Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
4df3ccb5f92fb2d201ab637d0d4e7140N.exe
Resource
win7-20240705-en
General
-
Target
4df3ccb5f92fb2d201ab637d0d4e7140N.exe
-
Size
92KB
-
MD5
4df3ccb5f92fb2d201ab637d0d4e7140
-
SHA1
44d94e796268137d88dd8289d5aa6cd5e423993d
-
SHA256
bfc4d47e057420e17486b5ccc269ad4eace48ff0738d2d1978146c51fb05c350
-
SHA512
b28fe28ac4cdb7b81e2063f5733bab128c5411cdb6a513a9426974e8c68ce306dd01aa1f3395b6da459b29057245b494d8b53d493ff133ef615b9d6b613d5374
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBl7F/8e+e:ymb3NkkiQ3mdBjFIi/REUZnKlD+e
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2872-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 320 frfflrl.exe 2788 ppdjp.exe 2748 frrfrxf.exe 2312 nbhbbb.exe 2576 3djjd.exe 2596 lfxxlrx.exe 2960 9thnnt.exe 2268 vjppp.exe 2112 xrlfxxl.exe 1332 hhbntt.exe 2192 nhthnt.exe 3032 3pjvj.exe 2968 1jdjj.exe 1632 ffrxffr.exe 1372 1ttntt.exe 2348 3jpdj.exe 3064 1vpjp.exe 2096 xrfrxfr.exe 2004 bnhhtt.exe 2140 nnhhtb.exe 2008 1jvdj.exe 1616 lfrxflr.exe 2420 rxflffl.exe 580 hbnbhn.exe 1492 pddjp.exe 2396 jdpvv.exe 708 5flffxf.exe 1000 7bnhtt.exe 880 htbttt.exe 2264 pjvjd.exe 2624 flrrlfl.exe 2772 lfxfxlr.exe 2800 3ttnbh.exe 2636 hbtbbh.exe 2808 vjddv.exe 1708 fflxxxf.exe 1984 lfllfrx.exe 2572 btnbbh.exe 2688 bnnhht.exe 2136 9jvdj.exe 2464 3ddjv.exe 1208 lxllrrf.exe 1188 ffllxfl.exe 2500 hbnbhn.exe 872 7tbbtb.exe 2316 dvjdp.exe 3032 pppvv.exe 2860 1xrlrxf.exe 2832 tnttnt.exe 2816 1pddj.exe 1372 3frfllx.exe 2348 1frfflf.exe 2024 tnhhtb.exe 2012 3vjpj.exe 2148 vjvjp.exe 3020 lrxlfxf.exe 1484 9lfrxfr.exe 2212 nhbhnb.exe 840 tntbnn.exe 896 1djpd.exe 844 jdvpv.exe 1508 jdpdj.exe 2072 fxxxllx.exe 308 lfrfrfr.exe -
resource yara_rule behavioral1/memory/2872-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 320 2872 4df3ccb5f92fb2d201ab637d0d4e7140N.exe 30 PID 2872 wrote to memory of 320 2872 4df3ccb5f92fb2d201ab637d0d4e7140N.exe 30 PID 2872 wrote to memory of 320 2872 4df3ccb5f92fb2d201ab637d0d4e7140N.exe 30 PID 2872 wrote to memory of 320 2872 4df3ccb5f92fb2d201ab637d0d4e7140N.exe 30 PID 320 wrote to memory of 2788 320 frfflrl.exe 31 PID 320 wrote to memory of 2788 320 frfflrl.exe 31 PID 320 wrote to memory of 2788 320 frfflrl.exe 31 PID 320 wrote to memory of 2788 320 frfflrl.exe 31 PID 2788 wrote to memory of 2748 2788 ppdjp.exe 32 PID 2788 wrote to memory of 2748 2788 ppdjp.exe 32 PID 2788 wrote to memory of 2748 2788 ppdjp.exe 32 PID 2788 wrote to memory of 2748 2788 ppdjp.exe 32 PID 2748 wrote to memory of 2312 2748 frrfrxf.exe 33 PID 2748 wrote to memory of 2312 2748 frrfrxf.exe 33 PID 2748 wrote to memory of 2312 2748 frrfrxf.exe 33 PID 2748 wrote to memory of 2312 2748 frrfrxf.exe 33 PID 2312 wrote to memory of 2576 2312 nbhbbb.exe 34 PID 2312 wrote to memory of 2576 2312 nbhbbb.exe 34 PID 2312 wrote to memory of 2576 2312 nbhbbb.exe 34 PID 2312 wrote to memory of 2576 2312 nbhbbb.exe 34 PID 2576 wrote to memory of 2596 2576 3djjd.exe 35 PID 2576 wrote to memory of 2596 2576 3djjd.exe 35 PID 2576 wrote to memory of 2596 2576 3djjd.exe 35 PID 2576 wrote to memory of 2596 2576 3djjd.exe 35 PID 2596 wrote to memory of 2960 2596 lfxxlrx.exe 36 PID 2596 wrote to memory of 2960 2596 lfxxlrx.exe 36 PID 2596 wrote to memory of 2960 2596 lfxxlrx.exe 36 PID 2596 wrote to memory of 2960 2596 lfxxlrx.exe 36 PID 2960 wrote to memory of 2268 2960 9thnnt.exe 37 PID 2960 wrote to memory of 2268 2960 9thnnt.exe 37 PID 2960 wrote to memory of 2268 2960 9thnnt.exe 37 PID 2960 wrote to memory of 2268 2960 9thnnt.exe 37 PID 2268 wrote to memory of 2112 2268 vjppp.exe 38 PID 2268 wrote to memory of 2112 2268 vjppp.exe 38 PID 2268 wrote to memory of 2112 2268 vjppp.exe 38 PID 2268 wrote to memory of 2112 2268 vjppp.exe 38 PID 2112 wrote to memory of 1332 2112 xrlfxxl.exe 39 PID 2112 wrote to memory of 1332 2112 xrlfxxl.exe 39 PID 2112 wrote to memory of 1332 2112 xrlfxxl.exe 39 PID 2112 wrote to memory of 1332 2112 xrlfxxl.exe 39 PID 1332 wrote to memory of 2192 1332 hhbntt.exe 40 PID 1332 wrote to memory of 2192 1332 hhbntt.exe 40 PID 1332 wrote to memory of 2192 1332 hhbntt.exe 40 PID 1332 wrote to memory of 2192 1332 hhbntt.exe 40 PID 2192 wrote to memory of 3032 2192 nhthnt.exe 41 PID 2192 wrote to memory of 3032 2192 nhthnt.exe 41 PID 2192 wrote to memory of 3032 2192 nhthnt.exe 41 PID 2192 wrote to memory of 3032 2192 nhthnt.exe 41 PID 3032 wrote to memory of 2968 3032 3pjvj.exe 42 PID 3032 wrote to memory of 2968 3032 3pjvj.exe 42 PID 3032 wrote to memory of 2968 3032 3pjvj.exe 42 PID 3032 wrote to memory of 2968 3032 3pjvj.exe 42 PID 2968 wrote to memory of 1632 2968 1jdjj.exe 43 PID 2968 wrote to memory of 1632 2968 1jdjj.exe 43 PID 2968 wrote to memory of 1632 2968 1jdjj.exe 43 PID 2968 wrote to memory of 1632 2968 1jdjj.exe 43 PID 1632 wrote to memory of 1372 1632 ffrxffr.exe 44 PID 1632 wrote to memory of 1372 1632 ffrxffr.exe 44 PID 1632 wrote to memory of 1372 1632 ffrxffr.exe 44 PID 1632 wrote to memory of 1372 1632 ffrxffr.exe 44 PID 1372 wrote to memory of 2348 1372 1ttntt.exe 45 PID 1372 wrote to memory of 2348 1372 1ttntt.exe 45 PID 1372 wrote to memory of 2348 1372 1ttntt.exe 45 PID 1372 wrote to memory of 2348 1372 1ttntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4df3ccb5f92fb2d201ab637d0d4e7140N.exe"C:\Users\Admin\AppData\Local\Temp\4df3ccb5f92fb2d201ab637d0d4e7140N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\frfflrl.exec:\frfflrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\ppdjp.exec:\ppdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\frrfrxf.exec:\frrfrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nbhbbb.exec:\nbhbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3djjd.exec:\3djjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\9thnnt.exec:\9thnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vjppp.exec:\vjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\xrlfxxl.exec:\xrlfxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\hhbntt.exec:\hhbntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\nhthnt.exec:\nhthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\3pjvj.exec:\3pjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\1jdjj.exec:\1jdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\ffrxffr.exec:\ffrxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\1ttntt.exec:\1ttntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\3jpdj.exec:\3jpdj.exe17⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1vpjp.exec:\1vpjp.exe18⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe19⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bnhhtt.exec:\bnhhtt.exe20⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nnhhtb.exec:\nnhhtb.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1jvdj.exec:\1jvdj.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfrxflr.exec:\lfrxflr.exe23⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rxflffl.exec:\rxflffl.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbnbhn.exec:\hbnbhn.exe25⤵
- Executes dropped EXE
PID:580 -
\??\c:\pddjp.exec:\pddjp.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jdpvv.exec:\jdpvv.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5flffxf.exec:\5flffxf.exe28⤵
- Executes dropped EXE
PID:708 -
\??\c:\7bnhtt.exec:\7bnhtt.exe29⤵
- Executes dropped EXE
PID:1000 -
\??\c:\htbttt.exec:\htbttt.exe30⤵
- Executes dropped EXE
PID:880 -
\??\c:\pjvjd.exec:\pjvjd.exe31⤵
- Executes dropped EXE
PID:2264 -
\??\c:\flrrlfl.exec:\flrrlfl.exe32⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lfxfxlr.exec:\lfxfxlr.exe33⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3ttnbh.exec:\3ttnbh.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbtbbh.exec:\hbtbbh.exe35⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vjddv.exec:\vjddv.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\fflxxxf.exec:\fflxxxf.exe37⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lfllfrx.exec:\lfllfrx.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\btnbbh.exec:\btnbbh.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bnnhht.exec:\bnnhht.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9jvdj.exec:\9jvdj.exe41⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3ddjv.exec:\3ddjv.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxllrrf.exec:\lxllrrf.exe43⤵
- Executes dropped EXE
PID:1208 -
\??\c:\ffllxfl.exec:\ffllxfl.exe44⤵
- Executes dropped EXE
PID:1188 -
\??\c:\hbnbhn.exec:\hbnbhn.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7tbbtb.exec:\7tbbtb.exe46⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvjdp.exec:\dvjdp.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pppvv.exec:\pppvv.exe48⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1xrlrxf.exec:\1xrlrxf.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tnttnt.exec:\tnttnt.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1pddj.exec:\1pddj.exe51⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3frfllx.exec:\3frfllx.exe52⤵
- Executes dropped EXE
PID:1372 -
\??\c:\1frfflf.exec:\1frfflf.exe53⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tnhhtb.exec:\tnhhtb.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3vjpj.exec:\3vjpj.exe55⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vjvjp.exec:\vjvjp.exe56⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lrxlfxf.exec:\lrxlfxf.exe57⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9lfrxfr.exec:\9lfrxfr.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhbhnb.exec:\nhbhnb.exe59⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tntbnn.exec:\tntbnn.exe60⤵
- Executes dropped EXE
PID:840 -
\??\c:\1djpd.exec:\1djpd.exe61⤵
- Executes dropped EXE
PID:896 -
\??\c:\jdvpv.exec:\jdvpv.exe62⤵
- Executes dropped EXE
PID:844 -
\??\c:\jdpdj.exec:\jdpdj.exe63⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fxxxllx.exec:\fxxxllx.exe64⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lfrfrfr.exec:\lfrfrfr.exe65⤵
- Executes dropped EXE
PID:308 -
\??\c:\tnttbn.exec:\tnttbn.exe66⤵PID:2436
-
\??\c:\9htnbb.exec:\9htnbb.exe67⤵PID:1928
-
\??\c:\dvvjp.exec:\dvvjp.exe68⤵PID:3004
-
\??\c:\pdvdv.exec:\pdvdv.exe69⤵PID:2200
-
\??\c:\7lrlflx.exec:\7lrlflx.exe70⤵PID:2708
-
\??\c:\1fxlxxf.exec:\1fxlxxf.exe71⤵PID:2676
-
\??\c:\frxlxxl.exec:\frxlxxl.exe72⤵PID:1568
-
\??\c:\ttnttt.exec:\ttnttt.exe73⤵PID:2784
-
\??\c:\hbhnhh.exec:\hbhnhh.exe74⤵PID:1596
-
\??\c:\vvpdj.exec:\vvpdj.exe75⤵PID:2756
-
\??\c:\pjvdp.exec:\pjvdp.exe76⤵PID:2632
-
\??\c:\xrfrlxl.exec:\xrfrlxl.exe77⤵PID:2556
-
\??\c:\ffllrrx.exec:\ffllrrx.exe78⤵PID:2796
-
\??\c:\bnntbb.exec:\bnntbb.exe79⤵PID:2988
-
\??\c:\thtbnt.exec:\thtbnt.exe80⤵PID:2196
-
\??\c:\btnhhn.exec:\btnhhn.exe81⤵PID:2692
-
\??\c:\pjdpv.exec:\pjdpv.exe82⤵PID:2080
-
\??\c:\jvvpd.exec:\jvvpd.exe83⤵PID:2856
-
\??\c:\9rrxxlx.exec:\9rrxxlx.exe84⤵PID:1652
-
\??\c:\frffrxx.exec:\frffrxx.exe85⤵PID:2904
-
\??\c:\hhnnbh.exec:\hhnnbh.exe86⤵PID:2732
-
\??\c:\hhthtb.exec:\hhthtb.exe87⤵PID:2940
-
\??\c:\3tbhnt.exec:\3tbhnt.exe88⤵PID:1792
-
\??\c:\jvjpv.exec:\jvjpv.exe89⤵PID:2848
-
\??\c:\vjvdj.exec:\vjvdj.exe90⤵PID:2052
-
\??\c:\9rlrllf.exec:\9rlrllf.exe91⤵PID:1468
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe92⤵PID:528
-
\??\c:\ttthth.exec:\ttthth.exe93⤵PID:3064
-
\??\c:\hhtbnt.exec:\hhtbnt.exe94⤵PID:1248
-
\??\c:\pjjjv.exec:\pjjjv.exe95⤵PID:2128
-
\??\c:\dvddp.exec:\dvddp.exe96⤵PID:2168
-
\??\c:\7vddd.exec:\7vddd.exe97⤵PID:3020
-
\??\c:\llfrllx.exec:\llfrllx.exe98⤵PID:960
-
\??\c:\3xxfrrx.exec:\3xxfrrx.exe99⤵PID:1608
-
\??\c:\1hbnhh.exec:\1hbnhh.exe100⤵PID:280
-
\??\c:\nbbhnn.exec:\nbbhnn.exe101⤵PID:980
-
\??\c:\vpdpp.exec:\vpdpp.exe102⤵PID:2180
-
\??\c:\7jppv.exec:\7jppv.exe103⤵PID:348
-
\??\c:\pjpdp.exec:\pjpdp.exe104⤵PID:2400
-
\??\c:\1xrrrrl.exec:\1xrrrrl.exe105⤵PID:1408
-
\??\c:\5fxrllr.exec:\5fxrllr.exe106⤵PID:1000
-
\??\c:\1nnhbh.exec:\1nnhbh.exe107⤵PID:2120
-
\??\c:\hbntbh.exec:\hbntbh.exe108⤵PID:2320
-
\??\c:\9vjdd.exec:\9vjdd.exe109⤵PID:2872
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe110⤵PID:2612
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe111⤵PID:2764
-
\??\c:\rlfxlxf.exec:\rlfxlxf.exe112⤵PID:3056
-
\??\c:\tntthh.exec:\tntthh.exe113⤵PID:2740
-
\??\c:\tthnbt.exec:\tthnbt.exe114⤵PID:2696
-
\??\c:\3vpvd.exec:\3vpvd.exe115⤵PID:2636
-
\??\c:\lfrrlrf.exec:\lfrrlrf.exe116⤵PID:2516
-
\??\c:\9fxlrfr.exec:\9fxlrfr.exe117⤵PID:1984
-
\??\c:\1lflfll.exec:\1lflfll.exe118⤵PID:2572
-
\??\c:\bbtbnt.exec:\bbtbnt.exe119⤵PID:2844
-
\??\c:\5bnnht.exec:\5bnnht.exe120⤵PID:1136
-
\??\c:\5jdjv.exec:\5jdjv.exe121⤵PID:2136
-
\??\c:\pppjv.exec:\pppjv.exe122⤵PID:1072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-