Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/08/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe
Resource
win7-20240708-en
General
-
Target
315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe
-
Size
362KB
-
MD5
93c12dd984d9070199e2948d55462239
-
SHA1
24ba1cb59d672a278d9cb485bdad7dea11958d44
-
SHA256
315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d
-
SHA512
768056e4963fa4179ffda1ec6702d4286de71358da76989ce43d928913808cf335c95fcfcbe853ffc863ffdca223e50ff1b0d54c81ebe7f27d18ab0007f6ff81
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq7mj9+04xNZ:n3C9yMo+S0L9xRnoq7mR+04xf
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2168-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2828 bnttnn.exe 1964 ttnbnh.exe 2188 xrxlxfl.exe 2692 7hhttn.exe 2696 3pvdj.exe 2192 3fxfllr.exe 2808 7bhttb.exe 1980 1jjvd.exe 2616 7xfrrrf.exe 2248 nnnbtn.exe 1728 7pvpj.exe 2044 5rrffff.exe 112 hbtbhh.exe 552 pjvvd.exe 2444 5ffllxx.exe 2840 5thhnt.exe 1852 nhtbnt.exe 2852 ddvdv.exe 2428 lflrxxf.exe 1864 bntnbt.exe 2532 1nthbt.exe 1784 vpdjv.exe 1868 tnnbhn.exe 2512 pjvpv.exe 344 xrllrll.exe 1716 lrlfxfr.exe 2388 nbnnnn.exe 2080 dvppd.exe 2448 xlflrxf.exe 2508 hbthtt.exe 3068 jjddp.exe 2728 3rrfxxf.exe 2256 rlxxffr.exe 1584 hbhbbb.exe 2112 hhtbnt.exe 2688 vpjjv.exe 2660 9xxlxxf.exe 2696 nbtbtn.exe 2680 7ttnnh.exe 2544 ddvdv.exe 2568 xxrfrfl.exe 3016 rrfrfrf.exe 2656 hbnntt.exe 2284 tttbhn.exe 2028 vdpdp.exe 2276 vvvdv.exe 1668 llffrfr.exe 1372 nntntt.exe 756 hbbhtb.exe 1272 djjpv.exe 2840 vjvvp.exe 2584 xrrrrxf.exe 2524 rlflrfl.exe 2092 hhbnnn.exe 1864 3bnhtb.exe 2004 5pjpv.exe 1844 pdvdp.exe 1088 3xxxffl.exe 1708 rrlxffl.exe 680 bthhhb.exe 1028 1bnbhn.exe 1996 9ppvv.exe 3020 vppvv.exe 1828 3lfxxxf.exe -
resource yara_rule behavioral1/memory/2168-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-151-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2828 2168 315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe 31 PID 2168 wrote to memory of 2828 2168 315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe 31 PID 2168 wrote to memory of 2828 2168 315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe 31 PID 2168 wrote to memory of 2828 2168 315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe 31 PID 2828 wrote to memory of 1964 2828 bnttnn.exe 32 PID 2828 wrote to memory of 1964 2828 bnttnn.exe 32 PID 2828 wrote to memory of 1964 2828 bnttnn.exe 32 PID 2828 wrote to memory of 1964 2828 bnttnn.exe 32 PID 1964 wrote to memory of 2188 1964 ttnbnh.exe 33 PID 1964 wrote to memory of 2188 1964 ttnbnh.exe 33 PID 1964 wrote to memory of 2188 1964 ttnbnh.exe 33 PID 1964 wrote to memory of 2188 1964 ttnbnh.exe 33 PID 2188 wrote to memory of 2692 2188 xrxlxfl.exe 34 PID 2188 wrote to memory of 2692 2188 xrxlxfl.exe 34 PID 2188 wrote to memory of 2692 2188 xrxlxfl.exe 34 PID 2188 wrote to memory of 2692 2188 xrxlxfl.exe 34 PID 2692 wrote to memory of 2696 2692 7hhttn.exe 68 PID 2692 wrote to memory of 2696 2692 7hhttn.exe 68 PID 2692 wrote to memory of 2696 2692 7hhttn.exe 68 PID 2692 wrote to memory of 2696 2692 7hhttn.exe 68 PID 2696 wrote to memory of 2192 2696 3pvdj.exe 36 PID 2696 wrote to memory of 2192 2696 3pvdj.exe 36 PID 2696 wrote to memory of 2192 2696 3pvdj.exe 36 PID 2696 wrote to memory of 2192 2696 3pvdj.exe 36 PID 2192 wrote to memory of 2808 2192 3fxfllr.exe 37 PID 2192 wrote to memory of 2808 2192 3fxfllr.exe 37 PID 2192 wrote to memory of 2808 2192 3fxfllr.exe 37 PID 2192 wrote to memory of 2808 2192 3fxfllr.exe 37 PID 2808 wrote to memory of 1980 2808 7bhttb.exe 38 PID 2808 wrote to memory of 1980 2808 7bhttb.exe 38 PID 2808 wrote to memory of 1980 2808 7bhttb.exe 38 PID 2808 wrote to memory of 1980 2808 7bhttb.exe 38 PID 1980 wrote to memory of 2616 1980 1jjvd.exe 39 PID 1980 wrote to memory of 2616 1980 1jjvd.exe 39 PID 1980 wrote to memory of 2616 1980 1jjvd.exe 39 PID 1980 wrote to memory of 2616 1980 1jjvd.exe 39 PID 2616 wrote to memory of 2248 2616 7xfrrrf.exe 40 PID 2616 wrote to memory of 2248 2616 7xfrrrf.exe 40 PID 2616 wrote to memory of 2248 2616 7xfrrrf.exe 40 PID 2616 wrote to memory of 2248 2616 7xfrrrf.exe 40 PID 2248 wrote to memory of 1728 2248 nnnbtn.exe 41 PID 2248 wrote to memory of 1728 2248 nnnbtn.exe 41 PID 2248 wrote to memory of 1728 2248 nnnbtn.exe 41 PID 2248 wrote to memory of 1728 2248 nnnbtn.exe 41 PID 1728 wrote to memory of 2044 1728 7pvpj.exe 42 PID 1728 wrote to memory of 2044 1728 7pvpj.exe 42 PID 1728 wrote to memory of 2044 1728 7pvpj.exe 42 PID 1728 wrote to memory of 2044 1728 7pvpj.exe 42 PID 2044 wrote to memory of 112 2044 5rrffff.exe 43 PID 2044 wrote to memory of 112 2044 5rrffff.exe 43 PID 2044 wrote to memory of 112 2044 5rrffff.exe 43 PID 2044 wrote to memory of 112 2044 5rrffff.exe 43 PID 112 wrote to memory of 552 112 hbtbhh.exe 44 PID 112 wrote to memory of 552 112 hbtbhh.exe 44 PID 112 wrote to memory of 552 112 hbtbhh.exe 44 PID 112 wrote to memory of 552 112 hbtbhh.exe 44 PID 552 wrote to memory of 2444 552 pjvvd.exe 45 PID 552 wrote to memory of 2444 552 pjvvd.exe 45 PID 552 wrote to memory of 2444 552 pjvvd.exe 45 PID 552 wrote to memory of 2444 552 pjvvd.exe 45 PID 2444 wrote to memory of 2840 2444 5ffllxx.exe 46 PID 2444 wrote to memory of 2840 2444 5ffllxx.exe 46 PID 2444 wrote to memory of 2840 2444 5ffllxx.exe 46 PID 2444 wrote to memory of 2840 2444 5ffllxx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe"C:\Users\Admin\AppData\Local\Temp\315997134380a286a8a056e08a62d33e43806bd7c17a106e568793037ba3cf8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\bnttnn.exec:\bnttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ttnbnh.exec:\ttnbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\xrxlxfl.exec:\xrxlxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\7hhttn.exec:\7hhttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3pvdj.exec:\3pvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3fxfllr.exec:\3fxfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\7bhttb.exec:\7bhttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\1jjvd.exec:\1jjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\7xfrrrf.exec:\7xfrrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nnnbtn.exec:\nnnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\7pvpj.exec:\7pvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\5rrffff.exec:\5rrffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\hbtbhh.exec:\hbtbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\pjvvd.exec:\pjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\5ffllxx.exec:\5ffllxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5thhnt.exec:\5thhnt.exe17⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhtbnt.exec:\nhtbnt.exe18⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ddvdv.exec:\ddvdv.exe19⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lflrxxf.exec:\lflrxxf.exe20⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bntnbt.exec:\bntnbt.exe21⤵
- Executes dropped EXE
PID:1864 -
\??\c:\1nthbt.exec:\1nthbt.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vpdjv.exec:\vpdjv.exe23⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tnnbhn.exec:\tnnbhn.exe24⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pjvpv.exec:\pjvpv.exe25⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xrllrll.exec:\xrllrll.exe26⤵
- Executes dropped EXE
PID:344 -
\??\c:\lrlfxfr.exec:\lrlfxfr.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nbnnnn.exec:\nbnnnn.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dvppd.exec:\dvppd.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xlflrxf.exec:\xlflrxf.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hbthtt.exec:\hbthtt.exe31⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jjddp.exec:\jjddp.exe32⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3rrfxxf.exec:\3rrfxxf.exe33⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rlxxffr.exec:\rlxxffr.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbhbbb.exec:\hbhbbb.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhtbnt.exec:\hhtbnt.exe36⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vpjjv.exec:\vpjjv.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9xxlxxf.exec:\9xxlxxf.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nbtbtn.exec:\nbtbtn.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7ttnnh.exec:\7ttnnh.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ddvdv.exec:\ddvdv.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xxrfrfl.exec:\xxrfrfl.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rrfrfrf.exec:\rrfrfrf.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hbnntt.exec:\hbnntt.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tttbhn.exec:\tttbhn.exe45⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vdpdp.exec:\vdpdp.exe46⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vvvdv.exec:\vvvdv.exe47⤵
- Executes dropped EXE
PID:2276 -
\??\c:\llffrfr.exec:\llffrfr.exe48⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nntntt.exec:\nntntt.exe49⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hbbhtb.exec:\hbbhtb.exe50⤵
- Executes dropped EXE
PID:756 -
\??\c:\djjpv.exec:\djjpv.exe51⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vjvvp.exec:\vjvvp.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xrrrrxf.exec:\xrrrrxf.exe53⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rlflrfl.exec:\rlflrfl.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhbnnn.exec:\hhbnnn.exe55⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3bnhtb.exec:\3bnhtb.exe56⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5pjpv.exec:\5pjpv.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pdvdp.exec:\pdvdp.exe58⤵
- Executes dropped EXE
PID:1844 -
\??\c:\3xxxffl.exec:\3xxxffl.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rrlxffl.exec:\rrlxffl.exe60⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bthhhb.exec:\bthhhb.exe61⤵
- Executes dropped EXE
PID:680 -
\??\c:\1bnbhn.exec:\1bnbhn.exe62⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9ppvv.exec:\9ppvv.exe63⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vppvv.exec:\vppvv.exe64⤵
- Executes dropped EXE
PID:3020 -
\??\c:\3lfxxxf.exec:\3lfxxxf.exe65⤵
- Executes dropped EXE
PID:1828 -
\??\c:\frfffff.exec:\frfffff.exe66⤵PID:2936
-
\??\c:\btbbhn.exec:\btbbhn.exe67⤵PID:372
-
\??\c:\9nbhnh.exec:\9nbhnh.exe68⤵PID:3056
-
\??\c:\pjdpv.exec:\pjdpv.exe69⤵PID:3024
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:976
-
\??\c:\3rlrxxl.exec:\3rlrxxl.exe71⤵PID:2180
-
\??\c:\1ffrrrr.exec:\1ffrrrr.exe72⤵PID:1684
-
\??\c:\1hnhnt.exec:\1hnhnt.exe73⤵PID:2756
-
\??\c:\bbthnn.exec:\bbthnn.exe74⤵PID:3040
-
\??\c:\ddvjd.exec:\ddvjd.exe75⤵PID:2904
-
\??\c:\1dpdj.exec:\1dpdj.exe76⤵PID:2632
-
\??\c:\1rllxxr.exec:\1rllxxr.exe77⤵PID:2660
-
\??\c:\xrllxlr.exec:\xrllxlr.exe78⤵PID:2720
-
\??\c:\7nbhhn.exec:\7nbhhn.exe79⤵PID:2740
-
\??\c:\hbnntt.exec:\hbnntt.exe80⤵PID:2608
-
\??\c:\pjjvv.exec:\pjjvv.exe81⤵PID:3052
-
\??\c:\9jpjd.exec:\9jpjd.exe82⤵PID:2620
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe83⤵PID:1820
-
\??\c:\5llffll.exec:\5llffll.exe84⤵PID:1100
-
\??\c:\vjvvd.exec:\vjvvd.exe85⤵PID:2000
-
\??\c:\pdjdd.exec:\pdjdd.exe86⤵PID:1680
-
\??\c:\lxxrfxf.exec:\lxxrfxf.exe87⤵PID:1956
-
\??\c:\3bhbhh.exec:\3bhbhh.exe88⤵PID:2052
-
\??\c:\jdvvj.exec:\jdvvj.exe89⤵PID:1640
-
\??\c:\7rlrxff.exec:\7rlrxff.exe90⤵PID:2880
-
\??\c:\lxfllll.exec:\lxfllll.exe91⤵PID:2860
-
\??\c:\thnhnn.exec:\thnhnn.exe92⤵PID:1388
-
\??\c:\9vdpv.exec:\9vdpv.exe93⤵PID:2788
-
\??\c:\frflllf.exec:\frflllf.exe94⤵PID:2736
-
\??\c:\rlfflrf.exec:\rlfflrf.exe95⤵PID:824
-
\??\c:\hthhhh.exec:\hthhhh.exe96⤵PID:1568
-
\??\c:\vpjjp.exec:\vpjjp.exe97⤵PID:2704
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe98⤵PID:892
-
\??\c:\9ntnnt.exec:\9ntnnt.exe99⤵PID:1552
-
\??\c:\pjvjj.exec:\pjvjj.exe100⤵PID:1708
-
\??\c:\7lxfllr.exec:\7lxfllr.exe101⤵PID:952
-
\??\c:\tbhttt.exec:\tbhttt.exe102⤵PID:868
-
\??\c:\jdvjp.exec:\jdvjp.exe103⤵PID:2104
-
\??\c:\dvpdp.exec:\dvpdp.exe104⤵PID:2280
-
\??\c:\xrrfxff.exec:\xrrfxff.exe105⤵PID:876
-
\??\c:\thtbhn.exec:\thtbhn.exe106⤵PID:2156
-
\??\c:\ppdvd.exec:\ppdvd.exe107⤵PID:2460
-
\??\c:\pvjvv.exec:\pvjvv.exe108⤵PID:3068
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe109⤵PID:348
-
\??\c:\9nnhhh.exec:\9nnhhh.exe110⤵PID:3036
-
\??\c:\vvpvd.exec:\vvpvd.exe111⤵PID:1572
-
\??\c:\1rfxffl.exec:\1rfxffl.exe112⤵PID:1684
-
\??\c:\nhhhth.exec:\nhhhth.exe113⤵PID:1332
-
\??\c:\nbntbt.exec:\nbntbt.exe114⤵PID:2820
-
\??\c:\vpdjp.exec:\vpdjp.exe115⤵PID:2192
-
\??\c:\frlrxxf.exec:\frlrxxf.exe116⤵PID:2700
-
\??\c:\1tthnt.exec:\1tthnt.exe117⤵PID:2708
-
\??\c:\jdjdj.exec:\jdjdj.exe118⤵PID:2540
-
\??\c:\5pddp.exec:\5pddp.exe119⤵PID:2716
-
\??\c:\lfrfxxf.exec:\lfrfxxf.exe120⤵PID:2896
-
\??\c:\hbnnnt.exec:\hbnnnt.exe121⤵PID:2976
-
\??\c:\9ddpp.exec:\9ddpp.exe122⤵PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-