Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 02:04
Behavioral task
behavioral1
Sample
c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe
Resource
win7-20240419-en
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe
-
Size
424KB
-
MD5
b528fec4af832641128758aa11a969e7
-
SHA1
f9731ba919e3d015b7073db8a7a92541b67023f3
-
SHA256
c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33
-
SHA512
81832aa84caa02dbbc7965cbc52df3851d9faa5082385d816f90506cc12f81686c11ee76c88724273062453353f9ed79e0e5866bca5b8823cead81db64f7a21e
-
SSDEEP
12288:C4wFBh2F5BVzPSMh2F5BVzPSMh2F5BVzPS1:NL1ML1ML1m
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4780-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/364-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-654-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-736-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-755-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-782-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-833-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-879-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3652 nhnhhn.exe 1244 vdjdv.exe 3588 rlrlfxr.exe 2060 ppvvv.exe 1360 ddppv.exe 3892 9htnhn.exe 3644 pddvv.exe 1616 9ffxrlf.exe 2896 tnbnhn.exe 5032 dpdvv.exe 4520 htbtnh.exe 2200 rxfxffx.exe 1968 ttthnb.exe 4772 rxxrlll.exe 1088 9dddd.exe 3372 vpvpj.exe 4128 5jpjd.exe 216 7bthbh.exe 2116 rrlfxxl.exe 3700 vpppp.exe 2216 xrrlfxx.exe 1460 7rrxxll.exe 4016 vdjjd.exe 1600 bnbtnn.exe 4052 vdjdv.exe 4832 frxxxxx.exe 5080 3bhhhh.exe 2120 bhhhhn.exe 1496 3vpvv.exe 512 5rllflf.exe 4228 hhtnnn.exe 4976 vjdvv.exe 4860 ntnnbh.exe 1380 pvvvj.exe 4356 rxxrrxl.exe 4856 lrxxrlf.exe 2472 bnbbtt.exe 3608 dvdvp.exe 2304 xfllffr.exe 2060 btbttt.exe 3128 ddjdp.exe 1384 5fllflf.exe 3708 rrlfxxx.exe 4700 7nnhtb.exe 1616 dvvvp.exe 3592 pdpjj.exe 1788 fflfffl.exe 4112 bbtttt.exe 4440 nnnthb.exe 3184 vdpdp.exe 4936 lfrfxlr.exe 4784 nnbbth.exe 64 tnhbnn.exe 4844 dpppv.exe 4868 fxlrrlf.exe 4360 lrrxrxx.exe 4344 ntthnh.exe 1560 djvpp.exe 4128 rfllfrl.exe 4212 rlrllll.exe 5076 ththhh.exe 2100 hhbttt.exe 1264 dvvpj.exe 2584 5nnhbt.exe -
resource yara_rule behavioral2/memory/4780-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b6c-3.dat upx behavioral2/memory/4780-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3652-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b75-10.dat upx behavioral2/files/0x000a000000023b79-14.dat upx behavioral2/memory/1244-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3588-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7a-22.dat upx behavioral2/memory/2060-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7b-28.dat upx behavioral2/memory/2060-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-34.dat upx behavioral2/memory/3644-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-47.dat upx behavioral2/memory/3892-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7d-40.dat upx behavioral2/files/0x000a000000023b80-51.dat upx behavioral2/memory/1616-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b81-56.dat upx behavioral2/memory/5032-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-61.dat upx behavioral2/files/0x000a000000023b83-66.dat upx behavioral2/memory/4520-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-72.dat upx behavioral2/memory/2200-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b76-77.dat upx behavioral2/memory/1968-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-82.dat upx behavioral2/memory/4772-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-88.dat upx behavioral2/memory/3372-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-94.dat upx behavioral2/files/0x000a000000023b88-99.dat upx behavioral2/memory/216-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-106.dat upx behavioral2/files/0x000b000000023b8a-112.dat upx behavioral2/memory/2116-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b8c-117.dat upx behavioral2/memory/3700-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-123.dat upx behavioral2/memory/1460-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8e-128.dat upx behavioral2/files/0x0006000000022aa6-133.dat upx behavioral2/memory/1600-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-149.dat upx behavioral2/memory/5080-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-145.dat upx behavioral2/files/0x000b000000023b75-141.dat upx behavioral2/files/0x000a000000023b91-156.dat upx behavioral2/memory/2120-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-161.dat upx behavioral2/files/0x000a000000023b93-167.dat upx behavioral2/files/0x000a000000023b94-172.dat upx behavioral2/memory/4228-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-178.dat upx behavioral2/memory/4860-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1380-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4356-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4856-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4856-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2472-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3608-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2304-209-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 3652 4780 c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe 83 PID 4780 wrote to memory of 3652 4780 c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe 83 PID 4780 wrote to memory of 3652 4780 c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe 83 PID 3652 wrote to memory of 1244 3652 nhnhhn.exe 84 PID 3652 wrote to memory of 1244 3652 nhnhhn.exe 84 PID 3652 wrote to memory of 1244 3652 nhnhhn.exe 84 PID 1244 wrote to memory of 3588 1244 vdjdv.exe 85 PID 1244 wrote to memory of 3588 1244 vdjdv.exe 85 PID 1244 wrote to memory of 3588 1244 vdjdv.exe 85 PID 3588 wrote to memory of 2060 3588 rlrlfxr.exe 86 PID 3588 wrote to memory of 2060 3588 rlrlfxr.exe 86 PID 3588 wrote to memory of 2060 3588 rlrlfxr.exe 86 PID 2060 wrote to memory of 1360 2060 ppvvv.exe 87 PID 2060 wrote to memory of 1360 2060 ppvvv.exe 87 PID 2060 wrote to memory of 1360 2060 ppvvv.exe 87 PID 1360 wrote to memory of 3892 1360 ddppv.exe 88 PID 1360 wrote to memory of 3892 1360 ddppv.exe 88 PID 1360 wrote to memory of 3892 1360 ddppv.exe 88 PID 3892 wrote to memory of 3644 3892 9htnhn.exe 89 PID 3892 wrote to memory of 3644 3892 9htnhn.exe 89 PID 3892 wrote to memory of 3644 3892 9htnhn.exe 89 PID 3644 wrote to memory of 1616 3644 pddvv.exe 90 PID 3644 wrote to memory of 1616 3644 pddvv.exe 90 PID 3644 wrote to memory of 1616 3644 pddvv.exe 90 PID 1616 wrote to memory of 2896 1616 9ffxrlf.exe 91 PID 1616 wrote to memory of 2896 1616 9ffxrlf.exe 91 PID 1616 wrote to memory of 2896 1616 9ffxrlf.exe 91 PID 2896 wrote to memory of 5032 2896 tnbnhn.exe 93 PID 2896 wrote to memory of 5032 2896 tnbnhn.exe 93 PID 2896 wrote to memory of 5032 2896 tnbnhn.exe 93 PID 5032 wrote to memory of 4520 5032 dpdvv.exe 94 PID 5032 wrote to memory of 4520 5032 dpdvv.exe 94 PID 5032 wrote to memory of 4520 5032 dpdvv.exe 94 PID 4520 wrote to memory of 2200 4520 htbtnh.exe 95 PID 4520 wrote to memory of 2200 4520 htbtnh.exe 95 PID 4520 wrote to memory of 2200 4520 htbtnh.exe 95 PID 2200 wrote to memory of 1968 2200 rxfxffx.exe 97 PID 2200 wrote to memory of 1968 2200 rxfxffx.exe 97 PID 2200 wrote to memory of 1968 2200 rxfxffx.exe 97 PID 1968 wrote to memory of 4772 1968 ttthnb.exe 98 PID 1968 wrote to memory of 4772 1968 ttthnb.exe 98 PID 1968 wrote to memory of 4772 1968 ttthnb.exe 98 PID 4772 wrote to memory of 1088 4772 rxxrlll.exe 100 PID 4772 wrote to memory of 1088 4772 rxxrlll.exe 100 PID 4772 wrote to memory of 1088 4772 rxxrlll.exe 100 PID 1088 wrote to memory of 3372 1088 9dddd.exe 101 PID 1088 wrote to memory of 3372 1088 9dddd.exe 101 PID 1088 wrote to memory of 3372 1088 9dddd.exe 101 PID 3372 wrote to memory of 4128 3372 vpvpj.exe 102 PID 3372 wrote to memory of 4128 3372 vpvpj.exe 102 PID 3372 wrote to memory of 4128 3372 vpvpj.exe 102 PID 4128 wrote to memory of 216 4128 5jpjd.exe 103 PID 4128 wrote to memory of 216 4128 5jpjd.exe 103 PID 4128 wrote to memory of 216 4128 5jpjd.exe 103 PID 216 wrote to memory of 2116 216 7bthbh.exe 104 PID 216 wrote to memory of 2116 216 7bthbh.exe 104 PID 216 wrote to memory of 2116 216 7bthbh.exe 104 PID 2116 wrote to memory of 3700 2116 rrlfxxl.exe 105 PID 2116 wrote to memory of 3700 2116 rrlfxxl.exe 105 PID 2116 wrote to memory of 3700 2116 rrlfxxl.exe 105 PID 3700 wrote to memory of 2216 3700 vpppp.exe 106 PID 3700 wrote to memory of 2216 3700 vpppp.exe 106 PID 3700 wrote to memory of 2216 3700 vpppp.exe 106 PID 2216 wrote to memory of 1460 2216 xrrlfxx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe"C:\Users\Admin\AppData\Local\Temp\c5f3b10f32a049b9f14923551acb4aeabdb4f5a38d51e1780f6466887fe16f33.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\nhnhhn.exec:\nhnhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\vdjdv.exec:\vdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\ppvvv.exec:\ppvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\ddppv.exec:\ddppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\9htnhn.exec:\9htnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\pddvv.exec:\pddvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\tnbnhn.exec:\tnbnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dpdvv.exec:\dpdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\htbtnh.exec:\htbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\rxfxffx.exec:\rxfxffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\ttthnb.exec:\ttthnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rxxrlll.exec:\rxxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\9dddd.exec:\9dddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\vpvpj.exec:\vpvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\5jpjd.exec:\5jpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\7bthbh.exec:\7bthbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\rrlfxxl.exec:\rrlfxxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vpppp.exec:\vpppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\7rrxxll.exec:\7rrxxll.exe23⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vdjjd.exec:\vdjjd.exe24⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bnbtnn.exec:\bnbtnn.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vdjdv.exec:\vdjdv.exe26⤵
- Executes dropped EXE
PID:4052 -
\??\c:\frxxxxx.exec:\frxxxxx.exe27⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3bhhhh.exec:\3bhhhh.exe28⤵
- Executes dropped EXE
PID:5080 -
\??\c:\bhhhhn.exec:\bhhhhn.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3vpvv.exec:\3vpvv.exe30⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5rllflf.exec:\5rllflf.exe31⤵
- Executes dropped EXE
PID:512 -
\??\c:\hhtnnn.exec:\hhtnnn.exe32⤵
- Executes dropped EXE
PID:4228 -
\??\c:\vjdvv.exec:\vjdvv.exe33⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ntnnbh.exec:\ntnnbh.exe34⤵
- Executes dropped EXE
PID:4860 -
\??\c:\pvvvj.exec:\pvvvj.exe35⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rxxrrxl.exec:\rxxrrxl.exe36⤵
- Executes dropped EXE
PID:4356 -
\??\c:\lrxxrlf.exec:\lrxxrlf.exe37⤵
- Executes dropped EXE
PID:4856 -
\??\c:\bnbbtt.exec:\bnbbtt.exe38⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dvdvp.exec:\dvdvp.exe39⤵
- Executes dropped EXE
PID:3608 -
\??\c:\xfllffr.exec:\xfllffr.exe40⤵
- Executes dropped EXE
PID:2304 -
\??\c:\btbttt.exec:\btbttt.exe41⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddjdp.exec:\ddjdp.exe42⤵
- Executes dropped EXE
PID:3128 -
\??\c:\5fllflf.exec:\5fllflf.exe43⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe44⤵
- Executes dropped EXE
PID:3708 -
\??\c:\7nnhtb.exec:\7nnhtb.exe45⤵
- Executes dropped EXE
PID:4700 -
\??\c:\dvvvp.exec:\dvvvp.exe46⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pdpjj.exec:\pdpjj.exe47⤵
- Executes dropped EXE
PID:3592 -
\??\c:\fflfffl.exec:\fflfffl.exe48⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bbtttt.exec:\bbtttt.exe49⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nnnthb.exec:\nnnthb.exe50⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vdpdp.exec:\vdpdp.exe51⤵
- Executes dropped EXE
PID:3184 -
\??\c:\lfrfxlr.exec:\lfrfxlr.exe52⤵
- Executes dropped EXE
PID:4936 -
\??\c:\nnbbth.exec:\nnbbth.exe53⤵
- Executes dropped EXE
PID:4784 -
\??\c:\tnhbnn.exec:\tnhbnn.exe54⤵
- Executes dropped EXE
PID:64 -
\??\c:\dpppv.exec:\dpppv.exe55⤵
- Executes dropped EXE
PID:4844 -
\??\c:\fxlrrlf.exec:\fxlrrlf.exe56⤵
- Executes dropped EXE
PID:4868 -
\??\c:\lrrxrxx.exec:\lrrxrxx.exe57⤵
- Executes dropped EXE
PID:4360 -
\??\c:\ntthnh.exec:\ntthnh.exe58⤵
- Executes dropped EXE
PID:4344 -
\??\c:\djvpp.exec:\djvpp.exe59⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rfllfrl.exec:\rfllfrl.exe60⤵
- Executes dropped EXE
PID:4128 -
\??\c:\rlrllll.exec:\rlrllll.exe61⤵
- Executes dropped EXE
PID:4212 -
\??\c:\ththhh.exec:\ththhh.exe62⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hhbttt.exec:\hhbttt.exe63⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvvpj.exec:\dvvpj.exe64⤵
- Executes dropped EXE
PID:1264 -
\??\c:\5nnhbt.exec:\5nnhbt.exe65⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe66⤵PID:1836
-
\??\c:\htbtnn.exec:\htbtnn.exe67⤵PID:2140
-
\??\c:\dvpjj.exec:\dvpjj.exe68⤵PID:3900
-
\??\c:\1lfxrxr.exec:\1lfxrxr.exe69⤵PID:1600
-
\??\c:\fflfxrl.exec:\fflfxrl.exe70⤵PID:2364
-
\??\c:\flrrrrr.exec:\flrrrrr.exe71⤵PID:2832
-
\??\c:\3ffrlxr.exec:\3ffrlxr.exe72⤵PID:1200
-
\??\c:\xrffxfr.exec:\xrffxfr.exe73⤵PID:2464
-
\??\c:\1hnhhh.exec:\1hnhhh.exe74⤵PID:4496
-
\??\c:\dvvvp.exec:\dvvvp.exe75⤵PID:4900
-
\??\c:\rlffxxx.exec:\rlffxxx.exe76⤵PID:2916
-
\??\c:\btbtnn.exec:\btbtnn.exe77⤵PID:512
-
\??\c:\5tbnhh.exec:\5tbnhh.exe78⤵PID:1544
-
\??\c:\vjppj.exec:\vjppj.exe79⤵PID:4544
-
\??\c:\5llfxxl.exec:\5llfxxl.exe80⤵PID:2108
-
\??\c:\hhbbhn.exec:\hhbbhn.exe81⤵PID:4860
-
\??\c:\djvpp.exec:\djvpp.exe82⤵PID:2924
-
\??\c:\djddv.exec:\djddv.exe83⤵PID:4468
-
\??\c:\9lrlffx.exec:\9lrlffx.exe84⤵PID:3492
-
\??\c:\tnbbnh.exec:\tnbbnh.exe85⤵PID:3180
-
\??\c:\jjddj.exec:\jjddj.exe86⤵PID:624
-
\??\c:\9rxrrrr.exec:\9rxrrrr.exe87⤵PID:4396
-
\??\c:\tntnnn.exec:\tntnnn.exe88⤵PID:2304
-
\??\c:\vppjd.exec:\vppjd.exe89⤵PID:2628
-
\??\c:\3vpjd.exec:\3vpjd.exe90⤵PID:1368
-
\??\c:\9rrllll.exec:\9rrllll.exe91⤵PID:3644
-
\??\c:\nnhbnh.exec:\nnhbnh.exe92⤵PID:2656
-
\??\c:\btnhhb.exec:\btnhhb.exe93⤵PID:4616
-
\??\c:\7pppd.exec:\7pppd.exe94⤵PID:5000
-
\??\c:\3llfxxr.exec:\3llfxxr.exe95⤵PID:2872
-
\??\c:\rxxrxrx.exec:\rxxrxrx.exe96⤵PID:2776
-
\??\c:\bttnnh.exec:\bttnnh.exe97⤵PID:5032
-
\??\c:\dvjjj.exec:\dvjjj.exe98⤵PID:5100
-
\??\c:\5jpjp.exec:\5jpjp.exe99⤵PID:4440
-
\??\c:\lxllxxx.exec:\lxllxxx.exe100⤵PID:3184
-
\??\c:\ttnhnt.exec:\ttnhnt.exe101⤵PID:2248
-
\??\c:\3djjv.exec:\3djjv.exe102⤵PID:4784
-
\??\c:\lllfrrl.exec:\lllfrrl.exe103⤵PID:64
-
\??\c:\9rllfff.exec:\9rllfff.exe104⤵PID:2160
-
\??\c:\nbtbnn.exec:\nbtbnn.exe105⤵PID:1088
-
\??\c:\1vvpp.exec:\1vvpp.exe106⤵PID:3372
-
\??\c:\rrrrrll.exec:\rrrrrll.exe107⤵PID:4344
-
\??\c:\lrfrrrr.exec:\lrfrrrr.exe108⤵PID:4120
-
\??\c:\nbhbtt.exec:\nbhbtt.exe109⤵PID:4128
-
\??\c:\9pvpj.exec:\9pvpj.exe110⤵PID:1320
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe111⤵PID:5076
-
\??\c:\1xxxrxx.exec:\1xxxrxx.exe112⤵PID:2580
-
\??\c:\nbbhnn.exec:\nbbhnn.exe113⤵PID:364
-
\??\c:\3vdvp.exec:\3vdvp.exe114⤵PID:4788
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe115⤵PID:2176
-
\??\c:\nhnhbn.exec:\nhnhbn.exe116⤵PID:1792
-
\??\c:\vvvvv.exec:\vvvvv.exe117⤵PID:1464
-
\??\c:\3dvvd.exec:\3dvvd.exe118⤵PID:552
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe119⤵PID:1760
-
\??\c:\tnnhhh.exec:\tnnhhh.exe120⤵PID:4444
-
\??\c:\pdjdd.exec:\pdjdd.exe121⤵PID:2364
-
\??\c:\9frlllr.exec:\9frlllr.exe122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-