Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abefdeacfb2be9da20f2ce9361402060N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
abefdeacfb2be9da20f2ce9361402060N.exe
-
Size
64KB
-
MD5
abefdeacfb2be9da20f2ce9361402060
-
SHA1
d9946c952de2e1183d367f728d35218a45da2537
-
SHA256
df12688ebb6ea87fff1694dfdee51aaf1bcdea3f8062cad3ca32074de65d3c67
-
SHA512
e5fcd61ef726dc1a526e58ff56e64f8b8a64a3c448582abcc807fbfae9afba0a85e8f334474e9167e8371e479392eff2d8cc48f33849a73a066351771c2f9937
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNr:ymb3NkkiQ3mdBjFIvlpr
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/396-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 7jdjv.exe 2492 jvpvv.exe 2280 1llxxfl.exe 2196 nbbbnn.exe 2872 nhbntb.exe 2860 9ddjp.exe 2856 dpdvv.exe 1212 ffllfxx.exe 2600 7ntbbh.exe 1660 dpppv.exe 2204 3xfxffl.exe 1220 fxlxrrf.exe 2840 htntbn.exe 1076 vjdpv.exe 2372 dvdvd.exe 468 lxrxxxf.exe 1644 tnhthn.exe 2908 thtbtt.exe 2924 3dvvv.exe 1872 3jdvv.exe 1892 fxllrxf.exe 1284 lfflfxr.exe 3024 nthhhb.exe 396 vdppv.exe 1952 9jdvp.exe 3036 pdvpv.exe 1312 5rfxffl.exe 2256 hbhhnt.exe 1708 nbhbbt.exe 2528 3ppvp.exe 2396 frxxxxf.exe 1804 1rlxlrf.exe 2280 nhnntn.exe 2992 nbnhnn.exe 2444 dvpjp.exe 1632 pvjvj.exe 2852 rlffffl.exe 2812 lfxxrrf.exe 2744 btnttn.exe 2896 hbhhnn.exe 2764 pdvdd.exe 1212 jvddd.exe 2596 xfrrrrx.exe 2320 bthhnn.exe 1992 bnnnnh.exe 672 pjppp.exe 2928 pjpvj.exe 444 3ffxxxf.exe 612 frfllfx.exe 2128 xlfxfxf.exe 2372 7bnbhh.exe 2004 nbnhnn.exe 2936 rlxlllx.exe 1084 9bnnbn.exe 2944 5tbhtt.exe 1432 vvddp.exe 2972 jvvvj.exe 2064 fxllrfl.exe 796 1frfrlr.exe 1156 hbhbhh.exe 1640 pjddj.exe 760 vjvvd.exe 1916 lxxflll.exe 1940 5lllflx.exe -
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/396-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-261-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2532 2104 abefdeacfb2be9da20f2ce9361402060N.exe 30 PID 2104 wrote to memory of 2532 2104 abefdeacfb2be9da20f2ce9361402060N.exe 30 PID 2104 wrote to memory of 2532 2104 abefdeacfb2be9da20f2ce9361402060N.exe 30 PID 2104 wrote to memory of 2532 2104 abefdeacfb2be9da20f2ce9361402060N.exe 30 PID 2532 wrote to memory of 2492 2532 7jdjv.exe 31 PID 2532 wrote to memory of 2492 2532 7jdjv.exe 31 PID 2532 wrote to memory of 2492 2532 7jdjv.exe 31 PID 2532 wrote to memory of 2492 2532 7jdjv.exe 31 PID 2492 wrote to memory of 2280 2492 jvpvv.exe 32 PID 2492 wrote to memory of 2280 2492 jvpvv.exe 32 PID 2492 wrote to memory of 2280 2492 jvpvv.exe 32 PID 2492 wrote to memory of 2280 2492 jvpvv.exe 32 PID 2280 wrote to memory of 2196 2280 1llxxfl.exe 33 PID 2280 wrote to memory of 2196 2280 1llxxfl.exe 33 PID 2280 wrote to memory of 2196 2280 1llxxfl.exe 33 PID 2280 wrote to memory of 2196 2280 1llxxfl.exe 33 PID 2196 wrote to memory of 2872 2196 nbbbnn.exe 34 PID 2196 wrote to memory of 2872 2196 nbbbnn.exe 34 PID 2196 wrote to memory of 2872 2196 nbbbnn.exe 34 PID 2196 wrote to memory of 2872 2196 nbbbnn.exe 34 PID 2872 wrote to memory of 2860 2872 nhbntb.exe 35 PID 2872 wrote to memory of 2860 2872 nhbntb.exe 35 PID 2872 wrote to memory of 2860 2872 nhbntb.exe 35 PID 2872 wrote to memory of 2860 2872 nhbntb.exe 35 PID 2860 wrote to memory of 2856 2860 9ddjp.exe 36 PID 2860 wrote to memory of 2856 2860 9ddjp.exe 36 PID 2860 wrote to memory of 2856 2860 9ddjp.exe 36 PID 2860 wrote to memory of 2856 2860 9ddjp.exe 36 PID 2856 wrote to memory of 1212 2856 dpdvv.exe 37 PID 2856 wrote to memory of 1212 2856 dpdvv.exe 37 PID 2856 wrote to memory of 1212 2856 dpdvv.exe 37 PID 2856 wrote to memory of 1212 2856 dpdvv.exe 37 PID 1212 wrote to memory of 2600 1212 ffllfxx.exe 38 PID 1212 wrote to memory of 2600 1212 ffllfxx.exe 38 PID 1212 wrote to memory of 2600 1212 ffllfxx.exe 38 PID 1212 wrote to memory of 2600 1212 ffllfxx.exe 38 PID 2600 wrote to memory of 1660 2600 7ntbbh.exe 39 PID 2600 wrote to memory of 1660 2600 7ntbbh.exe 39 PID 2600 wrote to memory of 1660 2600 7ntbbh.exe 39 PID 2600 wrote to memory of 1660 2600 7ntbbh.exe 39 PID 1660 wrote to memory of 2204 1660 dpppv.exe 40 PID 1660 wrote to memory of 2204 1660 dpppv.exe 40 PID 1660 wrote to memory of 2204 1660 dpppv.exe 40 PID 1660 wrote to memory of 2204 1660 dpppv.exe 40 PID 2204 wrote to memory of 1220 2204 3xfxffl.exe 41 PID 2204 wrote to memory of 1220 2204 3xfxffl.exe 41 PID 2204 wrote to memory of 1220 2204 3xfxffl.exe 41 PID 2204 wrote to memory of 1220 2204 3xfxffl.exe 41 PID 1220 wrote to memory of 2840 1220 fxlxrrf.exe 42 PID 1220 wrote to memory of 2840 1220 fxlxrrf.exe 42 PID 1220 wrote to memory of 2840 1220 fxlxrrf.exe 42 PID 1220 wrote to memory of 2840 1220 fxlxrrf.exe 42 PID 2840 wrote to memory of 1076 2840 htntbn.exe 43 PID 2840 wrote to memory of 1076 2840 htntbn.exe 43 PID 2840 wrote to memory of 1076 2840 htntbn.exe 43 PID 2840 wrote to memory of 1076 2840 htntbn.exe 43 PID 1076 wrote to memory of 2372 1076 vjdpv.exe 44 PID 1076 wrote to memory of 2372 1076 vjdpv.exe 44 PID 1076 wrote to memory of 2372 1076 vjdpv.exe 44 PID 1076 wrote to memory of 2372 1076 vjdpv.exe 44 PID 2372 wrote to memory of 468 2372 dvdvd.exe 45 PID 2372 wrote to memory of 468 2372 dvdvd.exe 45 PID 2372 wrote to memory of 468 2372 dvdvd.exe 45 PID 2372 wrote to memory of 468 2372 dvdvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\abefdeacfb2be9da20f2ce9361402060N.exe"C:\Users\Admin\AppData\Local\Temp\abefdeacfb2be9da20f2ce9361402060N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7jdjv.exec:\7jdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jvpvv.exec:\jvpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\1llxxfl.exec:\1llxxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nbbbnn.exec:\nbbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nhbntb.exec:\nhbntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9ddjp.exec:\9ddjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dpdvv.exec:\dpdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ffllfxx.exec:\ffllfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\7ntbbh.exec:\7ntbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\dpppv.exec:\dpppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\3xfxffl.exec:\3xfxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\fxlxrrf.exec:\fxlxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\htntbn.exec:\htntbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vjdpv.exec:\vjdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\dvdvd.exec:\dvdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lxrxxxf.exec:\lxrxxxf.exe17⤵
- Executes dropped EXE
PID:468 -
\??\c:\tnhthn.exec:\tnhthn.exe18⤵
- Executes dropped EXE
PID:1644 -
\??\c:\thtbtt.exec:\thtbtt.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3dvvv.exec:\3dvvv.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3jdvv.exec:\3jdvv.exe21⤵
- Executes dropped EXE
PID:1872 -
\??\c:\fxllrxf.exec:\fxllrxf.exe22⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lfflfxr.exec:\lfflfxr.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nthhhb.exec:\nthhhb.exe24⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vdppv.exec:\vdppv.exe25⤵
- Executes dropped EXE
PID:396 -
\??\c:\9jdvp.exec:\9jdvp.exe26⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pdvpv.exec:\pdvpv.exe27⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5rfxffl.exec:\5rfxffl.exe28⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hbhhnt.exec:\hbhhnt.exe29⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nbhbbt.exec:\nbhbbt.exe30⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3ppvp.exec:\3ppvp.exe31⤵
- Executes dropped EXE
PID:2528 -
\??\c:\frxxxxf.exec:\frxxxxf.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1rlxlrf.exec:\1rlxlrf.exe33⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nhnntn.exec:\nhnntn.exe34⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nbnhnn.exec:\nbnhnn.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dvpjp.exec:\dvpjp.exe36⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pvjvj.exec:\pvjvj.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rlffffl.exec:\rlffffl.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\btnttn.exec:\btnttn.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hbhhnn.exec:\hbhhnn.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pdvdd.exec:\pdvdd.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jvddd.exec:\jvddd.exe43⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xfrrrrx.exec:\xfrrrrx.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bthhnn.exec:\bthhnn.exe45⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bnnnnh.exec:\bnnnnh.exe46⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjppp.exec:\pjppp.exe47⤵
- Executes dropped EXE
PID:672 -
\??\c:\pjpvj.exec:\pjpvj.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3ffxxxf.exec:\3ffxxxf.exe49⤵
- Executes dropped EXE
PID:444 -
\??\c:\frfllfx.exec:\frfllfx.exe50⤵
- Executes dropped EXE
PID:612 -
\??\c:\xlfxfxf.exec:\xlfxfxf.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7bnbhh.exec:\7bnbhh.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nbnhnn.exec:\nbnhnn.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rlxlllx.exec:\rlxlllx.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9bnnbn.exec:\9bnnbn.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5tbhtt.exec:\5tbhtt.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vvddp.exec:\vvddp.exe57⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jvvvj.exec:\jvvvj.exe58⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fxllrfl.exec:\fxllrfl.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1frfrlr.exec:\1frfrlr.exe60⤵
- Executes dropped EXE
PID:796 -
\??\c:\hbhbhh.exec:\hbhbhh.exe61⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pjddj.exec:\pjddj.exe62⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vjvvd.exec:\vjvvd.exe63⤵
- Executes dropped EXE
PID:760 -
\??\c:\lxxflll.exec:\lxxflll.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5lllflx.exec:\5lllflx.exe65⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hbttbt.exec:\hbttbt.exe66⤵PID:2000
-
\??\c:\9hhtbb.exec:\9hhtbb.exe67⤵PID:1072
-
\??\c:\vjvdd.exec:\vjvdd.exe68⤵PID:764
-
\??\c:\dvdvd.exec:\dvdvd.exe69⤵PID:2564
-
\??\c:\jdjpv.exec:\jdjpv.exe70⤵PID:1964
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe71⤵PID:2540
-
\??\c:\frfflll.exec:\frfflll.exe72⤵PID:2396
-
\??\c:\7hhnbh.exec:\7hhnbh.exe73⤵PID:1804
-
\??\c:\1hhbtb.exec:\1hhbtb.exe74⤵PID:2492
-
\??\c:\dvddj.exec:\dvddj.exe75⤵PID:1588
-
\??\c:\pvpvd.exec:\pvpvd.exe76⤵PID:2864
-
\??\c:\xxllxxf.exec:\xxllxxf.exe77⤵PID:2816
-
\??\c:\7fflxxx.exec:\7fflxxx.exe78⤵PID:2736
-
\??\c:\nbhhhb.exec:\nbhhhb.exe79⤵PID:2788
-
\??\c:\5htbbt.exec:\5htbbt.exe80⤵PID:2604
-
\??\c:\dvjpv.exec:\dvjpv.exe81⤵PID:2732
-
\??\c:\dvppj.exec:\dvppj.exe82⤵PID:2808
-
\??\c:\frxllrx.exec:\frxllrx.exe83⤵PID:2760
-
\??\c:\1rlrxfl.exec:\1rlrxfl.exe84⤵PID:1364
-
\??\c:\xlxrflr.exec:\xlxrflr.exe85⤵PID:2232
-
\??\c:\3hthhb.exec:\3hthhb.exe86⤵PID:1880
-
\??\c:\thbbhb.exec:\thbbhb.exe87⤵PID:1936
-
\??\c:\vpvdp.exec:\vpvdp.exe88⤵PID:2844
-
\??\c:\pdjpj.exec:\pdjpj.exe89⤵PID:2840
-
\??\c:\fxfrrrx.exec:\fxfrrrx.exe90⤵PID:2012
-
\??\c:\frffrxf.exec:\frffrxf.exe91⤵PID:1720
-
\??\c:\nbnntn.exec:\nbnntn.exe92⤵PID:2656
-
\??\c:\tnbhbh.exec:\tnbhbh.exe93⤵PID:1904
-
\??\c:\vjvvp.exec:\vjvvp.exe94⤵PID:2940
-
\??\c:\9djvj.exec:\9djvj.exe95⤵PID:2932
-
\??\c:\5rlfffl.exec:\5rlfffl.exe96⤵PID:2924
-
\??\c:\3rxffxl.exec:\3rxffxl.exe97⤵PID:2024
-
\??\c:\nhbnbt.exec:\nhbnbt.exe98⤵PID:2964
-
\??\c:\1bbbhh.exec:\1bbbhh.exe99⤵PID:1048
-
\??\c:\tntnhn.exec:\tntnhn.exe100⤵PID:2580
-
\??\c:\9pjjj.exec:\9pjjj.exe101⤵PID:3024
-
\??\c:\jvpdv.exec:\jvpdv.exe102⤵PID:2500
-
\??\c:\9ffrrrl.exec:\9ffrrrl.exe103⤵PID:1808
-
\??\c:\5frxfff.exec:\5frxfff.exe104⤵PID:1376
-
\??\c:\nnbhbb.exec:\nnbhbb.exe105⤵PID:2200
-
\??\c:\vjpvv.exec:\vjpvv.exe106⤵PID:2176
-
\??\c:\jdvpp.exec:\jdvpp.exe107⤵PID:808
-
\??\c:\3jddj.exec:\3jddj.exe108⤵PID:2996
-
\??\c:\3fxllff.exec:\3fxllff.exe109⤵PID:2360
-
\??\c:\1tnttt.exec:\1tnttt.exe110⤵PID:2404
-
\??\c:\bhttbt.exec:\bhttbt.exe111⤵PID:2540
-
\??\c:\thbttt.exec:\thbttt.exe112⤵PID:1812
-
\??\c:\9jpdv.exec:\9jpdv.exe113⤵PID:2416
-
\??\c:\dpvjp.exec:\dpvjp.exe114⤵PID:1544
-
\??\c:\lfrrfxl.exec:\lfrrfxl.exe115⤵PID:1588
-
\??\c:\lfflfll.exec:\lfflfll.exe116⤵PID:2868
-
\??\c:\tntnnn.exec:\tntnnn.exe117⤵PID:2816
-
\??\c:\7tbnnt.exec:\7tbnnt.exe118⤵PID:2704
-
\??\c:\pdjdp.exec:\pdjdp.exe119⤵PID:2788
-
\??\c:\jpdvp.exec:\jpdvp.exe120⤵PID:2604
-
\??\c:\lxrxfff.exec:\lxrxfff.exe121⤵PID:2732
-
\??\c:\xlfflff.exec:\xlfflff.exe122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-