Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 01:14
Behavioral task
behavioral1
Sample
0b00471d05fbec8dd89515394b80f290.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0b00471d05fbec8dd89515394b80f290.exe
-
Size
285KB
-
MD5
0b00471d05fbec8dd89515394b80f290
-
SHA1
4aa9a985ace19b0d038111d1afde7b4234f0c54a
-
SHA256
6c41fdb38c34bf7a747ce56735724d39b0e49b359db808a41da4b08b7016e141
-
SHA512
980850f5a3daa22c203ed1e3af85e686843cee9198bf5d979b6af2684114019e145a413ee0ffa6fb8b3ab13ca2937efae0188952acdb65fa57879b671f0ef9fe
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4t+IDvSXrh5g8hZTyoImg:y4wFHoS3eFp3IDvSbh5nP+oImg
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3220-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2812-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-703-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-1481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1236 tnttbh.exe 4224 pvjdj.exe 2620 lfxrrrl.exe 4780 bnnntt.exe 3176 djjdp.exe 680 rrffxff.exe 2896 3ttnhh.exe 3976 pvjdd.exe 3380 xxrrlfr.exe 1724 3btnhh.exe 2148 fffxxxx.exe 3948 vdpjd.exe 4860 pvddv.exe 1404 rxfxxrl.exe 1240 1jdvv.exe 2168 bbhhbh.exe 968 xfrrffl.exe 1464 hbtnnn.exe 2916 xrxxrlf.exe 4252 btbnbt.exe 4508 xflxfll.exe 1088 7tbnbt.exe 4368 lxrrlll.exe 116 xflfrrr.exe 2360 tnbhhh.exe 4324 dvvvp.exe 4660 tbtbbh.exe 2220 7pdjv.exe 2724 vpvpj.exe 1280 fxflxlx.exe 1740 hhttbb.exe 1168 ntnbnh.exe 4516 fxrrlrl.exe 1728 ppvvj.exe 2484 htbhnn.exe 512 pjjjd.exe 1444 btttnh.exe 5088 jvppv.exe 2044 hnbttb.exe 4828 pvjvj.exe 3688 xflfrfr.exe 3184 ttbhnt.exe 1996 vpjjp.exe 1732 tttttb.exe 4628 1dvpv.exe 1492 hhbtth.exe 4612 vdpdp.exe 1500 jdjjj.exe 2772 lfrlrrr.exe 4312 7bbbtt.exe 1956 pvdvp.exe 536 vjjjv.exe 3480 bbnnnn.exe 3828 jjdjd.exe 2812 flfxxxx.exe 3204 nttbbb.exe 3400 lxlxflr.exe 2992 ntnbnt.exe 3252 jvpjp.exe 4388 1bbtnn.exe 3648 9ppjj.exe 2700 hhtbtn.exe 1292 9pjjd.exe 3412 fxxxrfx.exe -
resource yara_rule behavioral2/memory/3220-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023270-3.dat upx behavioral2/memory/1236-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c1-10.dat upx behavioral2/files/0x00070000000233c2-16.dat upx behavioral2/memory/2620-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1236-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4224-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c3-23.dat upx behavioral2/memory/2620-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c4-28.dat upx behavioral2/memory/4780-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c5-33.dat upx behavioral2/memory/3176-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c6-42.dat upx behavioral2/files/0x00070000000233c7-45.dat upx behavioral2/files/0x00070000000233c8-50.dat upx behavioral2/memory/3976-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/680-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3380-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1724-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c9-56.dat upx behavioral2/files/0x00070000000233ca-63.dat upx behavioral2/files/0x00070000000233cb-68.dat upx behavioral2/memory/2148-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3948-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cc-76.dat upx behavioral2/files/0x00070000000233cd-81.dat upx behavioral2/files/0x00070000000233ce-86.dat upx behavioral2/memory/1404-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d0-90.dat upx behavioral2/memory/2168-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233be-95.dat upx behavioral2/files/0x00070000000233d1-101.dat upx behavioral2/memory/968-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d2-107.dat upx behavioral2/memory/2916-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1464-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d3-114.dat upx behavioral2/files/0x00070000000233d4-119.dat upx behavioral2/files/0x00070000000233d5-126.dat upx behavioral2/memory/1088-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4252-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d6-131.dat upx behavioral2/files/0x00070000000233d7-136.dat upx behavioral2/memory/116-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d8-142.dat upx behavioral2/memory/2360-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d9-147.dat upx behavioral2/files/0x00070000000233da-154.dat upx behavioral2/files/0x00070000000233db-158.dat upx behavioral2/files/0x00070000000233dc-164.dat upx behavioral2/memory/2724-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233dd-171.dat upx behavioral2/files/0x00070000000233de-177.dat upx behavioral2/memory/1740-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1280-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2220-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233df-182.dat upx behavioral2/memory/4516-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1728-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1444-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5088-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4828-216-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 1236 3220 0b00471d05fbec8dd89515394b80f290.exe 81 PID 3220 wrote to memory of 1236 3220 0b00471d05fbec8dd89515394b80f290.exe 81 PID 3220 wrote to memory of 1236 3220 0b00471d05fbec8dd89515394b80f290.exe 81 PID 1236 wrote to memory of 4224 1236 tnttbh.exe 82 PID 1236 wrote to memory of 4224 1236 tnttbh.exe 82 PID 1236 wrote to memory of 4224 1236 tnttbh.exe 82 PID 4224 wrote to memory of 2620 4224 pvjdj.exe 83 PID 4224 wrote to memory of 2620 4224 pvjdj.exe 83 PID 4224 wrote to memory of 2620 4224 pvjdj.exe 83 PID 2620 wrote to memory of 4780 2620 lfxrrrl.exe 84 PID 2620 wrote to memory of 4780 2620 lfxrrrl.exe 84 PID 2620 wrote to memory of 4780 2620 lfxrrrl.exe 84 PID 4780 wrote to memory of 3176 4780 bnnntt.exe 85 PID 4780 wrote to memory of 3176 4780 bnnntt.exe 85 PID 4780 wrote to memory of 3176 4780 bnnntt.exe 85 PID 3176 wrote to memory of 680 3176 djjdp.exe 86 PID 3176 wrote to memory of 680 3176 djjdp.exe 86 PID 3176 wrote to memory of 680 3176 djjdp.exe 86 PID 680 wrote to memory of 2896 680 rrffxff.exe 87 PID 680 wrote to memory of 2896 680 rrffxff.exe 87 PID 680 wrote to memory of 2896 680 rrffxff.exe 87 PID 2896 wrote to memory of 3976 2896 3ttnhh.exe 88 PID 2896 wrote to memory of 3976 2896 3ttnhh.exe 88 PID 2896 wrote to memory of 3976 2896 3ttnhh.exe 88 PID 3976 wrote to memory of 3380 3976 pvjdd.exe 89 PID 3976 wrote to memory of 3380 3976 pvjdd.exe 89 PID 3976 wrote to memory of 3380 3976 pvjdd.exe 89 PID 3380 wrote to memory of 1724 3380 xxrrlfr.exe 90 PID 3380 wrote to memory of 1724 3380 xxrrlfr.exe 90 PID 3380 wrote to memory of 1724 3380 xxrrlfr.exe 90 PID 1724 wrote to memory of 2148 1724 3btnhh.exe 91 PID 1724 wrote to memory of 2148 1724 3btnhh.exe 91 PID 1724 wrote to memory of 2148 1724 3btnhh.exe 91 PID 2148 wrote to memory of 3948 2148 fffxxxx.exe 92 PID 2148 wrote to memory of 3948 2148 fffxxxx.exe 92 PID 2148 wrote to memory of 3948 2148 fffxxxx.exe 92 PID 3948 wrote to memory of 4860 3948 vdpjd.exe 93 PID 3948 wrote to memory of 4860 3948 vdpjd.exe 93 PID 3948 wrote to memory of 4860 3948 vdpjd.exe 93 PID 4860 wrote to memory of 1404 4860 pvddv.exe 94 PID 4860 wrote to memory of 1404 4860 pvddv.exe 94 PID 4860 wrote to memory of 1404 4860 pvddv.exe 94 PID 1404 wrote to memory of 1240 1404 rxfxxrl.exe 95 PID 1404 wrote to memory of 1240 1404 rxfxxrl.exe 95 PID 1404 wrote to memory of 1240 1404 rxfxxrl.exe 95 PID 1240 wrote to memory of 2168 1240 1jdvv.exe 96 PID 1240 wrote to memory of 2168 1240 1jdvv.exe 96 PID 1240 wrote to memory of 2168 1240 1jdvv.exe 96 PID 2168 wrote to memory of 968 2168 bbhhbh.exe 97 PID 2168 wrote to memory of 968 2168 bbhhbh.exe 97 PID 2168 wrote to memory of 968 2168 bbhhbh.exe 97 PID 968 wrote to memory of 1464 968 xfrrffl.exe 98 PID 968 wrote to memory of 1464 968 xfrrffl.exe 98 PID 968 wrote to memory of 1464 968 xfrrffl.exe 98 PID 1464 wrote to memory of 2916 1464 hbtnnn.exe 99 PID 1464 wrote to memory of 2916 1464 hbtnnn.exe 99 PID 1464 wrote to memory of 2916 1464 hbtnnn.exe 99 PID 2916 wrote to memory of 4252 2916 xrxxrlf.exe 100 PID 2916 wrote to memory of 4252 2916 xrxxrlf.exe 100 PID 2916 wrote to memory of 4252 2916 xrxxrlf.exe 100 PID 4252 wrote to memory of 4508 4252 btbnbt.exe 101 PID 4252 wrote to memory of 4508 4252 btbnbt.exe 101 PID 4252 wrote to memory of 4508 4252 btbnbt.exe 101 PID 4508 wrote to memory of 1088 4508 xflxfll.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b00471d05fbec8dd89515394b80f290.exe"C:\Users\Admin\AppData\Local\Temp\0b00471d05fbec8dd89515394b80f290.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\tnttbh.exec:\tnttbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\pvjdj.exec:\pvjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bnnntt.exec:\bnnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\djjdp.exec:\djjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\rrffxff.exec:\rrffxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\3ttnhh.exec:\3ttnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pvjdd.exec:\pvjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\xxrrlfr.exec:\xxrrlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\3btnhh.exec:\3btnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\fffxxxx.exec:\fffxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vdpjd.exec:\vdpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\pvddv.exec:\pvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\rxfxxrl.exec:\rxfxxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\1jdvv.exec:\1jdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\bbhhbh.exec:\bbhhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xfrrffl.exec:\xfrrffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\hbtnnn.exec:\hbtnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\xrxxrlf.exec:\xrxxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\btbnbt.exec:\btbnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\xflxfll.exec:\xflxfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\7tbnbt.exec:\7tbnbt.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lxrrlll.exec:\lxrrlll.exe24⤵
- Executes dropped EXE
PID:4368 -
\??\c:\xflfrrr.exec:\xflfrrr.exe25⤵
- Executes dropped EXE
PID:116 -
\??\c:\tnbhhh.exec:\tnbhhh.exe26⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dvvvp.exec:\dvvvp.exe27⤵
- Executes dropped EXE
PID:4324 -
\??\c:\tbtbbh.exec:\tbtbbh.exe28⤵
- Executes dropped EXE
PID:4660 -
\??\c:\7pdjv.exec:\7pdjv.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpvpj.exec:\vpvpj.exe30⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxflxlx.exec:\fxflxlx.exe31⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hhttbb.exec:\hhttbb.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ntnbnh.exec:\ntnbnh.exe33⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fxrrlrl.exec:\fxrrlrl.exe34⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ppvvj.exec:\ppvvj.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\htbhnn.exec:\htbhnn.exe36⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pjjjd.exec:\pjjjd.exe37⤵
- Executes dropped EXE
PID:512 -
\??\c:\btttnh.exec:\btttnh.exe38⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jvppv.exec:\jvppv.exe39⤵
- Executes dropped EXE
PID:5088 -
\??\c:\hnbttb.exec:\hnbttb.exe40⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pvjvj.exec:\pvjvj.exe41⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xflfrfr.exec:\xflfrfr.exe42⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ttbhnt.exec:\ttbhnt.exe43⤵
- Executes dropped EXE
PID:3184 -
\??\c:\vpjjp.exec:\vpjjp.exe44⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tttttb.exec:\tttttb.exe45⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1dvpv.exec:\1dvpv.exe46⤵
- Executes dropped EXE
PID:4628 -
\??\c:\hhbtth.exec:\hhbtth.exe47⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vdpdp.exec:\vdpdp.exe48⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jdjjj.exec:\jdjjj.exe49⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7bbbtt.exec:\7bbbtt.exe51⤵
- Executes dropped EXE
PID:4312 -
\??\c:\pvdvp.exec:\pvdvp.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vjjjv.exec:\vjjjv.exe53⤵
- Executes dropped EXE
PID:536 -
\??\c:\bbnnnn.exec:\bbnnnn.exe54⤵
- Executes dropped EXE
PID:3480 -
\??\c:\jjdjd.exec:\jjdjd.exe55⤵
- Executes dropped EXE
PID:3828 -
\??\c:\flfxxxx.exec:\flfxxxx.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nttbbb.exec:\nttbbb.exe57⤵
- Executes dropped EXE
PID:3204 -
\??\c:\lxlxflr.exec:\lxlxflr.exe58⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ntnbnt.exec:\ntnbnt.exe59⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jvpjp.exec:\jvpjp.exe60⤵
- Executes dropped EXE
PID:3252 -
\??\c:\1bbtnn.exec:\1bbtnn.exe61⤵
- Executes dropped EXE
PID:4388 -
\??\c:\9ppjj.exec:\9ppjj.exe62⤵
- Executes dropped EXE
PID:3648 -
\??\c:\hhtbtn.exec:\hhtbtn.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9pjjd.exec:\9pjjd.exe64⤵
- Executes dropped EXE
PID:1292 -
\??\c:\fxxxrfx.exec:\fxxxrfx.exe65⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bhntnt.exec:\bhntnt.exe66⤵PID:1524
-
\??\c:\lflllll.exec:\lflllll.exe67⤵PID:4532
-
\??\c:\llxlfff.exec:\llxlfff.exe68⤵PID:3572
-
\??\c:\bhtbht.exec:\bhtbht.exe69⤵PID:3820
-
\??\c:\dddjd.exec:\dddjd.exe70⤵PID:4676
-
\??\c:\rlxrlll.exec:\rlxrlll.exe71⤵PID:3468
-
\??\c:\nnnnnn.exec:\nnnnnn.exe72⤵PID:2536
-
\??\c:\dvpdj.exec:\dvpdj.exe73⤵PID:4088
-
\??\c:\ffllrrx.exec:\ffllrrx.exe74⤵PID:3616
-
\??\c:\lrrrllf.exec:\lrrrllf.exe75⤵PID:1644
-
\??\c:\hhntnt.exec:\hhntnt.exe76⤵PID:3236
-
\??\c:\jjppd.exec:\jjppd.exe77⤵PID:368
-
\??\c:\1xxxrff.exec:\1xxxrff.exe78⤵PID:2468
-
\??\c:\hnbbtn.exec:\hnbbtn.exe79⤵PID:3200
-
\??\c:\jpjdv.exec:\jpjdv.exe80⤵PID:1796
-
\??\c:\jpjpd.exec:\jpjpd.exe81⤵PID:2452
-
\??\c:\lrlfrrf.exec:\lrlfrrf.exe82⤵PID:4376
-
\??\c:\hthntt.exec:\hthntt.exe83⤵PID:2324
-
\??\c:\vdddj.exec:\vdddj.exe84⤵PID:2232
-
\??\c:\pjjjj.exec:\pjjjj.exe85⤵PID:4668
-
\??\c:\djvpv.exec:\djvpv.exe86⤵PID:752
-
\??\c:\ffflrxx.exec:\ffflrxx.exe87⤵PID:1800
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe88⤵PID:2660
-
\??\c:\ppjdd.exec:\ppjdd.exe89⤵PID:4332
-
\??\c:\llxrfxr.exec:\llxrfxr.exe90⤵PID:4728
-
\??\c:\3flllll.exec:\3flllll.exe91⤵PID:2392
-
\??\c:\nhbbbh.exec:\nhbbbh.exe92⤵PID:3112
-
\??\c:\pjvvd.exec:\pjvvd.exe93⤵PID:2692
-
\??\c:\djvvv.exec:\djvvv.exe94⤵PID:4956
-
\??\c:\xllrxfl.exec:\xllrxfl.exe95⤵PID:3528
-
\??\c:\nbttnn.exec:\nbttnn.exe96⤵PID:4272
-
\??\c:\pvdpj.exec:\pvdpj.exe97⤵PID:2976
-
\??\c:\xfrxxrr.exec:\xfrxxrr.exe98⤵PID:4240
-
\??\c:\ttnbnh.exec:\ttnbnh.exe99⤵PID:2684
-
\??\c:\htbtth.exec:\htbtth.exe100⤵PID:4060
-
\??\c:\vvjpp.exec:\vvjpp.exe101⤵PID:2364
-
\??\c:\flxxxrf.exec:\flxxxrf.exe102⤵PID:1048
-
\??\c:\xlxrlrx.exec:\xlxrlrx.exe103⤵PID:1380
-
\??\c:\bbntht.exec:\bbntht.exe104⤵PID:1428
-
\??\c:\jpjvp.exec:\jpjvp.exe105⤵PID:1500
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe106⤵PID:4304
-
\??\c:\1bnhnn.exec:\1bnhnn.exe107⤵PID:4308
-
\??\c:\pdjdj.exec:\pdjdj.exe108⤵PID:3736
-
\??\c:\lxfflrl.exec:\lxfflrl.exe109⤵PID:4940
-
\??\c:\5tnhhn.exec:\5tnhhn.exe110⤵PID:3364
-
\??\c:\vpdjp.exec:\vpdjp.exe111⤵PID:2248
-
\??\c:\ppjvv.exec:\ppjvv.exe112⤵PID:2964
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe113⤵PID:2812
-
\??\c:\nnhnbt.exec:\nnhnbt.exe114⤵PID:3984
-
\??\c:\dddjd.exec:\dddjd.exe115⤵PID:3400
-
\??\c:\5xxxxxr.exec:\5xxxxxr.exe116⤵PID:2992
-
\??\c:\ffflxff.exec:\ffflxff.exe117⤵PID:4280
-
\??\c:\5bhbbh.exec:\5bhbbh.exe118⤵PID:2800
-
\??\c:\xrrrfrf.exec:\xrrrfrf.exe119⤵PID:3648
-
\??\c:\9frflxl.exec:\9frflxl.exe120⤵PID:4764
-
\??\c:\nhnhhh.exec:\nhnhhh.exe121⤵PID:2200
-
\??\c:\pjppp.exec:\pjppp.exe122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-