Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 17:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcd59a5d5abce27dc93da68869cab0a0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
bcd59a5d5abce27dc93da68869cab0a0N.exe
-
Size
67KB
-
MD5
bcd59a5d5abce27dc93da68869cab0a0
-
SHA1
9784ea18923646c33e031e75859a1556ac61d2f4
-
SHA256
7cfe0092b2321f7b90b56e25b6134b0d7022cb38f9453dfdb2a7ff87358f6d57
-
SHA512
cd455fedbbebc88b86c8a1e612e5bdb3ccc0778072e8bcb23a9b4d75b5b6172a14ccda78adb920afe583f8f58e5353c9b869b2ce17c6d939b8ed1ea53801e8af
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCO:ymb3NkkiQ3mdBjFIyna
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2272-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-90-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/968-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1904 djjvv.exe 1396 xlrrrll.exe 3060 3ntnnn.exe 2764 5btnhb.exe 2800 dvjdj.exe 2712 dvdpv.exe 2456 xfffxxx.exe 2544 xlrllll.exe 2980 1btnhb.exe 1664 3vdvv.exe 1512 vdpdv.exe 580 7xfffxx.exe 1028 3thbbb.exe 1232 thhhnn.exe 1912 1vjvv.exe 2036 lflrxlr.exe 1712 xrffflx.exe 2836 tbhnhh.exe 968 thbnhb.exe 2196 vpdvp.exe 2104 5lxlllr.exe 2928 xllrllr.exe 1360 7tnnnh.exe 1656 5thhhh.exe 112 5vjjd.exe 2168 fxlrxrr.exe 1468 bntntt.exe 1896 pjpvv.exe 2976 dvdpd.exe 1872 lflxxxx.exe 1564 9rrlffl.exe 2296 nbhhtn.exe 2644 1hnnhh.exe 2108 pdvvv.exe 2760 5jvpj.exe 2696 xrfffll.exe 1644 5xlflfl.exe 2820 htnntt.exe 2584 nbtnnb.exe 2688 dpjjj.exe 2624 7vdvp.exe 2600 lffrfxr.exe 2988 xllllll.exe 1268 tbnntn.exe 1976 thtttn.exe 1612 3vdvp.exe 1984 7djvp.exe 2360 5rffxxx.exe 1032 xlxxxrx.exe 1016 9jpvd.exe 1484 jvpjd.exe 2848 fxfflfl.exe 2788 5frxflx.exe 1496 ttthht.exe 2060 bntttt.exe 2236 nhnttn.exe 1104 pvpdd.exe 2860 5vvpv.exe 2532 lfxxrlf.exe 1588 bnttbb.exe 2000 tbhbnt.exe 2384 dpddv.exe 2424 vvjdd.exe 2168 xrfrffl.exe -
resource yara_rule behavioral1/memory/2272-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/968-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1904 2272 bcd59a5d5abce27dc93da68869cab0a0N.exe 31 PID 2272 wrote to memory of 1904 2272 bcd59a5d5abce27dc93da68869cab0a0N.exe 31 PID 2272 wrote to memory of 1904 2272 bcd59a5d5abce27dc93da68869cab0a0N.exe 31 PID 2272 wrote to memory of 1904 2272 bcd59a5d5abce27dc93da68869cab0a0N.exe 31 PID 1904 wrote to memory of 1396 1904 djjvv.exe 32 PID 1904 wrote to memory of 1396 1904 djjvv.exe 32 PID 1904 wrote to memory of 1396 1904 djjvv.exe 32 PID 1904 wrote to memory of 1396 1904 djjvv.exe 32 PID 1396 wrote to memory of 3060 1396 xlrrrll.exe 33 PID 1396 wrote to memory of 3060 1396 xlrrrll.exe 33 PID 1396 wrote to memory of 3060 1396 xlrrrll.exe 33 PID 1396 wrote to memory of 3060 1396 xlrrrll.exe 33 PID 3060 wrote to memory of 2764 3060 3ntnnn.exe 34 PID 3060 wrote to memory of 2764 3060 3ntnnn.exe 34 PID 3060 wrote to memory of 2764 3060 3ntnnn.exe 34 PID 3060 wrote to memory of 2764 3060 3ntnnn.exe 34 PID 2764 wrote to memory of 2800 2764 5btnhb.exe 35 PID 2764 wrote to memory of 2800 2764 5btnhb.exe 35 PID 2764 wrote to memory of 2800 2764 5btnhb.exe 35 PID 2764 wrote to memory of 2800 2764 5btnhb.exe 35 PID 2800 wrote to memory of 2712 2800 dvjdj.exe 36 PID 2800 wrote to memory of 2712 2800 dvjdj.exe 36 PID 2800 wrote to memory of 2712 2800 dvjdj.exe 36 PID 2800 wrote to memory of 2712 2800 dvjdj.exe 36 PID 2712 wrote to memory of 2456 2712 dvdpv.exe 37 PID 2712 wrote to memory of 2456 2712 dvdpv.exe 37 PID 2712 wrote to memory of 2456 2712 dvdpv.exe 37 PID 2712 wrote to memory of 2456 2712 dvdpv.exe 37 PID 2456 wrote to memory of 2544 2456 xfffxxx.exe 38 PID 2456 wrote to memory of 2544 2456 xfffxxx.exe 38 PID 2456 wrote to memory of 2544 2456 xfffxxx.exe 38 PID 2456 wrote to memory of 2544 2456 xfffxxx.exe 38 PID 2544 wrote to memory of 2980 2544 xlrllll.exe 39 PID 2544 wrote to memory of 2980 2544 xlrllll.exe 39 PID 2544 wrote to memory of 2980 2544 xlrllll.exe 39 PID 2544 wrote to memory of 2980 2544 xlrllll.exe 39 PID 2980 wrote to memory of 1664 2980 1btnhb.exe 40 PID 2980 wrote to memory of 1664 2980 1btnhb.exe 40 PID 2980 wrote to memory of 1664 2980 1btnhb.exe 40 PID 2980 wrote to memory of 1664 2980 1btnhb.exe 40 PID 1664 wrote to memory of 1512 1664 3vdvv.exe 41 PID 1664 wrote to memory of 1512 1664 3vdvv.exe 41 PID 1664 wrote to memory of 1512 1664 3vdvv.exe 41 PID 1664 wrote to memory of 1512 1664 3vdvv.exe 41 PID 1512 wrote to memory of 580 1512 vdpdv.exe 42 PID 1512 wrote to memory of 580 1512 vdpdv.exe 42 PID 1512 wrote to memory of 580 1512 vdpdv.exe 42 PID 1512 wrote to memory of 580 1512 vdpdv.exe 42 PID 580 wrote to memory of 1028 580 7xfffxx.exe 43 PID 580 wrote to memory of 1028 580 7xfffxx.exe 43 PID 580 wrote to memory of 1028 580 7xfffxx.exe 43 PID 580 wrote to memory of 1028 580 7xfffxx.exe 43 PID 1028 wrote to memory of 1232 1028 3thbbb.exe 44 PID 1028 wrote to memory of 1232 1028 3thbbb.exe 44 PID 1028 wrote to memory of 1232 1028 3thbbb.exe 44 PID 1028 wrote to memory of 1232 1028 3thbbb.exe 44 PID 1232 wrote to memory of 1912 1232 thhhnn.exe 45 PID 1232 wrote to memory of 1912 1232 thhhnn.exe 45 PID 1232 wrote to memory of 1912 1232 thhhnn.exe 45 PID 1232 wrote to memory of 1912 1232 thhhnn.exe 45 PID 1912 wrote to memory of 2036 1912 1vjvv.exe 46 PID 1912 wrote to memory of 2036 1912 1vjvv.exe 46 PID 1912 wrote to memory of 2036 1912 1vjvv.exe 46 PID 1912 wrote to memory of 2036 1912 1vjvv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcd59a5d5abce27dc93da68869cab0a0N.exe"C:\Users\Admin\AppData\Local\Temp\bcd59a5d5abce27dc93da68869cab0a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\djjvv.exec:\djjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\xlrrrll.exec:\xlrrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\3ntnnn.exec:\3ntnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\5btnhb.exec:\5btnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dvjdj.exec:\dvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dvdpv.exec:\dvdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xfffxxx.exec:\xfffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xlrllll.exec:\xlrllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1btnhb.exec:\1btnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3vdvv.exec:\3vdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vdpdv.exec:\vdpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\7xfffxx.exec:\7xfffxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\3thbbb.exec:\3thbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\thhhnn.exec:\thhhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\1vjvv.exec:\1vjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\lflrxlr.exec:\lflrxlr.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrffflx.exec:\xrffflx.exe18⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tbhnhh.exec:\tbhnhh.exe19⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thbnhb.exec:\thbnhb.exe20⤵
- Executes dropped EXE
PID:968 -
\??\c:\vpdvp.exec:\vpdvp.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5lxlllr.exec:\5lxlllr.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xllrllr.exec:\xllrllr.exe23⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7tnnnh.exec:\7tnnnh.exe24⤵
- Executes dropped EXE
PID:1360 -
\??\c:\5thhhh.exec:\5thhhh.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5vjjd.exec:\5vjjd.exe26⤵
- Executes dropped EXE
PID:112 -
\??\c:\fxlrxrr.exec:\fxlrxrr.exe27⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bntntt.exec:\bntntt.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pjpvv.exec:\pjpvv.exe29⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dvdpd.exec:\dvdpd.exe30⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lflxxxx.exec:\lflxxxx.exe31⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9rrlffl.exec:\9rrlffl.exe32⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nbhhtn.exec:\nbhhtn.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1hnnhh.exec:\1hnnhh.exe34⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pdvvv.exec:\pdvvv.exe35⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5jvpj.exec:\5jvpj.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrfffll.exec:\xrfffll.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5xlflfl.exec:\5xlflfl.exe38⤵
- Executes dropped EXE
PID:1644 -
\??\c:\htnntt.exec:\htnntt.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nbtnnb.exec:\nbtnnb.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpjjj.exec:\dpjjj.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7vdvp.exec:\7vdvp.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lffrfxr.exec:\lffrfxr.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xllllll.exec:\xllllll.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tbnntn.exec:\tbnntn.exe45⤵
- Executes dropped EXE
PID:1268 -
\??\c:\thtttn.exec:\thtttn.exe46⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3vdvp.exec:\3vdvp.exe47⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7djvp.exec:\7djvp.exe48⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5rffxxx.exec:\5rffxxx.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9jpvd.exec:\9jpvd.exe51⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jvpjd.exec:\jvpjd.exe52⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fxfflfl.exec:\fxfflfl.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5frxflx.exec:\5frxflx.exe54⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ttthht.exec:\ttthht.exe55⤵
- Executes dropped EXE
PID:1496 -
\??\c:\bntttt.exec:\bntttt.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nhnttn.exec:\nhnttn.exe57⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pvpdd.exec:\pvpdd.exe58⤵
- Executes dropped EXE
PID:1104 -
\??\c:\5vvpv.exec:\5vvpv.exe59⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe60⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bnttbb.exec:\bnttbb.exe61⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tbhbnt.exec:\tbhbnt.exe62⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dpddv.exec:\dpddv.exe63⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvjdd.exec:\vvjdd.exe64⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xrfrffl.exec:\xrfrffl.exe65⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe66⤵PID:1468
-
\??\c:\thbbbh.exec:\thbbbh.exe67⤵PID:3040
-
\??\c:\9ththn.exec:\9ththn.exe68⤵PID:1920
-
\??\c:\pjppd.exec:\pjppd.exe69⤵PID:2900
-
\??\c:\vpvjp.exec:\vpvjp.exe70⤵PID:1036
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe71⤵PID:2332
-
\??\c:\9rlflfx.exec:\9rlflfx.exe72⤵PID:2432
-
\??\c:\llfxfrf.exec:\llfxfrf.exe73⤵PID:2680
-
\??\c:\tnthnt.exec:\tnthnt.exe74⤵PID:3024
-
\??\c:\bnbtbb.exec:\bnbtbb.exe75⤵PID:2708
-
\??\c:\pdjvd.exec:\pdjvd.exe76⤵PID:2556
-
\??\c:\vjppp.exec:\vjppp.exe77⤵PID:2668
-
\??\c:\1fxrffl.exec:\1fxrffl.exe78⤵PID:2716
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe79⤵PID:536
-
\??\c:\9nhtbb.exec:\9nhtbb.exe80⤵PID:2552
-
\??\c:\bhhttt.exec:\bhhttt.exe81⤵PID:2984
-
\??\c:\vjvdd.exec:\vjvdd.exe82⤵PID:1540
-
\??\c:\1jvvd.exec:\1jvvd.exe83⤵PID:1068
-
\??\c:\7llllfl.exec:\7llllfl.exe84⤵PID:2304
-
\??\c:\rlrxffl.exec:\rlrxffl.exe85⤵PID:1884
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe86⤵PID:992
-
\??\c:\bnnttt.exec:\bnnttt.exe87⤵PID:2020
-
\??\c:\thtbhh.exec:\thtbhh.exe88⤵PID:1688
-
\??\c:\dvjdd.exec:\dvjdd.exe89⤵PID:2044
-
\??\c:\jjvdp.exec:\jjvdp.exe90⤵PID:1572
-
\??\c:\frfxfxx.exec:\frfxfxx.exe91⤵PID:2876
-
\??\c:\fxrxllr.exec:\fxrxllr.exe92⤵PID:1712
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe93⤵PID:2416
-
\??\c:\nbbbtt.exec:\nbbbtt.exe94⤵PID:2100
-
\??\c:\thhbnh.exec:\thhbnh.exe95⤵PID:2216
-
\??\c:\7dddd.exec:\7dddd.exe96⤵PID:456
-
\??\c:\dvddp.exec:\dvddp.exe97⤵PID:2640
-
\??\c:\vjvpv.exec:\vjvpv.exe98⤵PID:1932
-
\??\c:\1xllrlr.exec:\1xllrlr.exe99⤵PID:1176
-
\??\c:\rxrrrfr.exec:\rxrrrfr.exe100⤵PID:1652
-
\??\c:\ntbtnn.exec:\ntbtnn.exe101⤵PID:1252
-
\??\c:\nbhhtt.exec:\nbhhtt.exe102⤵PID:2292
-
\??\c:\9pdjd.exec:\9pdjd.exe103⤵PID:2156
-
\??\c:\lxffrlr.exec:\lxffrlr.exe104⤵PID:1504
-
\??\c:\fxlrxff.exec:\fxlrxff.exe105⤵PID:2516
-
\??\c:\thhhtn.exec:\thhhtn.exe106⤵PID:1008
-
\??\c:\nbnhnn.exec:\nbnhnn.exe107⤵PID:2272
-
\??\c:\9jdjj.exec:\9jdjj.exe108⤵PID:1536
-
\??\c:\9dvdj.exec:\9dvdj.exe109⤵PID:2452
-
\??\c:\dppjp.exec:\dppjp.exe110⤵PID:3068
-
\??\c:\lflfffr.exec:\lflfffr.exe111⤵PID:1396
-
\??\c:\1rxrfxf.exec:\1rxrfxf.exe112⤵PID:3060
-
\??\c:\tnnhnh.exec:\tnnhnh.exe113⤵PID:2704
-
\??\c:\bbnntb.exec:\bbnntb.exe114⤵PID:2792
-
\??\c:\dvvdd.exec:\dvvdd.exe115⤵PID:2732
-
\??\c:\5djjj.exec:\5djjj.exe116⤵PID:2728
-
\??\c:\dpvdd.exec:\dpvdd.exe117⤵PID:2596
-
\??\c:\lflfffl.exec:\lflfffl.exe118⤵PID:2616
-
\??\c:\7rfllff.exec:\7rfllff.exe119⤵PID:2808
-
\??\c:\nbbbbn.exec:\nbbbbn.exe120⤵PID:1196
-
\??\c:\nnbnnn.exec:\nnbnnn.exe121⤵PID:1448
-
\??\c:\jvvpj.exec:\jvvpj.exe122⤵PID:1472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-