Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 14:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fef84f1303aebad11cfcadb00d040540N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
fef84f1303aebad11cfcadb00d040540N.exe
-
Size
316KB
-
MD5
fef84f1303aebad11cfcadb00d040540
-
SHA1
3e5da9fe11dc42bb8e23a8af090f75550dffcb45
-
SHA256
3ffbaef5883013b0235655a7bbb5f430bb72c7485da620e7768b67f238f17c5a
-
SHA512
cfb334a1e6ce1a77d2743b12e587a6e7fbe867f53f863e621bd6c21a664b6e079e1c611a70720324ea6d1dcfad118a857208133ed77119e450628fbe49ef9e55
-
SSDEEP
6144:n3C9BRo/AIX2h97aUzpbBj3+b2ziJC39QS8hDJd+Q7ZLbjwm8:n3C9uDC97aUFbZ42ziM39QS8hDJd+Q74
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1692-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/440-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1708 9pvvj.exe 2540 3hbbhn.exe 2968 dvpdj.exe 2764 7xrlrxf.exe 2988 7nnttb.exe 2980 ffrxflr.exe 2804 9lfflxf.exe 2068 vvjpv.exe 1416 jdpvd.exe 2884 tnnbhh.exe 1792 bbtbtb.exe 2152 ffxxlxl.exe 1132 xxrfllr.exe 2912 tnhnbb.exe 2432 xrlxlxl.exe 1964 bbhntt.exe 2124 bttbnn.exe 1544 dddjv.exe 2560 5ffflrx.exe 1436 nhbbhb.exe 440 pdvdd.exe 2268 lxflxlf.exe 1528 tbthbb.exe 1788 dvjpp.exe 324 llrxlll.exe 2072 hhhtnh.exe 784 dvppj.exe 1632 rlxxllr.exe 1740 nnnthn.exe 1836 vvjdj.exe 536 pjvdv.exe 2408 nhthtt.exe 1588 jdddj.exe 1676 pjvdj.exe 2808 xrllxxf.exe 2892 nbbbbb.exe 2816 3btthn.exe 2832 vjjjj.exe 2708 1xrflrf.exe 2756 rlfflfr.exe 2608 nnnbtb.exe 2612 vjdjp.exe 2656 5vpjp.exe 1172 fxllxxx.exe 1656 llflflx.exe 2716 hbnnbb.exe 1800 pjppd.exe 1668 5jddj.exe 2916 ffxxffx.exe 2928 rlfffrx.exe 820 5hnthb.exe 2200 dvjdp.exe 2016 9vjjp.exe 2124 rlrrfff.exe 2172 lfxfrxl.exe 1856 bthnbb.exe 404 jjvdp.exe 1180 ppdjv.exe 844 llflxlr.exe 956 xfllrrf.exe 2568 ntnhtt.exe 2212 7nhntb.exe 2444 dvpvd.exe 1504 dpjdp.exe -
resource yara_rule behavioral1/memory/1692-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1132-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/440-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1708 1692 fef84f1303aebad11cfcadb00d040540N.exe 30 PID 1692 wrote to memory of 1708 1692 fef84f1303aebad11cfcadb00d040540N.exe 30 PID 1692 wrote to memory of 1708 1692 fef84f1303aebad11cfcadb00d040540N.exe 30 PID 1692 wrote to memory of 1708 1692 fef84f1303aebad11cfcadb00d040540N.exe 30 PID 1708 wrote to memory of 2540 1708 9pvvj.exe 31 PID 1708 wrote to memory of 2540 1708 9pvvj.exe 31 PID 1708 wrote to memory of 2540 1708 9pvvj.exe 31 PID 1708 wrote to memory of 2540 1708 9pvvj.exe 31 PID 2540 wrote to memory of 2968 2540 3hbbhn.exe 32 PID 2540 wrote to memory of 2968 2540 3hbbhn.exe 32 PID 2540 wrote to memory of 2968 2540 3hbbhn.exe 32 PID 2540 wrote to memory of 2968 2540 3hbbhn.exe 32 PID 2968 wrote to memory of 2764 2968 dvpdj.exe 33 PID 2968 wrote to memory of 2764 2968 dvpdj.exe 33 PID 2968 wrote to memory of 2764 2968 dvpdj.exe 33 PID 2968 wrote to memory of 2764 2968 dvpdj.exe 33 PID 2764 wrote to memory of 2988 2764 7xrlrxf.exe 34 PID 2764 wrote to memory of 2988 2764 7xrlrxf.exe 34 PID 2764 wrote to memory of 2988 2764 7xrlrxf.exe 34 PID 2764 wrote to memory of 2988 2764 7xrlrxf.exe 34 PID 2988 wrote to memory of 2980 2988 7nnttb.exe 35 PID 2988 wrote to memory of 2980 2988 7nnttb.exe 35 PID 2988 wrote to memory of 2980 2988 7nnttb.exe 35 PID 2988 wrote to memory of 2980 2988 7nnttb.exe 35 PID 2980 wrote to memory of 2804 2980 ffrxflr.exe 36 PID 2980 wrote to memory of 2804 2980 ffrxflr.exe 36 PID 2980 wrote to memory of 2804 2980 ffrxflr.exe 36 PID 2980 wrote to memory of 2804 2980 ffrxflr.exe 36 PID 2804 wrote to memory of 2068 2804 9lfflxf.exe 37 PID 2804 wrote to memory of 2068 2804 9lfflxf.exe 37 PID 2804 wrote to memory of 2068 2804 9lfflxf.exe 37 PID 2804 wrote to memory of 2068 2804 9lfflxf.exe 37 PID 2068 wrote to memory of 1416 2068 vvjpv.exe 38 PID 2068 wrote to memory of 1416 2068 vvjpv.exe 38 PID 2068 wrote to memory of 1416 2068 vvjpv.exe 38 PID 2068 wrote to memory of 1416 2068 vvjpv.exe 38 PID 1416 wrote to memory of 2884 1416 jdpvd.exe 39 PID 1416 wrote to memory of 2884 1416 jdpvd.exe 39 PID 1416 wrote to memory of 2884 1416 jdpvd.exe 39 PID 1416 wrote to memory of 2884 1416 jdpvd.exe 39 PID 2884 wrote to memory of 1792 2884 tnnbhh.exe 40 PID 2884 wrote to memory of 1792 2884 tnnbhh.exe 40 PID 2884 wrote to memory of 1792 2884 tnnbhh.exe 40 PID 2884 wrote to memory of 1792 2884 tnnbhh.exe 40 PID 1792 wrote to memory of 2152 1792 bbtbtb.exe 41 PID 1792 wrote to memory of 2152 1792 bbtbtb.exe 41 PID 1792 wrote to memory of 2152 1792 bbtbtb.exe 41 PID 1792 wrote to memory of 2152 1792 bbtbtb.exe 41 PID 2152 wrote to memory of 1132 2152 ffxxlxl.exe 42 PID 2152 wrote to memory of 1132 2152 ffxxlxl.exe 42 PID 2152 wrote to memory of 1132 2152 ffxxlxl.exe 42 PID 2152 wrote to memory of 1132 2152 ffxxlxl.exe 42 PID 1132 wrote to memory of 2912 1132 xxrfllr.exe 43 PID 1132 wrote to memory of 2912 1132 xxrfllr.exe 43 PID 1132 wrote to memory of 2912 1132 xxrfllr.exe 43 PID 1132 wrote to memory of 2912 1132 xxrfllr.exe 43 PID 2912 wrote to memory of 2432 2912 tnhnbb.exe 44 PID 2912 wrote to memory of 2432 2912 tnhnbb.exe 44 PID 2912 wrote to memory of 2432 2912 tnhnbb.exe 44 PID 2912 wrote to memory of 2432 2912 tnhnbb.exe 44 PID 2432 wrote to memory of 1964 2432 xrlxlxl.exe 45 PID 2432 wrote to memory of 1964 2432 xrlxlxl.exe 45 PID 2432 wrote to memory of 1964 2432 xrlxlxl.exe 45 PID 2432 wrote to memory of 1964 2432 xrlxlxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fef84f1303aebad11cfcadb00d040540N.exe"C:\Users\Admin\AppData\Local\Temp\fef84f1303aebad11cfcadb00d040540N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\9pvvj.exec:\9pvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\3hbbhn.exec:\3hbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dvpdj.exec:\dvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\7xrlrxf.exec:\7xrlrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\7nnttb.exec:\7nnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\ffrxflr.exec:\ffrxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\9lfflxf.exec:\9lfflxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vvjpv.exec:\vvjpv.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jdpvd.exec:\jdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\tnnbhh.exec:\tnnbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\bbtbtb.exec:\bbtbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\ffxxlxl.exec:\ffxxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\xxrfllr.exec:\xxrfllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\tnhnbb.exec:\tnhnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xrlxlxl.exec:\xrlxlxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\bbhntt.exec:\bbhntt.exe17⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bttbnn.exec:\bttbnn.exe18⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dddjv.exec:\dddjv.exe19⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5ffflrx.exec:\5ffflrx.exe20⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nhbbhb.exec:\nhbbhb.exe21⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pdvdd.exec:\pdvdd.exe22⤵
- Executes dropped EXE
PID:440 -
\??\c:\lxflxlf.exec:\lxflxlf.exe23⤵
- Executes dropped EXE
PID:2268 -
\??\c:\tbthbb.exec:\tbthbb.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dvjpp.exec:\dvjpp.exe25⤵
- Executes dropped EXE
PID:1788 -
\??\c:\llrxlll.exec:\llrxlll.exe26⤵
- Executes dropped EXE
PID:324 -
\??\c:\hhhtnh.exec:\hhhtnh.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dvppj.exec:\dvppj.exe28⤵
- Executes dropped EXE
PID:784 -
\??\c:\rlxxllr.exec:\rlxxllr.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nnnthn.exec:\nnnthn.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vvjdj.exec:\vvjdj.exe31⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pjvdv.exec:\pjvdv.exe32⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhthtt.exec:\nhthtt.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jdddj.exec:\jdddj.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pjvdj.exec:\pjvdj.exe35⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xrllxxf.exec:\xrllxxf.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nbbbbb.exec:\nbbbbb.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3btthn.exec:\3btthn.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjjjj.exec:\vjjjj.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1xrflrf.exec:\1xrflrf.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlfflfr.exec:\rlfflfr.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nnnbtb.exec:\nnnbtb.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vjdjp.exec:\vjdjp.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5vpjp.exec:\5vpjp.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fxllxxx.exec:\fxllxxx.exe45⤵
- Executes dropped EXE
PID:1172 -
\??\c:\llflflx.exec:\llflflx.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hbnnbb.exec:\hbnnbb.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pjppd.exec:\pjppd.exe48⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5jddj.exec:\5jddj.exe49⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ffxxffx.exec:\ffxxffx.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlfffrx.exec:\rlfffrx.exe51⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5hnthb.exec:\5hnthb.exe52⤵
- Executes dropped EXE
PID:820 -
\??\c:\dvjdp.exec:\dvjdp.exe53⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9vjjp.exec:\9vjjp.exe54⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlrrfff.exec:\rlrrfff.exe55⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe56⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bthnbb.exec:\bthnbb.exe57⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jjvdp.exec:\jjvdp.exe58⤵
- Executes dropped EXE
PID:404 -
\??\c:\ppdjv.exec:\ppdjv.exe59⤵
- Executes dropped EXE
PID:1180 -
\??\c:\llflxlr.exec:\llflxlr.exe60⤵
- Executes dropped EXE
PID:844 -
\??\c:\xfllrrf.exec:\xfllrrf.exe61⤵
- Executes dropped EXE
PID:956 -
\??\c:\ntnhtt.exec:\ntnhtt.exe62⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7nhntb.exec:\7nhntb.exe63⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvpvd.exec:\dvpvd.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dpjdp.exec:\dpjdp.exe65⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rlrxffl.exec:\rlrxffl.exe66⤵PID:2908
-
\??\c:\hnnhbt.exec:\hnnhbt.exe67⤵PID:2184
-
\??\c:\5bntbn.exec:\5bntbn.exe68⤵PID:1736
-
\??\c:\1ddjv.exec:\1ddjv.exe69⤵PID:2348
-
\??\c:\pjdjp.exec:\pjdjp.exe70⤵PID:2524
-
\??\c:\1rfxffr.exec:\1rfxffr.exe71⤵PID:1620
-
\??\c:\frffrrx.exec:\frffrrx.exe72⤵PID:1924
-
\??\c:\btnthh.exec:\btnthh.exe73⤵PID:1712
-
\??\c:\bbnthn.exec:\bbnthn.exe74⤵PID:2244
-
\??\c:\vvpvd.exec:\vvpvd.exe75⤵PID:1244
-
\??\c:\fxffxlx.exec:\fxffxlx.exe76⤵PID:2764
-
\??\c:\llfllfl.exec:\llfllfl.exe77⤵PID:2888
-
\??\c:\3btbnt.exec:\3btbnt.exe78⤵PID:1220
-
\??\c:\9pppd.exec:\9pppd.exe79⤵PID:2896
-
\??\c:\vjvpv.exec:\vjvpv.exe80⤵PID:1900
-
\??\c:\7rfxxfr.exec:\7rfxxfr.exe81⤵PID:2616
-
\??\c:\7flfllr.exec:\7flfllr.exe82⤵PID:2320
-
\??\c:\1thtnt.exec:\1thtnt.exe83⤵PID:3056
-
\??\c:\nhnntb.exec:\nhnntb.exe84⤵PID:2688
-
\??\c:\1pjjv.exec:\1pjjv.exe85⤵PID:1140
-
\??\c:\xfflxff.exec:\xfflxff.exe86⤵PID:2132
-
\??\c:\lfffxxl.exec:\lfffxxl.exe87⤵PID:2720
-
\??\c:\9btbnb.exec:\9btbnb.exe88⤵PID:2044
-
\??\c:\bbtthh.exec:\bbtthh.exe89⤵PID:2924
-
\??\c:\vpjvj.exec:\vpjvj.exe90⤵PID:2452
-
\??\c:\5xlfllf.exec:\5xlfllf.exe91⤵PID:1716
-
\??\c:\bbhhth.exec:\bbhhth.exe92⤵PID:1044
-
\??\c:\nnntbb.exec:\nnntbb.exe93⤵PID:2280
-
\??\c:\7jvjd.exec:\7jvjd.exe94⤵PID:2284
-
\??\c:\1dppp.exec:\1dppp.exe95⤵PID:1412
-
\??\c:\lfxlfrx.exec:\lfxlfrx.exe96⤵PID:2560
-
\??\c:\hbthhb.exec:\hbthhb.exe97⤵PID:588
-
\??\c:\5btthh.exec:\5btthh.exe98⤵PID:2276
-
\??\c:\pdpjp.exec:\pdpjp.exe99⤵PID:816
-
\??\c:\3pjjp.exec:\3pjjp.exe100⤵PID:1328
-
\??\c:\rllfffl.exec:\rllfffl.exe101⤵PID:1528
-
\??\c:\5flrxxx.exec:\5flrxxx.exe102⤵PID:1828
-
\??\c:\nhbhtb.exec:\nhbhtb.exe103⤵PID:1420
-
\??\c:\vvjvd.exec:\vvjvd.exe104⤵PID:2424
-
\??\c:\dvvvj.exec:\dvvvj.exe105⤵PID:2508
-
\??\c:\1lrlrrf.exec:\1lrlrrf.exe106⤵PID:2328
-
\??\c:\xrllxxl.exec:\xrllxxl.exe107⤵PID:688
-
\??\c:\hbtbnn.exec:\hbtbnn.exe108⤵PID:2976
-
\??\c:\bthntb.exec:\bthntb.exe109⤵PID:2256
-
\??\c:\dddjj.exec:\dddjj.exe110⤵PID:1708
-
\??\c:\3llrflx.exec:\3llrflx.exe111⤵PID:1940
-
\??\c:\rrllfrx.exec:\rrllfrx.exe112⤵PID:2544
-
\??\c:\9httnb.exec:\9httnb.exe113⤵PID:2552
-
\??\c:\bthhbh.exec:\bthhbh.exe114⤵PID:2520
-
\??\c:\dvjpv.exec:\dvjpv.exe115⤵PID:2808
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe116⤵PID:2860
-
\??\c:\fxffxfl.exec:\fxffxfl.exe117⤵PID:2880
-
\??\c:\tnbnnt.exec:\tnbnnt.exe118⤵PID:2836
-
\??\c:\1bhtbb.exec:\1bhtbb.exe119⤵PID:2936
-
\??\c:\pdvpv.exec:\pdvpv.exe120⤵PID:2792
-
\??\c:\frffrxf.exec:\frffrxf.exe121⤵PID:2624
-
\??\c:\llfllrx.exec:\llfllrx.exe122⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-