Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 03:32
Static task
static1
Behavioral task
behavioral1
Sample
d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe
Resource
win7-20240708-en
General
-
Target
d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe
-
Size
963KB
-
MD5
07612bfccc863ae2d0f84dd4f1a85453
-
SHA1
0d3969ce5680da5ec475348e196e5d7cdafe826d
-
SHA256
d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24
-
SHA512
052956c3e744f0ce0f13e6a4d08e4c1f2390de9f986891847001cb88eebac459c2728574a37850ddf24f28c8a66a74739ad6c4dc2fd23605362bf722e34b624a
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL04iVypNKvzcMwdBS3b3aoqYveXVadBlHD+CURPO6:SgD4bhoqLDqYLagB6Wj1+CyU
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2232-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2660 5rlrfrf.exe 2952 lflrxxx.exe 2144 lfrllff.exe 2724 dvddj.exe 2568 5hhnnn.exe 556 tntbbb.exe 816 xrxrrll.exe 2340 5bhnth.exe 2512 1vjdd.exe 1940 fxxxxxx.exe 308 xlfxfxx.exe 1056 hnthbn.exe 1644 lfllrll.exe 1780 5hnhnn.exe 1900 rlxrxrr.exe 2312 9dvvd.exe 2396 9tnnnn.exe 1124 pjjdj.exe 800 3bhhnn.exe 1296 lfffxlx.exe 628 pdpjj.exe 2856 lfflrll.exe 1364 frxxxlx.exe 2452 ntbnnb.exe 1980 ppjpj.exe 3016 nhhnbt.exe 2032 dvdjj.exe 1956 fxlfxlr.exe 2460 fxrfflr.exe 1044 nhtbnt.exe 2428 3bbhnh.exe 2700 vvjdp.exe 2808 vvppj.exe 2716 ffxlflr.exe 2676 ttbbnt.exe 2572 1dpvv.exe 2144 9xrxrrx.exe 2548 bnnnbb.exe 2328 3pddp.exe 2568 fxllffl.exe 2564 nhbntn.exe 2400 ddjjj.exe 2532 7lxfrlf.exe 2960 tntntt.exe 2088 vvjjp.exe 1772 xrxlxfl.exe 2072 nhbhth.exe 308 djvdd.exe 1084 llfrlxf.exe 2136 bbntbh.exe 264 ppdpd.exe 1748 5lrrrxr.exe 1896 thhnbb.exe 2352 jjvjp.exe 2212 xlrxrll.exe 2396 5bnhnn.exe 1124 vvjpv.exe 800 1fxflrr.exe 1852 bbnhtb.exe 740 1dvdd.exe 628 7flrlrf.exe 2856 nnbbnh.exe 1724 jdvpv.exe 2452 ppdjv.exe -
resource yara_rule behavioral1/memory/2232-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-310-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2660 2232 d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe 30 PID 2232 wrote to memory of 2660 2232 d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe 30 PID 2232 wrote to memory of 2660 2232 d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe 30 PID 2232 wrote to memory of 2660 2232 d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe 30 PID 2660 wrote to memory of 2952 2660 5rlrfrf.exe 31 PID 2660 wrote to memory of 2952 2660 5rlrfrf.exe 31 PID 2660 wrote to memory of 2952 2660 5rlrfrf.exe 31 PID 2660 wrote to memory of 2952 2660 5rlrfrf.exe 31 PID 2952 wrote to memory of 2144 2952 lflrxxx.exe 32 PID 2952 wrote to memory of 2144 2952 lflrxxx.exe 32 PID 2952 wrote to memory of 2144 2952 lflrxxx.exe 32 PID 2952 wrote to memory of 2144 2952 lflrxxx.exe 32 PID 2144 wrote to memory of 2724 2144 lfrllff.exe 33 PID 2144 wrote to memory of 2724 2144 lfrllff.exe 33 PID 2144 wrote to memory of 2724 2144 lfrllff.exe 33 PID 2144 wrote to memory of 2724 2144 lfrllff.exe 33 PID 2724 wrote to memory of 2568 2724 dvddj.exe 34 PID 2724 wrote to memory of 2568 2724 dvddj.exe 34 PID 2724 wrote to memory of 2568 2724 dvddj.exe 34 PID 2724 wrote to memory of 2568 2724 dvddj.exe 34 PID 2568 wrote to memory of 556 2568 5hhnnn.exe 35 PID 2568 wrote to memory of 556 2568 5hhnnn.exe 35 PID 2568 wrote to memory of 556 2568 5hhnnn.exe 35 PID 2568 wrote to memory of 556 2568 5hhnnn.exe 35 PID 556 wrote to memory of 816 556 tntbbb.exe 36 PID 556 wrote to memory of 816 556 tntbbb.exe 36 PID 556 wrote to memory of 816 556 tntbbb.exe 36 PID 556 wrote to memory of 816 556 tntbbb.exe 36 PID 816 wrote to memory of 2340 816 xrxrrll.exe 37 PID 816 wrote to memory of 2340 816 xrxrrll.exe 37 PID 816 wrote to memory of 2340 816 xrxrrll.exe 37 PID 816 wrote to memory of 2340 816 xrxrrll.exe 37 PID 2340 wrote to memory of 2512 2340 5bhnth.exe 38 PID 2340 wrote to memory of 2512 2340 5bhnth.exe 38 PID 2340 wrote to memory of 2512 2340 5bhnth.exe 38 PID 2340 wrote to memory of 2512 2340 5bhnth.exe 38 PID 2512 wrote to memory of 1940 2512 1vjdd.exe 39 PID 2512 wrote to memory of 1940 2512 1vjdd.exe 39 PID 2512 wrote to memory of 1940 2512 1vjdd.exe 39 PID 2512 wrote to memory of 1940 2512 1vjdd.exe 39 PID 1940 wrote to memory of 308 1940 fxxxxxx.exe 40 PID 1940 wrote to memory of 308 1940 fxxxxxx.exe 40 PID 1940 wrote to memory of 308 1940 fxxxxxx.exe 40 PID 1940 wrote to memory of 308 1940 fxxxxxx.exe 40 PID 308 wrote to memory of 1056 308 xlfxfxx.exe 41 PID 308 wrote to memory of 1056 308 xlfxfxx.exe 41 PID 308 wrote to memory of 1056 308 xlfxfxx.exe 41 PID 308 wrote to memory of 1056 308 xlfxfxx.exe 41 PID 1056 wrote to memory of 1644 1056 hnthbn.exe 42 PID 1056 wrote to memory of 1644 1056 hnthbn.exe 42 PID 1056 wrote to memory of 1644 1056 hnthbn.exe 42 PID 1056 wrote to memory of 1644 1056 hnthbn.exe 42 PID 1644 wrote to memory of 1780 1644 lfllrll.exe 43 PID 1644 wrote to memory of 1780 1644 lfllrll.exe 43 PID 1644 wrote to memory of 1780 1644 lfllrll.exe 43 PID 1644 wrote to memory of 1780 1644 lfllrll.exe 43 PID 1780 wrote to memory of 1900 1780 5hnhnn.exe 44 PID 1780 wrote to memory of 1900 1780 5hnhnn.exe 44 PID 1780 wrote to memory of 1900 1780 5hnhnn.exe 44 PID 1780 wrote to memory of 1900 1780 5hnhnn.exe 44 PID 1900 wrote to memory of 2312 1900 rlxrxrr.exe 45 PID 1900 wrote to memory of 2312 1900 rlxrxrr.exe 45 PID 1900 wrote to memory of 2312 1900 rlxrxrr.exe 45 PID 1900 wrote to memory of 2312 1900 rlxrxrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe"C:\Users\Admin\AppData\Local\Temp\d30bceb876f5e4697d5a6300a330f2774fe7d5509f1d2cbd846cc3691fb31c24.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\5rlrfrf.exec:\5rlrfrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lflrxxx.exec:\lflrxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\lfrllff.exec:\lfrllff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\dvddj.exec:\dvddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5hhnnn.exec:\5hhnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tntbbb.exec:\tntbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\xrxrrll.exec:\xrxrrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\5bhnth.exec:\5bhnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\1vjdd.exec:\1vjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\xlfxfxx.exec:\xlfxfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\hnthbn.exec:\hnthbn.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\lfllrll.exec:\lfllrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\5hnhnn.exec:\5hnhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rlxrxrr.exec:\rlxrxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\9dvvd.exec:\9dvvd.exe17⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9tnnnn.exec:\9tnnnn.exe18⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pjjdj.exec:\pjjdj.exe19⤵
- Executes dropped EXE
PID:1124 -
\??\c:\3bhhnn.exec:\3bhhnn.exe20⤵
- Executes dropped EXE
PID:800 -
\??\c:\lfffxlx.exec:\lfffxlx.exe21⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pdpjj.exec:\pdpjj.exe22⤵
- Executes dropped EXE
PID:628 -
\??\c:\lfflrll.exec:\lfflrll.exe23⤵
- Executes dropped EXE
PID:2856 -
\??\c:\frxxxlx.exec:\frxxxlx.exe24⤵
- Executes dropped EXE
PID:1364 -
\??\c:\ntbnnb.exec:\ntbnnb.exe25⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ppjpj.exec:\ppjpj.exe26⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nhhnbt.exec:\nhhnbt.exe27⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvdjj.exec:\dvdjj.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\fxlfxlr.exec:\fxlfxlr.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\fxrfflr.exec:\fxrfflr.exe30⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nhtbnt.exec:\nhtbnt.exe31⤵
- Executes dropped EXE
PID:1044 -
\??\c:\3bbhnh.exec:\3bbhnh.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vvjdp.exec:\vvjdp.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vvppj.exec:\vvppj.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ffxlflr.exec:\ffxlflr.exe35⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ttbbnt.exec:\ttbbnt.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1dpvv.exec:\1dpvv.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9xrxrrx.exec:\9xrxrrx.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bnnnbb.exec:\bnnnbb.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3pddp.exec:\3pddp.exe40⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fxllffl.exec:\fxllffl.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhbntn.exec:\nhbntn.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ddjjj.exec:\ddjjj.exe43⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7lxfrlf.exec:\7lxfrlf.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tntntt.exec:\tntntt.exe45⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvjjp.exec:\vvjjp.exe46⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xrxlxfl.exec:\xrxlxfl.exe47⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nhbhth.exec:\nhbhth.exe48⤵
- Executes dropped EXE
PID:2072 -
\??\c:\djvdd.exec:\djvdd.exe49⤵
- Executes dropped EXE
PID:308 -
\??\c:\llfrlxf.exec:\llfrlxf.exe50⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bbntbh.exec:\bbntbh.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ppdpd.exec:\ppdpd.exe52⤵
- Executes dropped EXE
PID:264 -
\??\c:\5lrrrxr.exec:\5lrrrxr.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\thhnbb.exec:\thhnbb.exe54⤵
- Executes dropped EXE
PID:1896 -
\??\c:\jjvjp.exec:\jjvjp.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xlrxrll.exec:\xlrxrll.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5bnhnn.exec:\5bnhnn.exe57⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvjpv.exec:\vvjpv.exe58⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1fxflrr.exec:\1fxflrr.exe59⤵
- Executes dropped EXE
PID:800 -
\??\c:\bbnhtb.exec:\bbnhtb.exe60⤵
- Executes dropped EXE
PID:1852 -
\??\c:\1dvdd.exec:\1dvdd.exe61⤵
- Executes dropped EXE
PID:740 -
\??\c:\7flrlrf.exec:\7flrlrf.exe62⤵
- Executes dropped EXE
PID:628 -
\??\c:\nnbbnh.exec:\nnbbnh.exe63⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jdvpv.exec:\jdvpv.exe64⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppdjv.exec:\ppdjv.exe65⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nbhthh.exec:\nbhthh.exe66⤵PID:1764
-
\??\c:\vjvjd.exec:\vjvjd.exe67⤵PID:1468
-
\??\c:\fxflflx.exec:\fxflflx.exe68⤵PID:1756
-
\??\c:\ntbtht.exec:\ntbtht.exe69⤵PID:568
-
\??\c:\pjdjp.exec:\pjdjp.exe70⤵PID:2300
-
\??\c:\9flrrfl.exec:\9flrrfl.exe71⤵PID:1856
-
\??\c:\tnbttn.exec:\tnbttn.exe72⤵PID:2180
-
\??\c:\5dppp.exec:\5dppp.exe73⤵PID:2252
-
\??\c:\xxlllrr.exec:\xxlllrr.exe74⤵PID:2940
-
\??\c:\bthhnt.exec:\bthhnt.exe75⤵PID:1600
-
\??\c:\djpjv.exec:\djpjv.exe76⤵PID:2964
-
\??\c:\xrffxfl.exec:\xrffxfl.exe77⤵PID:2720
-
\??\c:\ttttbt.exec:\ttttbt.exe78⤵PID:2796
-
\??\c:\vpdvd.exec:\vpdvd.exe79⤵PID:2500
-
\??\c:\lxlxlfl.exec:\lxlxlfl.exe80⤵PID:2560
-
\??\c:\nbnhtt.exec:\nbnhtt.exe81⤵PID:2320
-
\??\c:\nhtbnt.exec:\nhtbnt.exe82⤵PID:2544
-
\??\c:\ppvvd.exec:\ppvvd.exe83⤵PID:2256
-
\??\c:\fflrrfl.exec:\fflrrfl.exe84⤵PID:108
-
\??\c:\tnbhtb.exec:\tnbhtb.exe85⤵PID:2968
-
\??\c:\dvvvj.exec:\dvvvj.exe86⤵PID:2528
-
\??\c:\xxxfllx.exec:\xxxfllx.exe87⤵PID:2316
-
\??\c:\btbhtt.exec:\btbhtt.exe88⤵PID:2536
-
\??\c:\tntnbb.exec:\tntnbb.exe89⤵PID:1284
-
\??\c:\vpdjp.exec:\vpdjp.exe90⤵PID:2840
-
\??\c:\fxlrxff.exec:\fxlrxff.exe91⤵PID:1056
-
\??\c:\thhnnt.exec:\thhnnt.exe92⤵PID:1680
-
\??\c:\ppjjj.exec:\ppjjj.exe93⤵PID:2136
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe94⤵PID:264
-
\??\c:\bthhnt.exec:\bthhnt.exe95⤵PID:1472
-
\??\c:\jdpvd.exec:\jdpvd.exe96⤵PID:1896
-
\??\c:\rfrxrll.exec:\rfrxrll.exe97⤵PID:1960
-
\??\c:\tnhntt.exec:\tnhntt.exe98⤵PID:2364
-
\??\c:\nnhbhh.exec:\nnhbhh.exe99⤵PID:2360
-
\??\c:\jdvjd.exec:\jdvjd.exe100⤵PID:1124
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe101⤵PID:1300
-
\??\c:\hbnbtb.exec:\hbnbtb.exe102⤵PID:1852
-
\??\c:\ppdjp.exec:\ppdjp.exe103⤵PID:1492
-
\??\c:\xxrllxl.exec:\xxrllxl.exe104⤵PID:628
-
\??\c:\tttnht.exec:\tttnht.exe105⤵PID:1536
-
\??\c:\jdpjp.exec:\jdpjp.exe106⤵PID:1724
-
\??\c:\5rlllrx.exec:\5rlllrx.exe107⤵PID:2100
-
\??\c:\xxlfrll.exec:\xxlfrll.exe108⤵PID:3008
-
\??\c:\hhntbb.exec:\hhntbb.exe109⤵PID:3060
-
\??\c:\jdvpp.exec:\jdvpp.exe110⤵PID:1756
-
\??\c:\fxllllx.exec:\fxllllx.exe111⤵PID:1956
-
\??\c:\nnbnhh.exec:\nnbnhh.exe112⤵PID:2300
-
\??\c:\7vvdd.exec:\7vvdd.exe113⤵PID:2744
-
\??\c:\lfxflll.exec:\lfxflll.exe114⤵PID:2180
-
\??\c:\9bnntn.exec:\9bnntn.exe115⤵PID:2232
-
\??\c:\btbtnt.exec:\btbtnt.exe116⤵PID:2940
-
\??\c:\dvppd.exec:\dvppd.exe117⤵PID:2700
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe118⤵PID:2964
-
\??\c:\5btthh.exec:\5btthh.exe119⤵PID:2688
-
\??\c:\pjvpp.exec:\pjvpp.exe120⤵PID:2796
-
\??\c:\lfxflll.exec:\lfxflll.exe121⤵PID:2920
-
\??\c:\5pvvp.exec:\5pvvp.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-