Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
5b60838c6380a4c6cc3a503e84ff4ec0N.exe
Resource
win7-20240903-en
General
-
Target
5b60838c6380a4c6cc3a503e84ff4ec0N.exe
-
Size
74KB
-
MD5
5b60838c6380a4c6cc3a503e84ff4ec0
-
SHA1
3f876b2adb4a2911a9e46f1c37367bc90e776b76
-
SHA256
63ba6d3e08dfd15f19d6555ca2b75e86feb817fd16ebf77ff98c611ba91bcb54
-
SHA512
660cfd7cbcaaaeadbc768e2bffb8fac3815ac5b28e6a671bce8aeb3a19d63ef28809e48d29ed20a3c05db0a8efa3e7f3e07027160bb44b9684ea6f13e862f685
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsu:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHk
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1920-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3036 3lfflrx.exe 3024 lllxrxl.exe 888 7pjpd.exe 2816 dvppv.exe 2740 rxxfxxl.exe 2084 hhnnth.exe 1924 vdvjp.exe 2672 fxrxffx.exe 2692 lflxfxr.exe 2504 7bbntt.exe 2792 pdvdp.exe 532 5vppd.exe 1524 rlxlfll.exe 2704 9hbnbh.exe 1016 vpdjp.exe 2308 vdpjj.exe 2212 xxxflrx.exe 2120 fxflllr.exe 580 5thnbb.exe 1592 hthnnt.exe 316 vpdpd.exe 808 lxrrxfl.exe 3000 rffxfff.exe 2564 hhthhn.exe 2196 9tnttt.exe 932 jdvvp.exe 2412 dvppp.exe 2080 5frrxxf.exe 2228 3ttbnb.exe 2516 pjjjp.exe 1872 1jddj.exe 3052 llxxllx.exe 1584 3hnnbh.exe 3036 tnbhtb.exe 3064 dvvdj.exe 3024 jdvdd.exe 2772 pppvv.exe 2768 5fxxxlr.exe 2864 rxfrlxx.exe 2988 3ntbbh.exe 2108 nbhbhb.exe 2780 9ppvd.exe 2632 1frlfxl.exe 2140 rlfxffl.exe 2288 htnhbh.exe 1376 nhbhht.exe 2936 7pvvv.exe 476 7vvjp.exe 792 5rlllrr.exe 2716 htttbh.exe 2900 htbbbh.exe 492 jvpdp.exe 840 jppvv.exe 2308 5fxlrrr.exe 2092 7flrrfx.exe 1504 bnbbbb.exe 1940 ddjpv.exe 1500 pjdjv.exe 1368 rlffrxx.exe 796 tntthb.exe 3008 bhbnhh.exe 3020 dpvjp.exe 612 xxrrlxl.exe 1412 xlxxxfr.exe -
resource yara_rule behavioral1/memory/1920-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3036 1920 5b60838c6380a4c6cc3a503e84ff4ec0N.exe 30 PID 1920 wrote to memory of 3036 1920 5b60838c6380a4c6cc3a503e84ff4ec0N.exe 30 PID 1920 wrote to memory of 3036 1920 5b60838c6380a4c6cc3a503e84ff4ec0N.exe 30 PID 1920 wrote to memory of 3036 1920 5b60838c6380a4c6cc3a503e84ff4ec0N.exe 30 PID 3036 wrote to memory of 3024 3036 3lfflrx.exe 31 PID 3036 wrote to memory of 3024 3036 3lfflrx.exe 31 PID 3036 wrote to memory of 3024 3036 3lfflrx.exe 31 PID 3036 wrote to memory of 3024 3036 3lfflrx.exe 31 PID 3024 wrote to memory of 888 3024 lllxrxl.exe 32 PID 3024 wrote to memory of 888 3024 lllxrxl.exe 32 PID 3024 wrote to memory of 888 3024 lllxrxl.exe 32 PID 3024 wrote to memory of 888 3024 lllxrxl.exe 32 PID 888 wrote to memory of 2816 888 7pjpd.exe 33 PID 888 wrote to memory of 2816 888 7pjpd.exe 33 PID 888 wrote to memory of 2816 888 7pjpd.exe 33 PID 888 wrote to memory of 2816 888 7pjpd.exe 33 PID 2816 wrote to memory of 2740 2816 dvppv.exe 34 PID 2816 wrote to memory of 2740 2816 dvppv.exe 34 PID 2816 wrote to memory of 2740 2816 dvppv.exe 34 PID 2816 wrote to memory of 2740 2816 dvppv.exe 34 PID 2740 wrote to memory of 2084 2740 rxxfxxl.exe 35 PID 2740 wrote to memory of 2084 2740 rxxfxxl.exe 35 PID 2740 wrote to memory of 2084 2740 rxxfxxl.exe 35 PID 2740 wrote to memory of 2084 2740 rxxfxxl.exe 35 PID 2084 wrote to memory of 1924 2084 hhnnth.exe 36 PID 2084 wrote to memory of 1924 2084 hhnnth.exe 36 PID 2084 wrote to memory of 1924 2084 hhnnth.exe 36 PID 2084 wrote to memory of 1924 2084 hhnnth.exe 36 PID 1924 wrote to memory of 2672 1924 vdvjp.exe 37 PID 1924 wrote to memory of 2672 1924 vdvjp.exe 37 PID 1924 wrote to memory of 2672 1924 vdvjp.exe 37 PID 1924 wrote to memory of 2672 1924 vdvjp.exe 37 PID 2672 wrote to memory of 2692 2672 fxrxffx.exe 38 PID 2672 wrote to memory of 2692 2672 fxrxffx.exe 38 PID 2672 wrote to memory of 2692 2672 fxrxffx.exe 38 PID 2672 wrote to memory of 2692 2672 fxrxffx.exe 38 PID 2692 wrote to memory of 2504 2692 lflxfxr.exe 39 PID 2692 wrote to memory of 2504 2692 lflxfxr.exe 39 PID 2692 wrote to memory of 2504 2692 lflxfxr.exe 39 PID 2692 wrote to memory of 2504 2692 lflxfxr.exe 39 PID 2504 wrote to memory of 2792 2504 7bbntt.exe 40 PID 2504 wrote to memory of 2792 2504 7bbntt.exe 40 PID 2504 wrote to memory of 2792 2504 7bbntt.exe 40 PID 2504 wrote to memory of 2792 2504 7bbntt.exe 40 PID 2792 wrote to memory of 532 2792 pdvdp.exe 41 PID 2792 wrote to memory of 532 2792 pdvdp.exe 41 PID 2792 wrote to memory of 532 2792 pdvdp.exe 41 PID 2792 wrote to memory of 532 2792 pdvdp.exe 41 PID 532 wrote to memory of 1524 532 5vppd.exe 42 PID 532 wrote to memory of 1524 532 5vppd.exe 42 PID 532 wrote to memory of 1524 532 5vppd.exe 42 PID 532 wrote to memory of 1524 532 5vppd.exe 42 PID 1524 wrote to memory of 2704 1524 rlxlfll.exe 43 PID 1524 wrote to memory of 2704 1524 rlxlfll.exe 43 PID 1524 wrote to memory of 2704 1524 rlxlfll.exe 43 PID 1524 wrote to memory of 2704 1524 rlxlfll.exe 43 PID 2704 wrote to memory of 1016 2704 9hbnbh.exe 44 PID 2704 wrote to memory of 1016 2704 9hbnbh.exe 44 PID 2704 wrote to memory of 1016 2704 9hbnbh.exe 44 PID 2704 wrote to memory of 1016 2704 9hbnbh.exe 44 PID 1016 wrote to memory of 2308 1016 vpdjp.exe 45 PID 1016 wrote to memory of 2308 1016 vpdjp.exe 45 PID 1016 wrote to memory of 2308 1016 vpdjp.exe 45 PID 1016 wrote to memory of 2308 1016 vpdjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b60838c6380a4c6cc3a503e84ff4ec0N.exe"C:\Users\Admin\AppData\Local\Temp\5b60838c6380a4c6cc3a503e84ff4ec0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\3lfflrx.exec:\3lfflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lllxrxl.exec:\lllxrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\7pjpd.exec:\7pjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\dvppv.exec:\dvppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rxxfxxl.exec:\rxxfxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hhnnth.exec:\hhnnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\vdvjp.exec:\vdvjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\fxrxffx.exec:\fxrxffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lflxfxr.exec:\lflxfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7bbntt.exec:\7bbntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pdvdp.exec:\pdvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\5vppd.exec:\5vppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\rlxlfll.exec:\rlxlfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\9hbnbh.exec:\9hbnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vpdjp.exec:\vpdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\vdpjj.exec:\vdpjj.exe17⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xxxflrx.exec:\xxxflrx.exe18⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fxflllr.exec:\fxflllr.exe19⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5thnbb.exec:\5thnbb.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\hthnnt.exec:\hthnnt.exe21⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vpdpd.exec:\vpdpd.exe22⤵
- Executes dropped EXE
PID:316 -
\??\c:\lxrrxfl.exec:\lxrrxfl.exe23⤵
- Executes dropped EXE
PID:808 -
\??\c:\rffxfff.exec:\rffxfff.exe24⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hhthhn.exec:\hhthhn.exe25⤵
- Executes dropped EXE
PID:2564 -
\??\c:\9tnttt.exec:\9tnttt.exe26⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jdvvp.exec:\jdvvp.exe27⤵
- Executes dropped EXE
PID:932 -
\??\c:\dvppp.exec:\dvppp.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5frrxxf.exec:\5frrxxf.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3ttbnb.exec:\3ttbnb.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjjjp.exec:\pjjjp.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1jddj.exec:\1jddj.exe32⤵
- Executes dropped EXE
PID:1872 -
\??\c:\llxxllx.exec:\llxxllx.exe33⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3hnnbh.exec:\3hnnbh.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tnbhtb.exec:\tnbhtb.exe35⤵
- Executes dropped EXE
PID:3036 -
\??\c:\dvvdj.exec:\dvvdj.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jdvdd.exec:\jdvdd.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pppvv.exec:\pppvv.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5fxxxlr.exec:\5fxxxlr.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rxfrlxx.exec:\rxfrlxx.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3ntbbh.exec:\3ntbbh.exe41⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nbhbhb.exec:\nbhbhb.exe42⤵
- Executes dropped EXE
PID:2108 -
\??\c:\9ppvd.exec:\9ppvd.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1frlfxl.exec:\1frlfxl.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlfxffl.exec:\rlfxffl.exe45⤵
- Executes dropped EXE
PID:2140 -
\??\c:\htnhbh.exec:\htnhbh.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nhbhht.exec:\nhbhht.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\7pvvv.exec:\7pvvv.exe48⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7vvjp.exec:\7vvjp.exe49⤵
- Executes dropped EXE
PID:476 -
\??\c:\5rlllrr.exec:\5rlllrr.exe50⤵
- Executes dropped EXE
PID:792 -
\??\c:\htttbh.exec:\htttbh.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\htbbbh.exec:\htbbbh.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jvpdp.exec:\jvpdp.exe53⤵
- Executes dropped EXE
PID:492 -
\??\c:\jppvv.exec:\jppvv.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\5fxlrrr.exec:\5fxlrrr.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7flrrfx.exec:\7flrrfx.exe56⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bnbbbb.exec:\bnbbbb.exe57⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ddjpv.exec:\ddjpv.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjdjv.exec:\pjdjv.exe59⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlffrxx.exec:\rlffrxx.exe60⤵
- Executes dropped EXE
PID:1368 -
\??\c:\tntthb.exec:\tntthb.exe61⤵
- Executes dropped EXE
PID:796 -
\??\c:\bhbnhh.exec:\bhbnhh.exe62⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dpvjp.exec:\dpvjp.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xxrrlxl.exec:\xxrrlxl.exe64⤵
- Executes dropped EXE
PID:612 -
\??\c:\xlxxxfr.exec:\xlxxxfr.exe65⤵
- Executes dropped EXE
PID:1412 -
\??\c:\nntntb.exec:\nntntb.exe66⤵PID:2232
-
\??\c:\ppvpp.exec:\ppvpp.exe67⤵PID:2400
-
\??\c:\pvjpp.exec:\pvjpp.exe68⤵PID:2488
-
\??\c:\llrflff.exec:\llrflff.exe69⤵PID:2128
-
\??\c:\lrfxrxx.exec:\lrfxrxx.exe70⤵PID:1080
-
\??\c:\7nbhbb.exec:\7nbhbb.exe71⤵PID:2228
-
\??\c:\thbthh.exec:\thbthh.exe72⤵PID:1764
-
\??\c:\jdvdp.exec:\jdvdp.exe73⤵PID:3044
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe74⤵PID:1612
-
\??\c:\fxlrrrf.exec:\fxlrrrf.exe75⤵PID:2012
-
\??\c:\nbntnt.exec:\nbntnt.exe76⤵PID:2240
-
\??\c:\hbbnhh.exec:\hbbnhh.exe77⤵PID:2472
-
\??\c:\dvvdj.exec:\dvvdj.exe78⤵PID:2836
-
\??\c:\1pppv.exec:\1pppv.exe79⤵PID:2888
-
\??\c:\xfxfrfr.exec:\xfxfrfr.exe80⤵PID:2816
-
\??\c:\3tttbh.exec:\3tttbh.exe81⤵PID:2804
-
\??\c:\htnthh.exec:\htnthh.exe82⤵PID:2652
-
\??\c:\jdjdp.exec:\jdjdp.exe83⤵PID:2084
-
\??\c:\9jpvd.exec:\9jpvd.exe84⤵PID:2616
-
\??\c:\xrfflrx.exec:\xrfflrx.exe85⤵PID:2648
-
\??\c:\xxlfrxx.exec:\xxlfrxx.exe86⤵PID:2236
-
\??\c:\7nhnnn.exec:\7nhnnn.exe87⤵PID:344
-
\??\c:\tnnnnn.exec:\tnnnnn.exe88⤵PID:2664
-
\??\c:\dvddj.exec:\dvddj.exe89⤵PID:3048
-
\??\c:\jdpjj.exec:\jdpjj.exe90⤵PID:2932
-
\??\c:\7lllrxl.exec:\7lllrxl.exe91⤵PID:2604
-
\??\c:\7flrxfl.exec:\7flrxfl.exe92⤵PID:2956
-
\??\c:\btnbnb.exec:\btnbnb.exe93⤵PID:1440
-
\??\c:\dpjjj.exec:\dpjjj.exe94⤵PID:768
-
\??\c:\jdvdd.exec:\jdvdd.exe95⤵PID:1828
-
\??\c:\lllxlxf.exec:\lllxlxf.exe96⤵PID:2444
-
\??\c:\rlrrxrf.exec:\rlrrxrf.exe97⤵PID:2096
-
\??\c:\xrllrrx.exec:\xrllrrx.exe98⤵PID:2928
-
\??\c:\bttbnn.exec:\bttbnn.exe99⤵PID:580
-
\??\c:\bnhhhh.exec:\bnhhhh.exe100⤵PID:1324
-
\??\c:\dpjdd.exec:\dpjdd.exe101⤵PID:1840
-
\??\c:\rffxxrx.exec:\rffxxrx.exe102⤵PID:2572
-
\??\c:\xrfrlrl.exec:\xrfrlrl.exe103⤵PID:3012
-
\??\c:\3ffrrff.exec:\3ffrrff.exe104⤵PID:1320
-
\??\c:\hbtbhn.exec:\hbtbhn.exe105⤵PID:1040
-
\??\c:\hbhbhb.exec:\hbhbhb.exe106⤵PID:2104
-
\??\c:\jvppp.exec:\jvppp.exe107⤵PID:1548
-
\??\c:\vpvdj.exec:\vpvdj.exe108⤵PID:1032
-
\??\c:\xlrllfl.exec:\xlrllfl.exe109⤵PID:1196
-
\??\c:\5rxflfl.exec:\5rxflfl.exe110⤵PID:1784
-
\??\c:\hnhbnb.exec:\hnhbnb.exe111⤵PID:308
-
\??\c:\3ntnhh.exec:\3ntnhh.exe112⤵PID:2484
-
\??\c:\pdjpp.exec:\pdjpp.exe113⤵PID:1204
-
\??\c:\dpdjd.exec:\dpdjd.exe114⤵PID:1604
-
\??\c:\5dpjj.exec:\5dpjj.exe115⤵PID:2328
-
\??\c:\3lxflxl.exec:\3lxflxl.exe116⤵PID:1584
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe117⤵PID:2980
-
\??\c:\tttbtb.exec:\tttbtb.exe118⤵PID:2800
-
\??\c:\3nnbbb.exec:\3nnbbb.exe119⤵PID:2844
-
\??\c:\ddvvp.exec:\ddvvp.exe120⤵PID:2772
-
\??\c:\pjdjj.exec:\pjdjj.exe121⤵PID:2868
-
\??\c:\xrflrlf.exec:\xrflrlf.exe122⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-