Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f39d1361a8c174cca2588bfca30bc1b0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
f39d1361a8c174cca2588bfca30bc1b0N.exe
-
Size
65KB
-
MD5
f39d1361a8c174cca2588bfca30bc1b0
-
SHA1
4ae6ed66173c156c44fe7378b4646fa0411f49da
-
SHA256
12ce31e2bb90d843f9f4a9d4c545238d89b4e1e6ae3eea95573e9230f1c85726
-
SHA512
86ed1725505dd75d3033bdfc0348058e3c74465a431abb93a9a12d8809cba73015af1d5a78a9bd08471d8f4c7f3a9fc3e2ab920563a013529543e108beb2520c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfj:ymb3NkkiQ3mdBjFI9cqfj
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2820-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/236-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2652 llxrrlx.exe 2852 1flllfr.exe 2692 5nhhbb.exe 2548 jdjdv.exe 3016 vppjj.exe 480 xlfffxf.exe 568 1flffrl.exe 2864 5htnbt.exe 2388 dvvvv.exe 2588 9pvpp.exe 2004 1rfxxxx.exe 1876 htnnnn.exe 2012 nnntnt.exe 2776 vjppv.exe 620 lfrllll.exe 1948 thtnnh.exe 2208 nhbttt.exe 2512 dvdvp.exe 2268 xxllllr.exe 2244 fxfflrf.exe 236 bbhbhh.exe 1692 jdpvj.exe 1848 vpddd.exe 2100 fxflxxl.exe 1284 3frxxrx.exe 3032 htbnnh.exe 3024 3hnhhh.exe 1412 5jpdd.exe 2264 ppddp.exe 2140 5lflrrx.exe 2628 hbthtt.exe 1632 vjppv.exe 2828 pdvpv.exe 2592 3llrflx.exe 2560 3rxxfxf.exe 2532 1hhtbh.exe 1860 9hhntt.exe 2544 pjjjd.exe 1716 1flllff.exe 2968 7xflrrx.exe 2180 thnnnn.exe 2388 nnbtbh.exe 2588 jdjjp.exe 2372 ppvvd.exe 2300 xrrxxrx.exe 1564 5frrxxl.exe 2596 xrxxxfl.exe 2752 bbntbb.exe 1712 7jdpd.exe 2028 vpjjj.exe 1780 3xrrxxf.exe 2128 xrflxrf.exe 2224 5lxxflr.exe 1960 5tthhh.exe 2116 1hbnnb.exe 1512 3jjjj.exe 760 vppjd.exe 1264 rlxfrrf.exe 3052 lfrrrxr.exe 344 9nhnhn.exe 956 ddpvv.exe 1884 ddpvp.exe 1856 rllffff.exe 1992 lfxfllx.exe -
resource yara_rule behavioral1/memory/2820-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/236-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2652 2820 f39d1361a8c174cca2588bfca30bc1b0N.exe 30 PID 2820 wrote to memory of 2652 2820 f39d1361a8c174cca2588bfca30bc1b0N.exe 30 PID 2820 wrote to memory of 2652 2820 f39d1361a8c174cca2588bfca30bc1b0N.exe 30 PID 2820 wrote to memory of 2652 2820 f39d1361a8c174cca2588bfca30bc1b0N.exe 30 PID 2652 wrote to memory of 2852 2652 llxrrlx.exe 31 PID 2652 wrote to memory of 2852 2652 llxrrlx.exe 31 PID 2652 wrote to memory of 2852 2652 llxrrlx.exe 31 PID 2652 wrote to memory of 2852 2652 llxrrlx.exe 31 PID 2852 wrote to memory of 2692 2852 1flllfr.exe 32 PID 2852 wrote to memory of 2692 2852 1flllfr.exe 32 PID 2852 wrote to memory of 2692 2852 1flllfr.exe 32 PID 2852 wrote to memory of 2692 2852 1flllfr.exe 32 PID 2692 wrote to memory of 2548 2692 5nhhbb.exe 33 PID 2692 wrote to memory of 2548 2692 5nhhbb.exe 33 PID 2692 wrote to memory of 2548 2692 5nhhbb.exe 33 PID 2692 wrote to memory of 2548 2692 5nhhbb.exe 33 PID 2548 wrote to memory of 3016 2548 jdjdv.exe 34 PID 2548 wrote to memory of 3016 2548 jdjdv.exe 34 PID 2548 wrote to memory of 3016 2548 jdjdv.exe 34 PID 2548 wrote to memory of 3016 2548 jdjdv.exe 34 PID 3016 wrote to memory of 480 3016 vppjj.exe 35 PID 3016 wrote to memory of 480 3016 vppjj.exe 35 PID 3016 wrote to memory of 480 3016 vppjj.exe 35 PID 3016 wrote to memory of 480 3016 vppjj.exe 35 PID 480 wrote to memory of 568 480 xlfffxf.exe 36 PID 480 wrote to memory of 568 480 xlfffxf.exe 36 PID 480 wrote to memory of 568 480 xlfffxf.exe 36 PID 480 wrote to memory of 568 480 xlfffxf.exe 36 PID 568 wrote to memory of 2864 568 1flffrl.exe 37 PID 568 wrote to memory of 2864 568 1flffrl.exe 37 PID 568 wrote to memory of 2864 568 1flffrl.exe 37 PID 568 wrote to memory of 2864 568 1flffrl.exe 37 PID 2864 wrote to memory of 2388 2864 5htnbt.exe 38 PID 2864 wrote to memory of 2388 2864 5htnbt.exe 38 PID 2864 wrote to memory of 2388 2864 5htnbt.exe 38 PID 2864 wrote to memory of 2388 2864 5htnbt.exe 38 PID 2388 wrote to memory of 2588 2388 dvvvv.exe 39 PID 2388 wrote to memory of 2588 2388 dvvvv.exe 39 PID 2388 wrote to memory of 2588 2388 dvvvv.exe 39 PID 2388 wrote to memory of 2588 2388 dvvvv.exe 39 PID 2588 wrote to memory of 2004 2588 9pvpp.exe 40 PID 2588 wrote to memory of 2004 2588 9pvpp.exe 40 PID 2588 wrote to memory of 2004 2588 9pvpp.exe 40 PID 2588 wrote to memory of 2004 2588 9pvpp.exe 40 PID 2004 wrote to memory of 1876 2004 1rfxxxx.exe 41 PID 2004 wrote to memory of 1876 2004 1rfxxxx.exe 41 PID 2004 wrote to memory of 1876 2004 1rfxxxx.exe 41 PID 2004 wrote to memory of 1876 2004 1rfxxxx.exe 41 PID 1876 wrote to memory of 2012 1876 htnnnn.exe 42 PID 1876 wrote to memory of 2012 1876 htnnnn.exe 42 PID 1876 wrote to memory of 2012 1876 htnnnn.exe 42 PID 1876 wrote to memory of 2012 1876 htnnnn.exe 42 PID 2012 wrote to memory of 2776 2012 nnntnt.exe 43 PID 2012 wrote to memory of 2776 2012 nnntnt.exe 43 PID 2012 wrote to memory of 2776 2012 nnntnt.exe 43 PID 2012 wrote to memory of 2776 2012 nnntnt.exe 43 PID 2776 wrote to memory of 620 2776 vjppv.exe 44 PID 2776 wrote to memory of 620 2776 vjppv.exe 44 PID 2776 wrote to memory of 620 2776 vjppv.exe 44 PID 2776 wrote to memory of 620 2776 vjppv.exe 44 PID 620 wrote to memory of 1948 620 lfrllll.exe 45 PID 620 wrote to memory of 1948 620 lfrllll.exe 45 PID 620 wrote to memory of 1948 620 lfrllll.exe 45 PID 620 wrote to memory of 1948 620 lfrllll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f39d1361a8c174cca2588bfca30bc1b0N.exe"C:\Users\Admin\AppData\Local\Temp\f39d1361a8c174cca2588bfca30bc1b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\llxrrlx.exec:\llxrrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\1flllfr.exec:\1flllfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5nhhbb.exec:\5nhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jdjdv.exec:\jdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vppjj.exec:\vppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xlfffxf.exec:\xlfffxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\1flffrl.exec:\1flffrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\5htnbt.exec:\5htnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dvvvv.exec:\dvvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\9pvpp.exec:\9pvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\1rfxxxx.exec:\1rfxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\htnnnn.exec:\htnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\nnntnt.exec:\nnntnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vjppv.exec:\vjppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lfrllll.exec:\lfrllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\thtnnh.exec:\thtnnh.exe17⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nhbttt.exec:\nhbttt.exe18⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dvdvp.exec:\dvdvp.exe19⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xxllllr.exec:\xxllllr.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxfflrf.exec:\fxfflrf.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bbhbhh.exec:\bbhbhh.exe22⤵
- Executes dropped EXE
PID:236 -
\??\c:\jdpvj.exec:\jdpvj.exe23⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vpddd.exec:\vpddd.exe24⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fxflxxl.exec:\fxflxxl.exe25⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3frxxrx.exec:\3frxxrx.exe26⤵
- Executes dropped EXE
PID:1284 -
\??\c:\htbnnh.exec:\htbnnh.exe27⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3hnhhh.exec:\3hnhhh.exe28⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5jpdd.exec:\5jpdd.exe29⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ppddp.exec:\ppddp.exe30⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5lflrrx.exec:\5lflrrx.exe31⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbthtt.exec:\hbthtt.exe32⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vjppv.exec:\vjppv.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pdvpv.exec:\pdvpv.exe34⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3llrflx.exec:\3llrflx.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3rxxfxf.exec:\3rxxfxf.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1hhtbh.exec:\1hhtbh.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9hhntt.exec:\9hhntt.exe38⤵
- Executes dropped EXE
PID:1860 -
\??\c:\pjjjd.exec:\pjjjd.exe39⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1flllff.exec:\1flllff.exe40⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7xflrrx.exec:\7xflrrx.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\thnnnn.exec:\thnnnn.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nnbtbh.exec:\nnbtbh.exe43⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jdjjp.exec:\jdjjp.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ppvvd.exec:\ppvvd.exe45⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xrrxxrx.exec:\xrrxxrx.exe46⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5frrxxl.exec:\5frrxxl.exe47⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bbntbb.exec:\bbntbb.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7jdpd.exec:\7jdpd.exe50⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vpjjj.exec:\vpjjj.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3xrrxxf.exec:\3xrrxxf.exe52⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xrflxrf.exec:\xrflxrf.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5lxxflr.exec:\5lxxflr.exe54⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5tthhh.exec:\5tthhh.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1hbnnb.exec:\1hbnnb.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3jjjj.exec:\3jjjj.exe57⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vppjd.exec:\vppjd.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe59⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lfrrrxr.exec:\lfrrrxr.exe60⤵
- Executes dropped EXE
PID:3052 -
\??\c:\9nhnhn.exec:\9nhnhn.exe61⤵
- Executes dropped EXE
PID:344 -
\??\c:\ddpvv.exec:\ddpvv.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\ddpvp.exec:\ddpvp.exe63⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rllffff.exec:\rllffff.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfxfllx.exec:\lfxfllx.exe65⤵
- Executes dropped EXE
PID:1992 -
\??\c:\btbttt.exec:\btbttt.exe66⤵PID:2904
-
\??\c:\3bbhhn.exec:\3bbhhn.exe67⤵PID:2896
-
\??\c:\7jppp.exec:\7jppp.exe68⤵PID:1608
-
\??\c:\9jddv.exec:\9jddv.exe69⤵PID:2916
-
\??\c:\frfrxxx.exec:\frfrxxx.exe70⤵PID:1520
-
\??\c:\lfffxxl.exec:\lfffxxl.exe71⤵PID:2684
-
\??\c:\9xfffxf.exec:\9xfffxf.exe72⤵PID:2552
-
\??\c:\nnbbhh.exec:\nnbbhh.exe73⤵PID:2648
-
\??\c:\bnbbbb.exec:\bnbbbb.exe74⤵PID:2148
-
\??\c:\jdddj.exec:\jdddj.exe75⤵PID:2560
-
\??\c:\pvddd.exec:\pvddd.exe76⤵PID:1984
-
\??\c:\3rflrlr.exec:\3rflrlr.exe77⤵PID:1860
-
\??\c:\xrffffl.exec:\xrffffl.exe78⤵PID:2888
-
\??\c:\3tnbhn.exec:\3tnbhn.exe79⤵PID:2864
-
\??\c:\bnhnbh.exec:\bnhnbh.exe80⤵PID:2220
-
\??\c:\thttnh.exec:\thttnh.exe81⤵PID:2180
-
\??\c:\5djvd.exec:\5djvd.exe82⤵PID:2388
-
\??\c:\3djpj.exec:\3djpj.exe83⤵PID:2588
-
\??\c:\fxfxrrx.exec:\fxfxrrx.exe84⤵PID:2004
-
\??\c:\rlfrxxr.exec:\rlfrxxr.exe85⤵PID:2784
-
\??\c:\frrllff.exec:\frrllff.exe86⤵PID:2012
-
\??\c:\nbnhhb.exec:\nbnhhb.exe87⤵PID:2596
-
\??\c:\3nbttt.exec:\3nbttt.exe88⤵PID:524
-
\??\c:\jddjp.exec:\jddjp.exe89⤵PID:1712
-
\??\c:\5vjdd.exec:\5vjdd.exe90⤵PID:2096
-
\??\c:\9llxflx.exec:\9llxflx.exe91⤵PID:1780
-
\??\c:\3xflrll.exec:\3xflrll.exe92⤵PID:2512
-
\??\c:\5tttbb.exec:\5tttbb.exe93⤵PID:2164
-
\??\c:\thhbhh.exec:\thhbhh.exe94⤵PID:856
-
\??\c:\ppdjv.exec:\ppdjv.exe95⤵PID:2116
-
\??\c:\vpjjp.exec:\vpjjp.exe96⤵PID:1400
-
\??\c:\3xrxrxx.exec:\3xrxrxx.exe97⤵PID:1660
-
\??\c:\xrxxlll.exec:\xrxxlll.exe98⤵PID:1264
-
\??\c:\nhbbhh.exec:\nhbbhh.exe99⤵PID:3052
-
\??\c:\tnnntn.exec:\tnnntn.exe100⤵PID:1540
-
\??\c:\vpdjp.exec:\vpdjp.exe101⤵PID:956
-
\??\c:\pddvv.exec:\pddvv.exe102⤵PID:2964
-
\??\c:\dvjdj.exec:\dvjdj.exe103⤵PID:1856
-
\??\c:\rlrlfxf.exec:\rlrlfxf.exe104⤵PID:600
-
\??\c:\xrllxrx.exec:\xrllxrx.exe105⤵PID:2904
-
\??\c:\7tbbhb.exec:\7tbbhb.exe106⤵PID:2848
-
\??\c:\dvdjp.exec:\dvdjp.exe107⤵PID:1608
-
\??\c:\jvvjj.exec:\jvvjj.exe108⤵PID:2816
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe109⤵PID:1520
-
\??\c:\fxlffxx.exec:\fxlffxx.exe110⤵PID:2640
-
\??\c:\frrxrrr.exec:\frrxrrr.exe111⤵PID:796
-
\??\c:\9hhnhn.exec:\9hhnhn.exe112⤵PID:3048
-
\??\c:\hthhhb.exec:\hthhhb.exe113⤵PID:2148
-
\??\c:\dvvdv.exec:\dvvdv.exe114⤵PID:1416
-
\??\c:\jdppv.exec:\jdppv.exe115⤵PID:1984
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe116⤵PID:580
-
\??\c:\nhtntt.exec:\nhtntt.exe117⤵PID:2396
-
\??\c:\hbbbhb.exec:\hbbbhb.exe118⤵PID:1704
-
\??\c:\pjpdd.exec:\pjpdd.exe119⤵PID:2220
-
\??\c:\vppjj.exec:\vppjj.exe120⤵PID:1448
-
\??\c:\xrrlllx.exec:\xrrlllx.exe121⤵PID:2388
-
\??\c:\5xfxfxx.exec:\5xfxfxx.exe122⤵PID:1196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-