Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 00:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe
-
Size
192KB
-
MD5
36ef18928d4b97ce244315c0a6ec4d49
-
SHA1
5fe5371c3002cacaa95fd17e8d339c4f346c277e
-
SHA256
ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069
-
SHA512
ecd05ddf6bf9314f7ba6d3cbf24924ceb64d8a9f913b05eaf53c028a11389122b42339ac7eb2a897d03dedb22afbf5f0e976c11f6ad7d746c9c1be582f8237ba
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+3Q:Ycm4FmowdHoSLEaTBftapTsyFeO3Q
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4480-6-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/912-20-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/516-43-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2212-68-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/528-217-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/404-232-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4560-276-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3136-275-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2308-272-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4544-253-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1192-248-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1172-241-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4416-211-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/380-207-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1648-203-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4948-187-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1352-170-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1196-150-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2504-143-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2692-132-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2016-121-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/840-116-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1628-284-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4456-101-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1772-99-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4772-93-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4124-91-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2100-81-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1960-75-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3556-63-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1892-57-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1812-289-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4644-42-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/224-32-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1692-26-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4000-21-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3688-12-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4772-301-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2528-308-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5048-310-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1392-347-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4948-356-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3572-358-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2772-366-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1328-378-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2056-395-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3888-423-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4120-425-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4276-461-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3984-478-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/760-509-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1372-537-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/744-557-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1352-564-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2672-586-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5036-623-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2760-649-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1168-665-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4612-678-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1100-885-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4480-906-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2104-946-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/744-995-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1272-1335-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4480-0-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000c0000000233da-3.dat UPX behavioral2/memory/4480-6-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0008000000023423-9.dat UPX behavioral2/files/0x0007000000023427-14.dat UPX behavioral2/memory/912-20-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000700000002342b-40.dat UPX behavioral2/memory/516-43-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000700000002342c-48.dat UPX behavioral2/files/0x000700000002342e-59.dat UPX behavioral2/memory/2212-68-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0007000000023432-83.dat UPX behavioral2/files/0x0007000000023434-95.dat UPX behavioral2/files/0x0007000000023438-118.dat UPX behavioral2/files/0x000700000002343b-135.dat UPX behavioral2/files/0x0007000000023442-173.dat UPX behavioral2/memory/528-217-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/404-232-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4560-276-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/3136-275-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/2308-272-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4544-253-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1192-248-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1172-241-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4416-211-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/380-207-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1648-203-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4948-187-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0007000000023444-183.dat UPX behavioral2/files/0x0007000000023443-178.dat UPX behavioral2/memory/1352-170-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0007000000023441-167.dat UPX behavioral2/files/0x0007000000023440-162.dat UPX behavioral2/files/0x000700000002343f-157.dat UPX behavioral2/files/0x000700000002343e-152.dat UPX behavioral2/memory/1196-150-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000700000002343d-146.dat UPX behavioral2/memory/2504-143-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000700000002343c-140.dat UPX behavioral2/memory/2692-132-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000700000002343a-129.dat UPX behavioral2/files/0x0007000000023439-124.dat UPX behavioral2/memory/2016-121-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/840-116-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0007000000023437-112.dat UPX behavioral2/files/0x0007000000023436-107.dat UPX behavioral2/files/0x0007000000023435-103.dat UPX behavioral2/memory/1628-284-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4456-101-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1772-99-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4772-93-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4124-91-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0007000000023433-87.dat UPX behavioral2/memory/2100-81-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0007000000023431-77.dat UPX behavioral2/memory/1960-75-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x0007000000023430-71.dat UPX behavioral2/files/0x000700000002342f-65.dat UPX behavioral2/memory/3556-63-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1892-57-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000700000002342d-53.dat UPX behavioral2/memory/1812-289-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4644-42-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/files/0x000700000002342a-36.dat UPX -
Executes dropped EXE 64 IoCs
pid Process 3688 jpvpj.exe 912 lllfrlf.exe 4000 rlrrffx.exe 1692 hhtntt.exe 224 hbbtnh.exe 516 dpdpd.exe 4644 frrlxrf.exe 1892 xrfrlfr.exe 3556 thhbtt.exe 2212 nhhbnn.exe 1960 thhtnb.exe 2100 jvpjd.exe 4124 jpvpd.exe 4772 3xlxllf.exe 4456 flrlxxl.exe 1772 bhnnhb.exe 3128 nbnbnh.exe 840 jvdvj.exe 2016 1ppdd.exe 3212 xlrfrlf.exe 2692 ffflfxr.exe 2916 bnnhbt.exe 2504 tbhbtn.exe 1196 pdvpd.exe 2524 jjpjv.exe 3692 jjvpp.exe 1276 xfxrrrr.exe 1352 xflfxrl.exe 748 5nnnhh.exe 3120 hhhhbt.exe 4948 jvddv.exe 2220 vjjdv.exe 944 xrrfxxr.exe 4144 rfxrlff.exe 3336 9hhbbt.exe 1648 ttnhtn.exe 380 3djdv.exe 4416 jvvvj.exe 1480 rxlfrrl.exe 528 rxxrllx.exe 1104 1tttnh.exe 8 bthbnh.exe 1756 tntntt.exe 404 vdddv.exe 2520 7pvjp.exe 4180 xllfllx.exe 1172 xllfxrr.exe 1976 tnnhbb.exe 1192 bttnbb.exe 4544 dvjdd.exe 4980 pjvvp.exe 1788 ffxxfxr.exe 2448 xflllfx.exe 2988 bhthhb.exe 4876 tnnbnn.exe 408 pvvvj.exe 2308 vdjjp.exe 3136 rlxxlff.exe 4560 rfrrllf.exe 1628 ntttnn.exe 2484 9rxrlfr.exe 1812 lxxxxrl.exe 552 1ntntt.exe 2928 bnhnbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 3688 4480 ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe 81 PID 4480 wrote to memory of 3688 4480 ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe 81 PID 4480 wrote to memory of 3688 4480 ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe 81 PID 3688 wrote to memory of 912 3688 jpvpj.exe 82 PID 3688 wrote to memory of 912 3688 jpvpj.exe 82 PID 3688 wrote to memory of 912 3688 jpvpj.exe 82 PID 912 wrote to memory of 4000 912 lllfrlf.exe 83 PID 912 wrote to memory of 4000 912 lllfrlf.exe 83 PID 912 wrote to memory of 4000 912 lllfrlf.exe 83 PID 4000 wrote to memory of 1692 4000 rlrrffx.exe 84 PID 4000 wrote to memory of 1692 4000 rlrrffx.exe 84 PID 4000 wrote to memory of 1692 4000 rlrrffx.exe 84 PID 1692 wrote to memory of 224 1692 hhtntt.exe 85 PID 1692 wrote to memory of 224 1692 hhtntt.exe 85 PID 1692 wrote to memory of 224 1692 hhtntt.exe 85 PID 224 wrote to memory of 516 224 hbbtnh.exe 86 PID 224 wrote to memory of 516 224 hbbtnh.exe 86 PID 224 wrote to memory of 516 224 hbbtnh.exe 86 PID 516 wrote to memory of 4644 516 dpdpd.exe 87 PID 516 wrote to memory of 4644 516 dpdpd.exe 87 PID 516 wrote to memory of 4644 516 dpdpd.exe 87 PID 4644 wrote to memory of 1892 4644 frrlxrf.exe 88 PID 4644 wrote to memory of 1892 4644 frrlxrf.exe 88 PID 4644 wrote to memory of 1892 4644 frrlxrf.exe 88 PID 1892 wrote to memory of 3556 1892 xrfrlfr.exe 89 PID 1892 wrote to memory of 3556 1892 xrfrlfr.exe 89 PID 1892 wrote to memory of 3556 1892 xrfrlfr.exe 89 PID 3556 wrote to memory of 2212 3556 thhbtt.exe 90 PID 3556 wrote to memory of 2212 3556 thhbtt.exe 90 PID 3556 wrote to memory of 2212 3556 thhbtt.exe 90 PID 2212 wrote to memory of 1960 2212 nhhbnn.exe 91 PID 2212 wrote to memory of 1960 2212 nhhbnn.exe 91 PID 2212 wrote to memory of 1960 2212 nhhbnn.exe 91 PID 1960 wrote to memory of 2100 1960 thhtnb.exe 92 PID 1960 wrote to memory of 2100 1960 thhtnb.exe 92 PID 1960 wrote to memory of 2100 1960 thhtnb.exe 92 PID 2100 wrote to memory of 4124 2100 jvpjd.exe 93 PID 2100 wrote to memory of 4124 2100 jvpjd.exe 93 PID 2100 wrote to memory of 4124 2100 jvpjd.exe 93 PID 4124 wrote to memory of 4772 4124 jpvpd.exe 145 PID 4124 wrote to memory of 4772 4124 jpvpd.exe 145 PID 4124 wrote to memory of 4772 4124 jpvpd.exe 145 PID 4772 wrote to memory of 4456 4772 3xlxllf.exe 95 PID 4772 wrote to memory of 4456 4772 3xlxllf.exe 95 PID 4772 wrote to memory of 4456 4772 3xlxllf.exe 95 PID 4456 wrote to memory of 1772 4456 flrlxxl.exe 96 PID 4456 wrote to memory of 1772 4456 flrlxxl.exe 96 PID 4456 wrote to memory of 1772 4456 flrlxxl.exe 96 PID 1772 wrote to memory of 3128 1772 bhnnhb.exe 97 PID 1772 wrote to memory of 3128 1772 bhnnhb.exe 97 PID 1772 wrote to memory of 3128 1772 bhnnhb.exe 97 PID 3128 wrote to memory of 840 3128 nbnbnh.exe 98 PID 3128 wrote to memory of 840 3128 nbnbnh.exe 98 PID 3128 wrote to memory of 840 3128 nbnbnh.exe 98 PID 840 wrote to memory of 2016 840 jvdvj.exe 99 PID 840 wrote to memory of 2016 840 jvdvj.exe 99 PID 840 wrote to memory of 2016 840 jvdvj.exe 99 PID 2016 wrote to memory of 3212 2016 1ppdd.exe 100 PID 2016 wrote to memory of 3212 2016 1ppdd.exe 100 PID 2016 wrote to memory of 3212 2016 1ppdd.exe 100 PID 3212 wrote to memory of 2692 3212 xlrfrlf.exe 101 PID 3212 wrote to memory of 2692 3212 xlrfrlf.exe 101 PID 3212 wrote to memory of 2692 3212 xlrfrlf.exe 101 PID 2692 wrote to memory of 2916 2692 ffflfxr.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe"C:\Users\Admin\AppData\Local\Temp\ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\jpvpj.exec:\jpvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\lllfrlf.exec:\lllfrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\rlrrffx.exec:\rlrrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\hhtntt.exec:\hhtntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\hbbtnh.exec:\hbbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\dpdpd.exec:\dpdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\frrlxrf.exec:\frrlxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\xrfrlfr.exec:\xrfrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\thhbtt.exec:\thhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\nhhbnn.exec:\nhhbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\thhtnb.exec:\thhtnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\jvpjd.exec:\jvpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jpvpd.exec:\jpvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\3xlxllf.exec:\3xlxllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\flrlxxl.exec:\flrlxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\bhnnhb.exec:\bhnnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nbnbnh.exec:\nbnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\jvdvj.exec:\jvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\1ppdd.exec:\1ppdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xlrfrlf.exec:\xlrfrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\ffflfxr.exec:\ffflfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bnnhbt.exec:\bnnhbt.exe23⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tbhbtn.exec:\tbhbtn.exe24⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pdvpd.exec:\pdvpd.exe25⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jjpjv.exec:\jjpjv.exe26⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jjvpp.exec:\jjvpp.exe27⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xfxrrrr.exec:\xfxrrrr.exe28⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xflfxrl.exec:\xflfxrl.exe29⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5nnnhh.exec:\5nnnhh.exe30⤵
- Executes dropped EXE
PID:748 -
\??\c:\hhhhbt.exec:\hhhhbt.exe31⤵
- Executes dropped EXE
PID:3120 -
\??\c:\jvddv.exec:\jvddv.exe32⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vjjdv.exec:\vjjdv.exe33⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe34⤵
- Executes dropped EXE
PID:944 -
\??\c:\rfxrlff.exec:\rfxrlff.exe35⤵
- Executes dropped EXE
PID:4144 -
\??\c:\9hhbbt.exec:\9hhbbt.exe36⤵
- Executes dropped EXE
PID:3336 -
\??\c:\ttnhtn.exec:\ttnhtn.exe37⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3djdv.exec:\3djdv.exe38⤵
- Executes dropped EXE
PID:380 -
\??\c:\jvvvj.exec:\jvvvj.exe39⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe40⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rxxrllx.exec:\rxxrllx.exe41⤵
- Executes dropped EXE
PID:528 -
\??\c:\1tttnh.exec:\1tttnh.exe42⤵
- Executes dropped EXE
PID:1104 -
\??\c:\bthbnh.exec:\bthbnh.exe43⤵
- Executes dropped EXE
PID:8 -
\??\c:\tntntt.exec:\tntntt.exe44⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vdddv.exec:\vdddv.exe45⤵
- Executes dropped EXE
PID:404 -
\??\c:\7pvjp.exec:\7pvjp.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xllfllx.exec:\xllfllx.exe47⤵
- Executes dropped EXE
PID:4180 -
\??\c:\xllfxrr.exec:\xllfxrr.exe48⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tnnhbb.exec:\tnnhbb.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bttnbb.exec:\bttnbb.exe50⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvjdd.exec:\dvjdd.exe51⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pjvvp.exec:\pjvvp.exe52⤵
- Executes dropped EXE
PID:4980 -
\??\c:\ffxxfxr.exec:\ffxxfxr.exe53⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xflllfx.exec:\xflllfx.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bhthhb.exec:\bhthhb.exe55⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tnnbnn.exec:\tnnbnn.exe56⤵
- Executes dropped EXE
PID:4876 -
\??\c:\pvvvj.exec:\pvvvj.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\vdjjp.exec:\vdjjp.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rlxxlff.exec:\rlxxlff.exe59⤵
- Executes dropped EXE
PID:3136 -
\??\c:\rfrrllf.exec:\rfrrllf.exe60⤵
- Executes dropped EXE
PID:4560 -
\??\c:\ntttnn.exec:\ntttnn.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9rxrlfr.exec:\9rxrlfr.exe62⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lxxxxrl.exec:\lxxxxrl.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1ntntt.exec:\1ntntt.exe64⤵
- Executes dropped EXE
PID:552 -
\??\c:\bnhnbb.exec:\bnhnbb.exe65⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vjdpp.exec:\vjdpp.exe66⤵PID:4772
-
\??\c:\flffflr.exec:\flffflr.exe67⤵PID:656
-
\??\c:\llfxllx.exec:\llfxllx.exe68⤵PID:2528
-
\??\c:\tnnhnn.exec:\tnnhnn.exe69⤵PID:5048
-
\??\c:\pdjpv.exec:\pdjpv.exe70⤵PID:220
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe71⤵PID:3084
-
\??\c:\nntbhn.exec:\nntbhn.exe72⤵PID:3892
-
\??\c:\httnht.exec:\httnht.exe73⤵PID:2980
-
\??\c:\ddvjd.exec:\ddvjd.exe74⤵PID:3392
-
\??\c:\fllfxxx.exec:\fllfxxx.exe75⤵PID:2420
-
\??\c:\llrlrrx.exec:\llrlrrx.exe76⤵PID:3924
-
\??\c:\hbhhbb.exec:\hbhhbb.exe77⤵PID:4020
-
\??\c:\pjdvd.exec:\pjdvd.exe78⤵PID:4300
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe79⤵PID:3748
-
\??\c:\7hhhbn.exec:\7hhhbn.exe80⤵PID:2540
-
\??\c:\tnbbnt.exec:\tnbbnt.exe81⤵PID:1392
-
\??\c:\pdpdv.exec:\pdpdv.exe82⤵PID:612
-
\??\c:\lxxrllf.exec:\lxxrllf.exe83⤵PID:4948
-
\??\c:\hhnnnt.exec:\hhnnnt.exe84⤵PID:3572
-
\??\c:\7nhtnh.exec:\7nhtnh.exe85⤵PID:2652
-
\??\c:\7fllllr.exec:\7fllllr.exe86⤵PID:2772
-
\??\c:\bnnhhb.exec:\bnnhhb.exe87⤵PID:2340
-
\??\c:\vdjjd.exec:\vdjjd.exe88⤵PID:1376
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe89⤵PID:1328
-
\??\c:\vjvpj.exec:\vjvpj.exe90⤵PID:2488
-
\??\c:\vddpj.exec:\vddpj.exe91⤵PID:1176
-
\??\c:\nnttth.exec:\nnttth.exe92⤵PID:3600
-
\??\c:\rrlllll.exec:\rrlllll.exe93⤵PID:1312
-
\??\c:\hhhhbt.exec:\hhhhbt.exe94⤵PID:2056
-
\??\c:\dpjjv.exec:\dpjjv.exe95⤵PID:3884
-
\??\c:\dpjdp.exec:\dpjdp.exe96⤵PID:3596
-
\??\c:\vvddp.exec:\vvddp.exe97⤵PID:808
-
\??\c:\xrrlflf.exec:\xrrlflf.exe98⤵PID:3252
-
\??\c:\thnttt.exec:\thnttt.exe99⤵PID:1388
-
\??\c:\ttnhtt.exec:\ttnhtt.exe100⤵PID:396
-
\??\c:\xlffxxr.exec:\xlffxxr.exe101⤵PID:3864
-
\??\c:\bbbtnn.exec:\bbbtnn.exe102⤵PID:1988
-
\??\c:\ffxrxxl.exec:\ffxrxxl.exe103⤵PID:3888
-
\??\c:\jvvvp.exec:\jvvvp.exe104⤵PID:4120
-
\??\c:\9ddvj.exec:\9ddvj.exe105⤵PID:4544
-
\??\c:\hbhbtb.exec:\hbhbtb.exe106⤵PID:1916
-
\??\c:\3pvvj.exec:\3pvvj.exe107⤵PID:1368
-
\??\c:\lllffff.exec:\lllffff.exe108⤵PID:4356
-
\??\c:\pppjj.exec:\pppjj.exe109⤵PID:2264
-
\??\c:\nthhhh.exec:\nthhhh.exe110⤵PID:4424
-
\??\c:\pjpjd.exec:\pjpjd.exe111⤵PID:3720
-
\??\c:\9vdjd.exec:\9vdjd.exe112⤵PID:4876
-
\??\c:\fllfrxr.exec:\fllfrxr.exe113⤵PID:412
-
\??\c:\7tnnth.exec:\7tnnth.exe114⤵PID:3424
-
\??\c:\djpjd.exec:\djpjd.exe115⤵PID:4276
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe116⤵PID:1476
-
\??\c:\thtnhh.exec:\thtnhh.exe117⤵PID:4784
-
\??\c:\nttnbb.exec:\nttnbb.exe118⤵PID:4812
-
\??\c:\vvvvd.exec:\vvvvd.exe119⤵PID:3688
-
\??\c:\frllllf.exec:\frllllf.exe120⤵PID:3984
-
\??\c:\1rrrffl.exec:\1rrrffl.exe121⤵PID:4496
-
\??\c:\bnbbtt.exec:\bnbbtt.exe122⤵PID:432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-