Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7f88c32a84d0749d4bd5a9a45e8d150N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
c7f88c32a84d0749d4bd5a9a45e8d150N.exe
-
Size
93KB
-
MD5
c7f88c32a84d0749d4bd5a9a45e8d150
-
SHA1
77538844c4dd3b3c7d36b5981b3103b09bf331ff
-
SHA256
de82ce87a4bc0524ff90e1dc9ee8ff43d152208150d8d119dbc1621a268fc385
-
SHA512
343c3b1f687653f2b4bbf9d4dc4752bbe56b6ff983c075a875950a570a4839e8d361f580da0b070b8dd899a2faa4752cdc44a473efe84809566e8f8700bf72f2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xQ5z:ymb3NkkiQ3mdBjF+3TU20LQR
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 nnhnbn.exe 1764 xxxlfrf.exe 2576 bhhnhn.exe 1608 djjvj.exe 2176 9vddv.exe 2420 1rrxlrl.exe 2644 btntnt.exe 2872 llfxlfr.exe 2780 1lrfxfr.exe 2604 hbnbnb.exe 2032 pjvdv.exe 1724 fffrrff.exe 3048 llxxlrl.exe 2696 bbthth.exe 2964 9jdjv.exe 3000 xrflrfl.exe 2816 rrrlxfl.exe 2676 bhntth.exe 556 jpjdp.exe 2036 9vpvd.exe 304 rrfrfrf.exe 2352 tnhtnt.exe 380 hhhtht.exe 2368 7dvjp.exe 2160 djddd.exe 2440 xlxflrf.exe 1164 bthnbn.exe 2260 3hhnhn.exe 2484 7ppdd.exe 1900 rlflrlx.exe 2184 fllxrrr.exe 1716 tnhbnt.exe 2528 ddpdp.exe 1712 djjpj.exe 2020 fxrrxlx.exe 1648 1lfrfrf.exe 1772 nnnbnb.exe 1796 nhbntb.exe 2396 1vjjd.exe 2724 lrfxxxf.exe 2420 xrflxrx.exe 2748 nnhnbb.exe 2908 5bhtbt.exe 2664 jjvjd.exe 2660 pddvv.exe 1084 xxrfxfl.exe 2472 nnhthn.exe 2532 1hhhhb.exe 2800 1jvdv.exe 2848 ddvjp.exe 1612 9rxlfrl.exe 3020 fxrrlrx.exe 1972 tnthnb.exe 2240 tthbhb.exe 2568 7vpdp.exe 1364 jdvpd.exe 2468 3llrlrf.exe 3052 lrxlxrf.exe 2112 tnhtht.exe 2588 7bthnt.exe 2108 ddjvj.exe 2364 5pdpd.exe 2512 fxrfrfr.exe 2160 tbhnbt.exe -
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-274-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2316 2180 c7f88c32a84d0749d4bd5a9a45e8d150N.exe 29 PID 2180 wrote to memory of 2316 2180 c7f88c32a84d0749d4bd5a9a45e8d150N.exe 29 PID 2180 wrote to memory of 2316 2180 c7f88c32a84d0749d4bd5a9a45e8d150N.exe 29 PID 2180 wrote to memory of 2316 2180 c7f88c32a84d0749d4bd5a9a45e8d150N.exe 29 PID 2316 wrote to memory of 1764 2316 nnhnbn.exe 30 PID 2316 wrote to memory of 1764 2316 nnhnbn.exe 30 PID 2316 wrote to memory of 1764 2316 nnhnbn.exe 30 PID 2316 wrote to memory of 1764 2316 nnhnbn.exe 30 PID 1764 wrote to memory of 2576 1764 xxxlfrf.exe 31 PID 1764 wrote to memory of 2576 1764 xxxlfrf.exe 31 PID 1764 wrote to memory of 2576 1764 xxxlfrf.exe 31 PID 1764 wrote to memory of 2576 1764 xxxlfrf.exe 31 PID 2576 wrote to memory of 1608 2576 bhhnhn.exe 32 PID 2576 wrote to memory of 1608 2576 bhhnhn.exe 32 PID 2576 wrote to memory of 1608 2576 bhhnhn.exe 32 PID 2576 wrote to memory of 1608 2576 bhhnhn.exe 32 PID 1608 wrote to memory of 2176 1608 djjvj.exe 33 PID 1608 wrote to memory of 2176 1608 djjvj.exe 33 PID 1608 wrote to memory of 2176 1608 djjvj.exe 33 PID 1608 wrote to memory of 2176 1608 djjvj.exe 33 PID 2176 wrote to memory of 2420 2176 9vddv.exe 34 PID 2176 wrote to memory of 2420 2176 9vddv.exe 34 PID 2176 wrote to memory of 2420 2176 9vddv.exe 34 PID 2176 wrote to memory of 2420 2176 9vddv.exe 34 PID 2420 wrote to memory of 2644 2420 1rrxlrl.exe 35 PID 2420 wrote to memory of 2644 2420 1rrxlrl.exe 35 PID 2420 wrote to memory of 2644 2420 1rrxlrl.exe 35 PID 2420 wrote to memory of 2644 2420 1rrxlrl.exe 35 PID 2644 wrote to memory of 2872 2644 btntnt.exe 36 PID 2644 wrote to memory of 2872 2644 btntnt.exe 36 PID 2644 wrote to memory of 2872 2644 btntnt.exe 36 PID 2644 wrote to memory of 2872 2644 btntnt.exe 36 PID 2872 wrote to memory of 2780 2872 llfxlfr.exe 37 PID 2872 wrote to memory of 2780 2872 llfxlfr.exe 37 PID 2872 wrote to memory of 2780 2872 llfxlfr.exe 37 PID 2872 wrote to memory of 2780 2872 llfxlfr.exe 37 PID 2780 wrote to memory of 2604 2780 1lrfxfr.exe 38 PID 2780 wrote to memory of 2604 2780 1lrfxfr.exe 38 PID 2780 wrote to memory of 2604 2780 1lrfxfr.exe 38 PID 2780 wrote to memory of 2604 2780 1lrfxfr.exe 38 PID 2604 wrote to memory of 2032 2604 hbnbnb.exe 39 PID 2604 wrote to memory of 2032 2604 hbnbnb.exe 39 PID 2604 wrote to memory of 2032 2604 hbnbnb.exe 39 PID 2604 wrote to memory of 2032 2604 hbnbnb.exe 39 PID 2032 wrote to memory of 1724 2032 pjvdv.exe 40 PID 2032 wrote to memory of 1724 2032 pjvdv.exe 40 PID 2032 wrote to memory of 1724 2032 pjvdv.exe 40 PID 2032 wrote to memory of 1724 2032 pjvdv.exe 40 PID 1724 wrote to memory of 3048 1724 fffrrff.exe 41 PID 1724 wrote to memory of 3048 1724 fffrrff.exe 41 PID 1724 wrote to memory of 3048 1724 fffrrff.exe 41 PID 1724 wrote to memory of 3048 1724 fffrrff.exe 41 PID 3048 wrote to memory of 2696 3048 llxxlrl.exe 42 PID 3048 wrote to memory of 2696 3048 llxxlrl.exe 42 PID 3048 wrote to memory of 2696 3048 llxxlrl.exe 42 PID 3048 wrote to memory of 2696 3048 llxxlrl.exe 42 PID 2696 wrote to memory of 2964 2696 bbthth.exe 43 PID 2696 wrote to memory of 2964 2696 bbthth.exe 43 PID 2696 wrote to memory of 2964 2696 bbthth.exe 43 PID 2696 wrote to memory of 2964 2696 bbthth.exe 43 PID 2964 wrote to memory of 3000 2964 9jdjv.exe 44 PID 2964 wrote to memory of 3000 2964 9jdjv.exe 44 PID 2964 wrote to memory of 3000 2964 9jdjv.exe 44 PID 2964 wrote to memory of 3000 2964 9jdjv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f88c32a84d0749d4bd5a9a45e8d150N.exe"C:\Users\Admin\AppData\Local\Temp\c7f88c32a84d0749d4bd5a9a45e8d150N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\nnhnbn.exec:\nnhnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\bhhnhn.exec:\bhhnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\djjvj.exec:\djjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\9vddv.exec:\9vddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\1rrxlrl.exec:\1rrxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\btntnt.exec:\btntnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\llfxlfr.exec:\llfxlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1lrfxfr.exec:\1lrfxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hbnbnb.exec:\hbnbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pjvdv.exec:\pjvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\fffrrff.exec:\fffrrff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\llxxlrl.exec:\llxxlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bbthth.exec:\bbthth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9jdjv.exec:\9jdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xrflrfl.exec:\xrflrfl.exe17⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rrrlxfl.exec:\rrrlxfl.exe18⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bhntth.exec:\bhntth.exe19⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jpjdp.exec:\jpjdp.exe20⤵
- Executes dropped EXE
PID:556 -
\??\c:\9vpvd.exec:\9vpvd.exe21⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rrfrfrf.exec:\rrfrfrf.exe22⤵
- Executes dropped EXE
PID:304 -
\??\c:\tnhtnt.exec:\tnhtnt.exe23⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hhhtht.exec:\hhhtht.exe24⤵
- Executes dropped EXE
PID:380 -
\??\c:\7dvjp.exec:\7dvjp.exe25⤵
- Executes dropped EXE
PID:2368 -
\??\c:\djddd.exec:\djddd.exe26⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xlxflrf.exec:\xlxflrf.exe27⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bthnbn.exec:\bthnbn.exe28⤵
- Executes dropped EXE
PID:1164 -
\??\c:\3hhnhn.exec:\3hhnhn.exe29⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7ppdd.exec:\7ppdd.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rlflrlx.exec:\rlflrlx.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fllxrrr.exec:\fllxrrr.exe32⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tnhbnt.exec:\tnhbnt.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ddpdp.exec:\ddpdp.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\djjpj.exec:\djjpj.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fxrrxlx.exec:\fxrrxlx.exe36⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1lfrfrf.exec:\1lfrfrf.exe37⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nnnbnb.exec:\nnnbnb.exe38⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nhbntb.exec:\nhbntb.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1vjjd.exec:\1vjjd.exe40⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lrfxxxf.exec:\lrfxxxf.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xrflxrx.exec:\xrflxrx.exe42⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nnhnbb.exec:\nnhnbb.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5bhtbt.exec:\5bhtbt.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jjvjd.exec:\jjvjd.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pddvv.exec:\pddvv.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xxrfxfl.exec:\xxrfxfl.exe47⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nnhthn.exec:\nnhthn.exe48⤵
- Executes dropped EXE
PID:2472 -
\??\c:\1hhhhb.exec:\1hhhhb.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1jvdv.exec:\1jvdv.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ddvjp.exec:\ddvjp.exe51⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9rxlfrl.exec:\9rxlfrl.exe52⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fxrrlrx.exec:\fxrrlrx.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnthnb.exec:\tnthnb.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tthbhb.exec:\tthbhb.exe55⤵
- Executes dropped EXE
PID:2240 -
\??\c:\7vpdp.exec:\7vpdp.exe56⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jdvpd.exec:\jdvpd.exe57⤵
- Executes dropped EXE
PID:1364 -
\??\c:\3llrlrf.exec:\3llrlrf.exe58⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lrxlxrf.exec:\lrxlxrf.exe59⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tnhtht.exec:\tnhtht.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7bthnt.exec:\7bthnt.exe61⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ddjvj.exec:\ddjvj.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5pdpd.exec:\5pdpd.exe63⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe64⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tbhnbt.exec:\tbhnbt.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ddvpj.exec:\ddvpj.exe66⤵PID:2120
-
\??\c:\9dvpv.exec:\9dvpv.exe67⤵PID:2212
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe68⤵PID:308
-
\??\c:\rrfxrxr.exec:\rrfxrxr.exe69⤵PID:2592
-
\??\c:\3thnbh.exec:\3thnbh.exe70⤵PID:2220
-
\??\c:\1nhnbn.exec:\1nhnbn.exe71⤵PID:1136
-
\??\c:\ddvvj.exec:\ddvvj.exe72⤵PID:1900
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe73⤵PID:688
-
\??\c:\5rrxfrx.exec:\5rrxfrx.exe74⤵PID:2272
-
\??\c:\nnbnbh.exec:\nnbnbh.exe75⤵PID:1028
-
\??\c:\tbtnth.exec:\tbtnth.exe76⤵PID:2528
-
\??\c:\jjjjv.exec:\jjjjv.exe77⤵PID:852
-
\??\c:\jjjpj.exec:\jjjpj.exe78⤵PID:2020
-
\??\c:\xfllxfr.exec:\xfllxfr.exe79⤵PID:2700
-
\??\c:\fxlrllf.exec:\fxlrllf.exe80⤵PID:1772
-
\??\c:\7tnthh.exec:\7tnthh.exe81⤵PID:2412
-
\??\c:\thtntb.exec:\thtntb.exe82⤵PID:2396
-
\??\c:\vvvpd.exec:\vvvpd.exe83⤵PID:2724
-
\??\c:\7pdpj.exec:\7pdpj.exe84⤵PID:2420
-
\??\c:\ffrrxfr.exec:\ffrrxfr.exe85⤵PID:2768
-
\??\c:\5fxfllx.exec:\5fxfllx.exe86⤵PID:2864
-
\??\c:\hntntn.exec:\hntntn.exe87⤵PID:2664
-
\??\c:\1htnbb.exec:\1htnbb.exe88⤵PID:2660
-
\??\c:\5jvvv.exec:\5jvvv.exe89⤵PID:2620
-
\??\c:\vvpjp.exec:\vvpjp.exe90⤵PID:2472
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe91⤵PID:2372
-
\??\c:\lxfxfrr.exec:\lxfxfrr.exe92⤵PID:2800
-
\??\c:\1bttnt.exec:\1bttnt.exe93⤵PID:2824
-
\??\c:\nhbbbb.exec:\nhbbbb.exe94⤵PID:1612
-
\??\c:\dpjpp.exec:\dpjpp.exe95⤵PID:2252
-
\??\c:\7jjpp.exec:\7jjpp.exe96⤵PID:1972
-
\??\c:\fxlrfll.exec:\fxlrfll.exe97⤵PID:2596
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe98⤵PID:2568
-
\??\c:\9llxflx.exec:\9llxflx.exe99⤵PID:1328
-
\??\c:\ththnn.exec:\ththnn.exe100⤵PID:2320
-
\??\c:\5hnnhb.exec:\5hnnhb.exe101⤵PID:2572
-
\??\c:\9dpvd.exec:\9dpvd.exe102⤵PID:2112
-
\??\c:\7lflrlf.exec:\7lflrlf.exe103⤵PID:2588
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe104⤵PID:2108
-
\??\c:\bthhtn.exec:\bthhtn.exe105⤵PID:2808
-
\??\c:\hbttbn.exec:\hbttbn.exe106⤵PID:1188
-
\??\c:\pdppj.exec:\pdppj.exe107⤵PID:1624
-
\??\c:\5vvdp.exec:\5vvdp.exe108⤵PID:2120
-
\??\c:\vjvvd.exec:\vjvvd.exe109⤵PID:912
-
\??\c:\5rfffff.exec:\5rfffff.exe110⤵PID:308
-
\??\c:\7lffxfx.exec:\7lffxfx.exe111⤵PID:612
-
\??\c:\3bbbhn.exec:\3bbbhn.exe112⤵PID:2220
-
\??\c:\1tnbbh.exec:\1tnbbh.exe113⤵PID:276
-
\??\c:\vpjpv.exec:\vpjpv.exe114⤵PID:1900
-
\??\c:\9lrrfxr.exec:\9lrrfxr.exe115⤵PID:1716
-
\??\c:\lfxlrxx.exec:\lfxlrxx.exe116⤵PID:2044
-
\??\c:\bbbntb.exec:\bbbntb.exe117⤵PID:2524
-
\??\c:\nnbhth.exec:\nnbhth.exe118⤵PID:1980
-
\??\c:\3jdjd.exec:\3jdjd.exe119⤵PID:2576
-
\??\c:\jvppp.exec:\jvppp.exe120⤵PID:2548
-
\??\c:\rlrxxrl.exec:\rlrxxrl.exe121⤵PID:284
-
\??\c:\9lflrxf.exec:\9lflrxf.exe122⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-