Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d.exe
-
Size
84KB
-
MD5
07bf44c783963132cb3744ac5fd31141
-
SHA1
1d463822299829abd0183dc3715c33f86ba9f9a9
-
SHA256
073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d
-
SHA512
b32a286ff8949ec97361ccbc536403bd42fd7952f54ccfe1eb19577273d50b9f590689bf83dbc674603e003dda4be090dab9a965e5e78c3979fb3b17a361c6c6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgt7WxZKmNDnX77lY8/X5Qgrciv:ymb3NkkiQ3mdBjFIgte0mNb77Bptfr
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3332-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2484-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4932-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2196-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/952-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/952-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1752-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4100-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2540-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3100-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3644-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1212-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4112-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/860-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4388-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1584-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/220-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1600-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1252-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2344-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2880-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2864 lxfxrrl.exe 2148 bbbbtb.exe 4656 bttnhb.exe 2484 dvdpv.exe 2728 lfrrlxx.exe 4932 htnnnt.exe 2196 9ttbnn.exe 952 pjdvd.exe 1752 htbbbb.exe 4100 nbhhbt.exe 2540 jpppp.exe 3100 xxlfxlf.exe 3644 3htttt.exe 1212 ppjvd.exe 1904 lxxrfxr.exe 4112 hhbtbb.exe 860 vpjdv.exe 4388 xrfxllr.exe 1584 nnbhbb.exe 220 ddpjd.exe 1600 7lfxllf.exe 2440 7ntttn.exe 5104 jdjpj.exe 756 jpppj.exe 1252 xllllll.exe 4184 9httnn.exe 4512 bbbbnn.exe 2344 vddvv.exe 2880 5rrlxlr.exe 4288 3httnn.exe 2352 vpdvj.exe 3532 xrlfxff.exe 4628 frrrllf.exe 552 bntnnh.exe 4116 thnthb.exe 1856 pvvpd.exe 2872 lxrrrlf.exe 2472 7thbnn.exe 1700 tnntnn.exe 4452 vjjjd.exe 4536 rxrlfrf.exe 5100 nhbnhn.exe 5048 thnhbt.exe 748 vjvvv.exe 4348 7xxfffr.exe 2196 7bhhtt.exe 2416 1ppjj.exe 1408 pdpjj.exe 3596 ffllffx.exe 2136 nhtbbt.exe 4100 hthntt.exe 4044 pvddd.exe 760 lrfrlfr.exe 2176 xxlrrxf.exe 5028 nnhhhh.exe 348 htbhtb.exe 1212 jjvvp.exe 4108 rllfrxr.exe 2912 nhtnnn.exe 5036 ttthth.exe 4088 jjddv.exe 4388 3dddv.exe 2908 7flxflr.exe 2032 tnbthb.exe -
resource yara_rule behavioral2/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 2864 3332 073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d.exe 83 PID 3332 wrote to memory of 2864 3332 073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d.exe 83 PID 3332 wrote to memory of 2864 3332 073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d.exe 83 PID 2864 wrote to memory of 2148 2864 lxfxrrl.exe 84 PID 2864 wrote to memory of 2148 2864 lxfxrrl.exe 84 PID 2864 wrote to memory of 2148 2864 lxfxrrl.exe 84 PID 2148 wrote to memory of 4656 2148 bbbbtb.exe 85 PID 2148 wrote to memory of 4656 2148 bbbbtb.exe 85 PID 2148 wrote to memory of 4656 2148 bbbbtb.exe 85 PID 4656 wrote to memory of 2484 4656 bttnhb.exe 86 PID 4656 wrote to memory of 2484 4656 bttnhb.exe 86 PID 4656 wrote to memory of 2484 4656 bttnhb.exe 86 PID 2484 wrote to memory of 2728 2484 dvdpv.exe 87 PID 2484 wrote to memory of 2728 2484 dvdpv.exe 87 PID 2484 wrote to memory of 2728 2484 dvdpv.exe 87 PID 2728 wrote to memory of 4932 2728 lfrrlxx.exe 88 PID 2728 wrote to memory of 4932 2728 lfrrlxx.exe 88 PID 2728 wrote to memory of 4932 2728 lfrrlxx.exe 88 PID 4932 wrote to memory of 2196 4932 htnnnt.exe 89 PID 4932 wrote to memory of 2196 4932 htnnnt.exe 89 PID 4932 wrote to memory of 2196 4932 htnnnt.exe 89 PID 2196 wrote to memory of 952 2196 9ttbnn.exe 90 PID 2196 wrote to memory of 952 2196 9ttbnn.exe 90 PID 2196 wrote to memory of 952 2196 9ttbnn.exe 90 PID 952 wrote to memory of 1752 952 pjdvd.exe 91 PID 952 wrote to memory of 1752 952 pjdvd.exe 91 PID 952 wrote to memory of 1752 952 pjdvd.exe 91 PID 1752 wrote to memory of 4100 1752 htbbbb.exe 92 PID 1752 wrote to memory of 4100 1752 htbbbb.exe 92 PID 1752 wrote to memory of 4100 1752 htbbbb.exe 92 PID 4100 wrote to memory of 2540 4100 nbhhbt.exe 94 PID 4100 wrote to memory of 2540 4100 nbhhbt.exe 94 PID 4100 wrote to memory of 2540 4100 nbhhbt.exe 94 PID 2540 wrote to memory of 3100 2540 jpppp.exe 95 PID 2540 wrote to memory of 3100 2540 jpppp.exe 95 PID 2540 wrote to memory of 3100 2540 jpppp.exe 95 PID 3100 wrote to memory of 3644 3100 xxlfxlf.exe 96 PID 3100 wrote to memory of 3644 3100 xxlfxlf.exe 96 PID 3100 wrote to memory of 3644 3100 xxlfxlf.exe 96 PID 3644 wrote to memory of 1212 3644 3htttt.exe 97 PID 3644 wrote to memory of 1212 3644 3htttt.exe 97 PID 3644 wrote to memory of 1212 3644 3htttt.exe 97 PID 1212 wrote to memory of 1904 1212 ppjvd.exe 98 PID 1212 wrote to memory of 1904 1212 ppjvd.exe 98 PID 1212 wrote to memory of 1904 1212 ppjvd.exe 98 PID 1904 wrote to memory of 4112 1904 lxxrfxr.exe 99 PID 1904 wrote to memory of 4112 1904 lxxrfxr.exe 99 PID 1904 wrote to memory of 4112 1904 lxxrfxr.exe 99 PID 4112 wrote to memory of 860 4112 hhbtbb.exe 100 PID 4112 wrote to memory of 860 4112 hhbtbb.exe 100 PID 4112 wrote to memory of 860 4112 hhbtbb.exe 100 PID 860 wrote to memory of 4388 860 vpjdv.exe 102 PID 860 wrote to memory of 4388 860 vpjdv.exe 102 PID 860 wrote to memory of 4388 860 vpjdv.exe 102 PID 4388 wrote to memory of 1584 4388 xrfxllr.exe 103 PID 4388 wrote to memory of 1584 4388 xrfxllr.exe 103 PID 4388 wrote to memory of 1584 4388 xrfxllr.exe 103 PID 1584 wrote to memory of 220 1584 nnbhbb.exe 104 PID 1584 wrote to memory of 220 1584 nnbhbb.exe 104 PID 1584 wrote to memory of 220 1584 nnbhbb.exe 104 PID 220 wrote to memory of 1600 220 ddpjd.exe 105 PID 220 wrote to memory of 1600 220 ddpjd.exe 105 PID 220 wrote to memory of 1600 220 ddpjd.exe 105 PID 1600 wrote to memory of 2440 1600 7lfxllf.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d.exe"C:\Users\Admin\AppData\Local\Temp\073dc549aa6aecd244155473c7c1e1ab86c1017276fd022e6f4677f2a80bab9d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bbbbtb.exec:\bbbbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\bttnhb.exec:\bttnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\dvdpv.exec:\dvdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lfrrlxx.exec:\lfrrlxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\htnnnt.exec:\htnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\9ttbnn.exec:\9ttbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\pjdvd.exec:\pjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\htbbbb.exec:\htbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\nbhhbt.exec:\nbhhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\jpppp.exec:\jpppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xxlfxlf.exec:\xxlfxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\3htttt.exec:\3htttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\ppjvd.exec:\ppjvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hhbtbb.exec:\hhbtbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vpjdv.exec:\vpjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\xrfxllr.exec:\xrfxllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\nnbhbb.exec:\nnbhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\ddpjd.exec:\ddpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\7lfxllf.exec:\7lfxllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\7ntttn.exec:\7ntttn.exe23⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdjpj.exec:\jdjpj.exe24⤵
- Executes dropped EXE
PID:5104 -
\??\c:\jpppj.exec:\jpppj.exe25⤵
- Executes dropped EXE
PID:756 -
\??\c:\xllllll.exec:\xllllll.exe26⤵
- Executes dropped EXE
PID:1252 -
\??\c:\9httnn.exec:\9httnn.exe27⤵
- Executes dropped EXE
PID:4184 -
\??\c:\bbbbnn.exec:\bbbbnn.exe28⤵
- Executes dropped EXE
PID:4512 -
\??\c:\vddvv.exec:\vddvv.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5rrlxlr.exec:\5rrlxlr.exe30⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3httnn.exec:\3httnn.exe31⤵
- Executes dropped EXE
PID:4288 -
\??\c:\vpdvj.exec:\vpdvj.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xrlfxff.exec:\xrlfxff.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\frrrllf.exec:\frrrllf.exe34⤵
- Executes dropped EXE
PID:4628 -
\??\c:\bntnnh.exec:\bntnnh.exe35⤵
- Executes dropped EXE
PID:552 -
\??\c:\thnthb.exec:\thnthb.exe36⤵
- Executes dropped EXE
PID:4116 -
\??\c:\pvvpd.exec:\pvvpd.exe37⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lxrrrlf.exec:\lxrrrlf.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7thbnn.exec:\7thbnn.exe39⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tnntnn.exec:\tnntnn.exe40⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vjjjd.exec:\vjjjd.exe41⤵
- Executes dropped EXE
PID:4452 -
\??\c:\rxrlfrf.exec:\rxrlfrf.exe42⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nhbnhn.exec:\nhbnhn.exe43⤵
- Executes dropped EXE
PID:5100 -
\??\c:\thnhbt.exec:\thnhbt.exe44⤵
- Executes dropped EXE
PID:5048 -
\??\c:\vjvvv.exec:\vjvvv.exe45⤵
- Executes dropped EXE
PID:748 -
\??\c:\7xxfffr.exec:\7xxfffr.exe46⤵
- Executes dropped EXE
PID:4348 -
\??\c:\7bhhtt.exec:\7bhhtt.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1ppjj.exec:\1ppjj.exe48⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pdpjj.exec:\pdpjj.exe49⤵
- Executes dropped EXE
PID:1408 -
\??\c:\ffllffx.exec:\ffllffx.exe50⤵
- Executes dropped EXE
PID:3596 -
\??\c:\nhtbbt.exec:\nhtbbt.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hthntt.exec:\hthntt.exe52⤵
- Executes dropped EXE
PID:4100 -
\??\c:\pvddd.exec:\pvddd.exe53⤵
- Executes dropped EXE
PID:4044 -
\??\c:\lrfrlfr.exec:\lrfrlfr.exe54⤵
- Executes dropped EXE
PID:760 -
\??\c:\xxlrrxf.exec:\xxlrrxf.exe55⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nnhhhh.exec:\nnhhhh.exe56⤵
- Executes dropped EXE
PID:5028 -
\??\c:\htbhtb.exec:\htbhtb.exe57⤵
- Executes dropped EXE
PID:348 -
\??\c:\jjvvp.exec:\jjvvp.exe58⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rllfrxr.exec:\rllfrxr.exe59⤵
- Executes dropped EXE
PID:4108 -
\??\c:\nhtnnn.exec:\nhtnnn.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ttthth.exec:\ttthth.exe61⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jjddv.exec:\jjddv.exe62⤵
- Executes dropped EXE
PID:4088 -
\??\c:\3dddv.exec:\3dddv.exe63⤵
- Executes dropped EXE
PID:4388 -
\??\c:\7flxflr.exec:\7flxflr.exe64⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tnbthb.exec:\tnbthb.exe65⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1nnhtb.exec:\1nnhtb.exe66⤵PID:3308
-
\??\c:\jpppv.exec:\jpppv.exe67⤵PID:2456
-
\??\c:\lrxrxfl.exec:\lrxrxfl.exe68⤵PID:1532
-
\??\c:\tttntb.exec:\tttntb.exe69⤵PID:3584
-
\??\c:\3hntnn.exec:\3hntnn.exe70⤵PID:368
-
\??\c:\ppvpd.exec:\ppvpd.exe71⤵PID:3848
-
\??\c:\llrrlxr.exec:\llrrlxr.exe72⤵PID:1028
-
\??\c:\hbnntb.exec:\hbnntb.exe73⤵PID:2268
-
\??\c:\vdjdj.exec:\vdjdj.exe74⤵PID:1460
-
\??\c:\3llfxxx.exec:\3llfxxx.exe75⤵PID:2724
-
\??\c:\tnntnt.exec:\tnntnt.exe76⤵PID:4868
-
\??\c:\hhbtnh.exec:\hhbtnh.exe77⤵PID:4948
-
\??\c:\vvppv.exec:\vvppv.exe78⤵PID:2280
-
\??\c:\lxfffxr.exec:\lxfffxr.exe79⤵PID:3592
-
\??\c:\3ffxxrr.exec:\3ffxxrr.exe80⤵PID:2708
-
\??\c:\bnbttt.exec:\bnbttt.exe81⤵PID:4272
-
\??\c:\dvjdj.exec:\dvjdj.exe82⤵PID:4992
-
\??\c:\xrlxllf.exec:\xrlxllf.exe83⤵PID:4744
-
\??\c:\frrlxlf.exec:\frrlxlf.exe84⤵PID:4324
-
\??\c:\hbbhhh.exec:\hbbhhh.exe85⤵PID:4964
-
\??\c:\vdpvj.exec:\vdpvj.exe86⤵PID:5044
-
\??\c:\pddpj.exec:\pddpj.exe87⤵PID:1192
-
\??\c:\9rlllll.exec:\9rlllll.exe88⤵PID:4496
-
\??\c:\5lllfrl.exec:\5lllfrl.exe89⤵PID:4020
-
\??\c:\bnbbbh.exec:\bnbbbh.exe90⤵PID:4988
-
\??\c:\vpddv.exec:\vpddv.exe91⤵PID:2728
-
\??\c:\7djdp.exec:\7djdp.exe92⤵PID:1480
-
\??\c:\1rxrlrl.exec:\1rxrlrl.exe93⤵PID:2984
-
\??\c:\thhbtn.exec:\thhbtn.exe94⤵PID:3884
-
\??\c:\1nnnnh.exec:\1nnnnh.exe95⤵PID:952
-
\??\c:\jddvv.exec:\jddvv.exe96⤵PID:4084
-
\??\c:\xlffrrl.exec:\xlffrrl.exe97⤵PID:2408
-
\??\c:\rxlfrfl.exec:\rxlfrfl.exe98⤵PID:5112
-
\??\c:\7thbbb.exec:\7thbbb.exe99⤵PID:4736
-
\??\c:\7vvvj.exec:\7vvvj.exe100⤵PID:3956
-
\??\c:\5pddv.exec:\5pddv.exe101⤵PID:1288
-
\??\c:\llrrrrr.exec:\llrrrrr.exe102⤵PID:2676
-
\??\c:\7lxrrxx.exec:\7lxrrxx.exe103⤵PID:5116
-
\??\c:\hbhnbn.exec:\hbhnbn.exe104⤵PID:4640
-
\??\c:\dvvpj.exec:\dvvpj.exe105⤵PID:1016
-
\??\c:\jdjdd.exec:\jdjdd.exe106⤵PID:4864
-
\??\c:\xrllrrr.exec:\xrllrrr.exe107⤵PID:2208
-
\??\c:\5lffxxx.exec:\5lffxxx.exe108⤵PID:2556
-
\??\c:\tthtnt.exec:\tthtnt.exe109⤵PID:4816
-
\??\c:\thttbb.exec:\thttbb.exe110⤵PID:2988
-
\??\c:\ppddd.exec:\ppddd.exe111⤵PID:1484
-
\??\c:\pdjdp.exec:\pdjdp.exe112⤵PID:2544
-
\??\c:\lxfllfx.exec:\lxfllfx.exe113⤵PID:2980
-
\??\c:\1ttttb.exec:\1ttttb.exe114⤵PID:2440
-
\??\c:\bhnbbb.exec:\bhnbbb.exe115⤵PID:4360
-
\??\c:\nhnbbn.exec:\nhnbbn.exe116⤵PID:3860
-
\??\c:\vdjpp.exec:\vdjpp.exe117⤵PID:2360
-
\??\c:\tthbhn.exec:\tthbhn.exe118⤵PID:4184
-
\??\c:\nttnhh.exec:\nttnhh.exe119⤵PID:964
-
\??\c:\7pvdd.exec:\7pvdd.exe120⤵PID:3060
-
\??\c:\lxrflfl.exec:\lxrflfl.exe121⤵PID:2020
-
\??\c:\lllffll.exec:\lllffll.exe122⤵PID:3724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-