Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 00:15
Static task
static1
Behavioral task
behavioral1
Sample
9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe
Resource
win7-20240903-en
General
-
Target
9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe
-
Size
64KB
-
MD5
9a668fa652ac1a713627c30cd3138ee8
-
SHA1
b523013488088104ad80804151f2257279ea20f3
-
SHA256
9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88
-
SHA512
554bcab275a338d5d4d4d1c541a95ca2457c4ceaca4ee38e26d6d1966674d09c0b9e6d9ad1b8f2baec472faca69253be4ad94792dc3ccc2c48fa5c9f90d88230
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1N:ymb3NkkiQ3mdBjFI9cz
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2960-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-1413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2196 dvpvv.exe 2996 dpdvd.exe 2480 lxlflrf.exe 540 hhnnnt.exe 3060 dvvvd.exe 2808 3dppv.exe 2716 xrfrxxf.exe 2616 jjdjv.exe 2752 ffrrrxx.exe 2596 llfllxf.exe 3040 hthnbh.exe 1636 pjppd.exe 1684 vvppv.exe 2008 fxrfxxl.exe 1856 3ntntb.exe 2396 djppv.exe 1664 ddvpj.exe 1168 ffxlxxf.exe 1760 thnhbn.exe 1212 hhnbbh.exe 2892 vpjjp.exe 2856 ffxlflx.exe 1316 xllxfrr.exe 1508 7nhnnb.exe 944 5dpjp.exe 1436 jdddp.exe 772 7xlrrxl.exe 2304 bnbnth.exe 1864 9nhhtb.exe 864 vvdvv.exe 2256 ffxflrf.exe 2260 tbhtnb.exe 1588 1ttnnn.exe 2180 pppvd.exe 3064 rflxxrl.exe 1128 xxffrfr.exe 2964 lfrxflr.exe 2804 5bnbbn.exe 2924 btnhth.exe 2160 jvpdj.exe 2884 lrxllxr.exe 2872 llffxrx.exe 2584 nhhhbb.exe 2704 3bbbhn.exe 2596 dvjpv.exe 2248 ffffffl.exe 612 rlrfrxl.exe 1472 hbnnbb.exe 1684 ttbbbn.exe 1560 7jppv.exe 1792 1vvjv.exe 2396 nhbhnt.exe 464 vvvdv.exe 1664 dvjdp.exe 1320 lfxrfxl.exe 544 hbnbnn.exe 2904 hhbntb.exe 2668 ppdpd.exe 1816 vpjvd.exe 660 rlrxffx.exe 2108 flrffxx.exe 1508 1tbbnt.exe 944 9tntbh.exe 2104 pjppp.exe -
resource yara_rule behavioral1/memory/2960-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-1413-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2196 2960 9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe 30 PID 2960 wrote to memory of 2196 2960 9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe 30 PID 2960 wrote to memory of 2196 2960 9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe 30 PID 2960 wrote to memory of 2196 2960 9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe 30 PID 2196 wrote to memory of 2996 2196 dvpvv.exe 31 PID 2196 wrote to memory of 2996 2196 dvpvv.exe 31 PID 2196 wrote to memory of 2996 2196 dvpvv.exe 31 PID 2196 wrote to memory of 2996 2196 dvpvv.exe 31 PID 2996 wrote to memory of 2480 2996 dpdvd.exe 32 PID 2996 wrote to memory of 2480 2996 dpdvd.exe 32 PID 2996 wrote to memory of 2480 2996 dpdvd.exe 32 PID 2996 wrote to memory of 2480 2996 dpdvd.exe 32 PID 2480 wrote to memory of 540 2480 lxlflrf.exe 33 PID 2480 wrote to memory of 540 2480 lxlflrf.exe 33 PID 2480 wrote to memory of 540 2480 lxlflrf.exe 33 PID 2480 wrote to memory of 540 2480 lxlflrf.exe 33 PID 540 wrote to memory of 3060 540 hhnnnt.exe 34 PID 540 wrote to memory of 3060 540 hhnnnt.exe 34 PID 540 wrote to memory of 3060 540 hhnnnt.exe 34 PID 540 wrote to memory of 3060 540 hhnnnt.exe 34 PID 3060 wrote to memory of 2808 3060 dvvvd.exe 35 PID 3060 wrote to memory of 2808 3060 dvvvd.exe 35 PID 3060 wrote to memory of 2808 3060 dvvvd.exe 35 PID 3060 wrote to memory of 2808 3060 dvvvd.exe 35 PID 2808 wrote to memory of 2716 2808 3dppv.exe 36 PID 2808 wrote to memory of 2716 2808 3dppv.exe 36 PID 2808 wrote to memory of 2716 2808 3dppv.exe 36 PID 2808 wrote to memory of 2716 2808 3dppv.exe 36 PID 2716 wrote to memory of 2616 2716 xrfrxxf.exe 37 PID 2716 wrote to memory of 2616 2716 xrfrxxf.exe 37 PID 2716 wrote to memory of 2616 2716 xrfrxxf.exe 37 PID 2716 wrote to memory of 2616 2716 xrfrxxf.exe 37 PID 2616 wrote to memory of 2752 2616 jjdjv.exe 38 PID 2616 wrote to memory of 2752 2616 jjdjv.exe 38 PID 2616 wrote to memory of 2752 2616 jjdjv.exe 38 PID 2616 wrote to memory of 2752 2616 jjdjv.exe 38 PID 2752 wrote to memory of 2596 2752 ffrrrxx.exe 39 PID 2752 wrote to memory of 2596 2752 ffrrrxx.exe 39 PID 2752 wrote to memory of 2596 2752 ffrrrxx.exe 39 PID 2752 wrote to memory of 2596 2752 ffrrrxx.exe 39 PID 2596 wrote to memory of 3040 2596 llfllxf.exe 40 PID 2596 wrote to memory of 3040 2596 llfllxf.exe 40 PID 2596 wrote to memory of 3040 2596 llfllxf.exe 40 PID 2596 wrote to memory of 3040 2596 llfllxf.exe 40 PID 3040 wrote to memory of 1636 3040 hthnbh.exe 41 PID 3040 wrote to memory of 1636 3040 hthnbh.exe 41 PID 3040 wrote to memory of 1636 3040 hthnbh.exe 41 PID 3040 wrote to memory of 1636 3040 hthnbh.exe 41 PID 1636 wrote to memory of 1684 1636 pjppd.exe 42 PID 1636 wrote to memory of 1684 1636 pjppd.exe 42 PID 1636 wrote to memory of 1684 1636 pjppd.exe 42 PID 1636 wrote to memory of 1684 1636 pjppd.exe 42 PID 1684 wrote to memory of 2008 1684 vvppv.exe 43 PID 1684 wrote to memory of 2008 1684 vvppv.exe 43 PID 1684 wrote to memory of 2008 1684 vvppv.exe 43 PID 1684 wrote to memory of 2008 1684 vvppv.exe 43 PID 2008 wrote to memory of 1856 2008 fxrfxxl.exe 44 PID 2008 wrote to memory of 1856 2008 fxrfxxl.exe 44 PID 2008 wrote to memory of 1856 2008 fxrfxxl.exe 44 PID 2008 wrote to memory of 1856 2008 fxrfxxl.exe 44 PID 1856 wrote to memory of 2396 1856 3ntntb.exe 45 PID 1856 wrote to memory of 2396 1856 3ntntb.exe 45 PID 1856 wrote to memory of 2396 1856 3ntntb.exe 45 PID 1856 wrote to memory of 2396 1856 3ntntb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe"C:\Users\Admin\AppData\Local\Temp\9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\dvpvv.exec:\dvpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\dpdvd.exec:\dpdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lxlflrf.exec:\lxlflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\hhnnnt.exec:\hhnnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\dvvvd.exec:\dvvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\3dppv.exec:\3dppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jjdjv.exec:\jjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\llfllxf.exec:\llfllxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hthnbh.exec:\hthnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pjppd.exec:\pjppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\vvppv.exec:\vvppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\fxrfxxl.exec:\fxrfxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\3ntntb.exec:\3ntntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\djppv.exec:\djppv.exe17⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ddvpj.exec:\ddvpj.exe18⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ffxlxxf.exec:\ffxlxxf.exe19⤵
- Executes dropped EXE
PID:1168 -
\??\c:\thnhbn.exec:\thnhbn.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hhnbbh.exec:\hhnbbh.exe21⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vpjjp.exec:\vpjjp.exe22⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ffxlflx.exec:\ffxlflx.exe23⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xllxfrr.exec:\xllxfrr.exe24⤵
- Executes dropped EXE
PID:1316 -
\??\c:\7nhnnb.exec:\7nhnnb.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5dpjp.exec:\5dpjp.exe26⤵
- Executes dropped EXE
PID:944 -
\??\c:\jdddp.exec:\jdddp.exe27⤵
- Executes dropped EXE
PID:1436 -
\??\c:\7xlrrxl.exec:\7xlrrxl.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\bnbnth.exec:\bnbnth.exe29⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9nhhtb.exec:\9nhhtb.exe30⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vvdvv.exec:\vvdvv.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\ffxflrf.exec:\ffxflrf.exe32⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tbhtnb.exec:\tbhtnb.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1ttnnn.exec:\1ttnnn.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pppvd.exec:\pppvd.exe35⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rflxxrl.exec:\rflxxrl.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xxffrfr.exec:\xxffrfr.exe37⤵
- Executes dropped EXE
PID:1128 -
\??\c:\lfrxflr.exec:\lfrxflr.exe38⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5bnbbn.exec:\5bnbbn.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\btnhth.exec:\btnhth.exe40⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvpdj.exec:\jvpdj.exe41⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lrxllxr.exec:\lrxllxr.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\llffxrx.exec:\llffxrx.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhhhbb.exec:\nhhhbb.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3bbbhn.exec:\3bbbhn.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dvjpv.exec:\dvjpv.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ffffffl.exec:\ffffffl.exe47⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe48⤵
- Executes dropped EXE
PID:612 -
\??\c:\hbnnbb.exec:\hbnnbb.exe49⤵
- Executes dropped EXE
PID:1472 -
\??\c:\ttbbbn.exec:\ttbbbn.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7jppv.exec:\7jppv.exe51⤵
- Executes dropped EXE
PID:1560 -
\??\c:\1vvjv.exec:\1vvjv.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nhbhnt.exec:\nhbhnt.exe53⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvvdv.exec:\vvvdv.exe54⤵
- Executes dropped EXE
PID:464 -
\??\c:\dvjdp.exec:\dvjdp.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe56⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hbnbnn.exec:\hbnbnn.exe57⤵
- Executes dropped EXE
PID:544 -
\??\c:\hhbntb.exec:\hhbntb.exe58⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ppdpd.exec:\ppdpd.exe59⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vpjvd.exec:\vpjvd.exe60⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rlrxffx.exec:\rlrxffx.exe61⤵
- Executes dropped EXE
PID:660 -
\??\c:\flrffxx.exec:\flrffxx.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1tbbnt.exec:\1tbbnt.exe63⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9tntbh.exec:\9tntbh.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\pjppp.exec:\pjppp.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vvpvj.exec:\vvpvj.exe66⤵PID:284
-
\??\c:\3rfxlrf.exec:\3rfxlrf.exe67⤵PID:772
-
\??\c:\xffxfrr.exec:\xffxfrr.exe68⤵PID:2304
-
\??\c:\nnbhhh.exec:\nnbhhh.exe69⤵PID:880
-
\??\c:\1nhtnh.exec:\1nhtnh.exe70⤵PID:2916
-
\??\c:\pjjpj.exec:\pjjpj.exe71⤵PID:2132
-
\??\c:\fflfrrx.exec:\fflfrrx.exe72⤵PID:2256
-
\??\c:\xflfrxr.exec:\xflfrxr.exe73⤵PID:2260
-
\??\c:\tnbbbb.exec:\tnbbbb.exe74⤵PID:1700
-
\??\c:\bhthbb.exec:\bhthbb.exe75⤵PID:3068
-
\??\c:\vpdjj.exec:\vpdjj.exe76⤵PID:764
-
\??\c:\vdjpj.exec:\vdjpj.exe77⤵PID:540
-
\??\c:\lflllrr.exec:\lflllrr.exe78⤵PID:2296
-
\??\c:\rfxfllr.exec:\rfxfllr.exe79⤵PID:2740
-
\??\c:\5nnbnn.exec:\5nnbnn.exe80⤵PID:2588
-
\??\c:\1hnntn.exec:\1hnntn.exe81⤵PID:2684
-
\??\c:\dvdjj.exec:\dvdjj.exe82⤵PID:2748
-
\??\c:\pjddj.exec:\pjddj.exe83⤵PID:2328
-
\??\c:\3rlflxf.exec:\3rlflxf.exe84⤵PID:2652
-
\??\c:\tnbhtt.exec:\tnbhtt.exe85⤵PID:2600
-
\??\c:\3bhntt.exec:\3bhntt.exe86⤵PID:828
-
\??\c:\ddvvv.exec:\ddvvv.exe87⤵PID:1944
-
\??\c:\dvjdv.exec:\dvjdv.exe88⤵PID:2324
-
\??\c:\frllxfx.exec:\frllxfx.exe89⤵PID:1656
-
\??\c:\5hthnb.exec:\5hthnb.exe90⤵PID:1692
-
\??\c:\nbnnbb.exec:\nbnnbb.exe91⤵PID:1668
-
\??\c:\dvjdp.exec:\dvjdp.exe92⤵PID:2404
-
\??\c:\7dppp.exec:\7dppp.exe93⤵PID:1060
-
\??\c:\fxrflrf.exec:\fxrflrf.exe94⤵PID:1072
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe95⤵PID:1772
-
\??\c:\hbttbh.exec:\hbttbh.exe96⤵PID:348
-
\??\c:\btnhnt.exec:\btnhnt.exe97⤵PID:1212
-
\??\c:\vjpdv.exec:\vjpdv.exe98⤵PID:2888
-
\??\c:\dpddv.exec:\dpddv.exe99⤵PID:1288
-
\??\c:\fxlflrx.exec:\fxlflrx.exe100⤵PID:1240
-
\??\c:\xrfxxfl.exec:\xrfxxfl.exe101⤵PID:2900
-
\??\c:\hthntn.exec:\hthntn.exe102⤵PID:1292
-
\??\c:\bthhbh.exec:\bthhbh.exe103⤵PID:1228
-
\??\c:\1vjpd.exec:\1vjpd.exe104⤵PID:2504
-
\??\c:\dpjpd.exec:\dpjpd.exe105⤵PID:1724
-
\??\c:\flfflrf.exec:\flfflrf.exe106⤵PID:2544
-
\??\c:\1rxrffr.exec:\1rxrffr.exe107⤵PID:684
-
\??\c:\5hbnbb.exec:\5hbnbb.exe108⤵PID:1532
-
\??\c:\tnhttb.exec:\tnhttb.exe109⤵PID:2032
-
\??\c:\dddvd.exec:\dddvd.exe110⤵PID:2268
-
\??\c:\jjvjv.exec:\jjvjv.exe111⤵PID:2412
-
\??\c:\lffflrx.exec:\lffflrx.exe112⤵PID:2984
-
\??\c:\7tthtb.exec:\7tthtb.exe113⤵PID:2176
-
\??\c:\3hnhtb.exec:\3hnhtb.exe114⤵PID:2912
-
\??\c:\3bthht.exec:\3bthht.exe115⤵PID:3020
-
\??\c:\jjpjv.exec:\jjpjv.exe116⤵PID:3028
-
\??\c:\vvppd.exec:\vvppd.exe117⤵PID:2672
-
\??\c:\rrlrrrf.exec:\rrlrrrf.exe118⤵PID:2780
-
\??\c:\1xrlrfl.exec:\1xrlrfl.exe119⤵PID:2252
-
\??\c:\3nhthh.exec:\3nhthh.exe120⤵PID:2828
-
\??\c:\hhbnnn.exec:\hhbnnn.exe121⤵PID:2772
-
\??\c:\pjvjp.exec:\pjvjp.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-