Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe
Resource
win7-20240903-en
General
-
Target
790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe
-
Size
58KB
-
MD5
4d01de6bdf1632cb941a3f7519def474
-
SHA1
e300f449a7e02f34b8309f3cf94e948d3d1d345e
-
SHA256
790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83
-
SHA512
12076f90cde5214ea8948f2d8dd11ef51aa0a68e3dd46578ce74db18ee4ebe4ee68ea988a4ff5a2525785c3b5712539ac9586c16a42f479c81f3903ef41b41ae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgTdCo:ymb3NkkiQ3mdBjFIg0o
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2148-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2848 thhbhb.exe 2300 nhtbnh.exe 2856 dvvvv.exe 2584 lxxxfxx.exe 2732 fxxxlff.exe 3044 bthbtn.exe 2564 dpvdp.exe 2068 7xlflxf.exe 628 frlllrx.exe 2776 hbhnht.exe 828 7vjdd.exe 988 3djdd.exe 2736 rxrrlfl.exe 2944 fxrrxfr.exe 380 nbhbtn.exe 2016 3bttbt.exe 2544 5vjvv.exe 2128 rlrrrrx.exe 2392 1flflfr.exe 2452 3hbbhn.exe 2080 ttnbnn.exe 1356 pjdjp.exe 1656 jvddv.exe 2408 5lrlllx.exe 1532 bnbttt.exe 1504 tbnthb.exe 2488 xflxxfl.exe 764 ffrrrxf.exe 1324 hntnnh.exe 2184 bbhhnn.exe 2864 dpjjj.exe 2652 vjddv.exe 2568 5xfxfff.exe 2920 9lxxfxl.exe 2696 nhtbbb.exe 2556 7nbthb.exe 2608 vjjjj.exe 2732 dvdvd.exe 2612 9jvdd.exe 3040 rflfllf.exe 2376 5rfrrlr.exe 2068 nbhhnb.exe 2108 btbtbt.exe 1488 7vppv.exe 1052 vjppp.exe 2548 dppjj.exe 988 lffffff.exe 1576 frxxfff.exe 2940 nbnnht.exe 2944 bnbttt.exe 2440 vjjdj.exe 2988 ppppp.exe 2156 lxllrrx.exe 2420 xlxxxrx.exe 1868 tnbbnt.exe 1616 tnhntt.exe 1048 vvpvp.exe 948 dvjpd.exe 1388 pjdpd.exe 896 fxxrrrx.exe 1536 lxxxlll.exe 1788 llrlxfr.exe 1532 bnbbnn.exe 3012 hthnbb.exe -
resource yara_rule behavioral1/memory/2148-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-260-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2848 2148 790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe 31 PID 2148 wrote to memory of 2848 2148 790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe 31 PID 2148 wrote to memory of 2848 2148 790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe 31 PID 2148 wrote to memory of 2848 2148 790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe 31 PID 2848 wrote to memory of 2300 2848 thhbhb.exe 32 PID 2848 wrote to memory of 2300 2848 thhbhb.exe 32 PID 2848 wrote to memory of 2300 2848 thhbhb.exe 32 PID 2848 wrote to memory of 2300 2848 thhbhb.exe 32 PID 2300 wrote to memory of 2856 2300 nhtbnh.exe 33 PID 2300 wrote to memory of 2856 2300 nhtbnh.exe 33 PID 2300 wrote to memory of 2856 2300 nhtbnh.exe 33 PID 2300 wrote to memory of 2856 2300 nhtbnh.exe 33 PID 2856 wrote to memory of 2584 2856 dvvvv.exe 34 PID 2856 wrote to memory of 2584 2856 dvvvv.exe 34 PID 2856 wrote to memory of 2584 2856 dvvvv.exe 34 PID 2856 wrote to memory of 2584 2856 dvvvv.exe 34 PID 2584 wrote to memory of 2732 2584 lxxxfxx.exe 35 PID 2584 wrote to memory of 2732 2584 lxxxfxx.exe 35 PID 2584 wrote to memory of 2732 2584 lxxxfxx.exe 35 PID 2584 wrote to memory of 2732 2584 lxxxfxx.exe 35 PID 2732 wrote to memory of 3044 2732 fxxxlff.exe 36 PID 2732 wrote to memory of 3044 2732 fxxxlff.exe 36 PID 2732 wrote to memory of 3044 2732 fxxxlff.exe 36 PID 2732 wrote to memory of 3044 2732 fxxxlff.exe 36 PID 3044 wrote to memory of 2564 3044 bthbtn.exe 37 PID 3044 wrote to memory of 2564 3044 bthbtn.exe 37 PID 3044 wrote to memory of 2564 3044 bthbtn.exe 37 PID 3044 wrote to memory of 2564 3044 bthbtn.exe 37 PID 2564 wrote to memory of 2068 2564 dpvdp.exe 38 PID 2564 wrote to memory of 2068 2564 dpvdp.exe 38 PID 2564 wrote to memory of 2068 2564 dpvdp.exe 38 PID 2564 wrote to memory of 2068 2564 dpvdp.exe 38 PID 2068 wrote to memory of 628 2068 7xlflxf.exe 39 PID 2068 wrote to memory of 628 2068 7xlflxf.exe 39 PID 2068 wrote to memory of 628 2068 7xlflxf.exe 39 PID 2068 wrote to memory of 628 2068 7xlflxf.exe 39 PID 628 wrote to memory of 2776 628 frlllrx.exe 40 PID 628 wrote to memory of 2776 628 frlllrx.exe 40 PID 628 wrote to memory of 2776 628 frlllrx.exe 40 PID 628 wrote to memory of 2776 628 frlllrx.exe 40 PID 2776 wrote to memory of 828 2776 hbhnht.exe 41 PID 2776 wrote to memory of 828 2776 hbhnht.exe 41 PID 2776 wrote to memory of 828 2776 hbhnht.exe 41 PID 2776 wrote to memory of 828 2776 hbhnht.exe 41 PID 828 wrote to memory of 988 828 7vjdd.exe 42 PID 828 wrote to memory of 988 828 7vjdd.exe 42 PID 828 wrote to memory of 988 828 7vjdd.exe 42 PID 828 wrote to memory of 988 828 7vjdd.exe 42 PID 988 wrote to memory of 2736 988 3djdd.exe 43 PID 988 wrote to memory of 2736 988 3djdd.exe 43 PID 988 wrote to memory of 2736 988 3djdd.exe 43 PID 988 wrote to memory of 2736 988 3djdd.exe 43 PID 2736 wrote to memory of 2944 2736 rxrrlfl.exe 44 PID 2736 wrote to memory of 2944 2736 rxrrlfl.exe 44 PID 2736 wrote to memory of 2944 2736 rxrrlfl.exe 44 PID 2736 wrote to memory of 2944 2736 rxrrlfl.exe 44 PID 2944 wrote to memory of 380 2944 fxrrxfr.exe 45 PID 2944 wrote to memory of 380 2944 fxrrxfr.exe 45 PID 2944 wrote to memory of 380 2944 fxrrxfr.exe 45 PID 2944 wrote to memory of 380 2944 fxrrxfr.exe 45 PID 380 wrote to memory of 2016 380 nbhbtn.exe 46 PID 380 wrote to memory of 2016 380 nbhbtn.exe 46 PID 380 wrote to memory of 2016 380 nbhbtn.exe 46 PID 380 wrote to memory of 2016 380 nbhbtn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe"C:\Users\Admin\AppData\Local\Temp\790e90432053e62f7e41f8f851f36216f2f3af81fd014a26cb22453d7fc76d83.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\thhbhb.exec:\thhbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nhtbnh.exec:\nhtbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\dvvvv.exec:\dvvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lxxxfxx.exec:\lxxxfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\fxxxlff.exec:\fxxxlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bthbtn.exec:\bthbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\dpvdp.exec:\dpvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\7xlflxf.exec:\7xlflxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\frlllrx.exec:\frlllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\hbhnht.exec:\hbhnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7vjdd.exec:\7vjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\3djdd.exec:\3djdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\rxrrlfl.exec:\rxrrlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\nbhbtn.exec:\nbhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\3bttbt.exec:\3bttbt.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\5vjvv.exec:\5vjvv.exe18⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1flflfr.exec:\1flflfr.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3hbbhn.exec:\3hbbhn.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ttnbnn.exec:\ttnbnn.exe22⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jvddv.exec:\jvddv.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5lrlllx.exec:\5lrlllx.exe25⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bnbttt.exec:\bnbttt.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tbnthb.exec:\tbnthb.exe27⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xflxxfl.exec:\xflxxfl.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ffrrrxf.exec:\ffrrrxf.exe29⤵
- Executes dropped EXE
PID:764 -
\??\c:\hntnnh.exec:\hntnnh.exe30⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bbhhnn.exec:\bbhhnn.exe31⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dpjjj.exec:\dpjjj.exe32⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vjddv.exec:\vjddv.exe33⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5xfxfff.exec:\5xfxfff.exe34⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9lxxfxl.exec:\9lxxfxl.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nhtbbb.exec:\nhtbbb.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7nbthb.exec:\7nbthb.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vjjjj.exec:\vjjjj.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvdvd.exec:\dvdvd.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9jvdd.exec:\9jvdd.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rflfllf.exec:\rflfllf.exe41⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5rfrrlr.exec:\5rfrrlr.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nbhhnb.exec:\nbhhnb.exe43⤵
- Executes dropped EXE
PID:2068 -
\??\c:\btbtbt.exec:\btbtbt.exe44⤵
- Executes dropped EXE
PID:2108 -
\??\c:\7vppv.exec:\7vppv.exe45⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vjppp.exec:\vjppp.exe46⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dppjj.exec:\dppjj.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lffffff.exec:\lffffff.exe48⤵
- Executes dropped EXE
PID:988 -
\??\c:\frxxfff.exec:\frxxfff.exe49⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nbnnht.exec:\nbnnht.exe50⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bnbttt.exec:\bnbttt.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vjjdj.exec:\vjjdj.exe52⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ppppp.exec:\ppppp.exe53⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lxllrrx.exec:\lxllrrx.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe55⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tnbbnt.exec:\tnbbnt.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tnhntt.exec:\tnhntt.exe57⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vvpvp.exec:\vvpvp.exe58⤵
- Executes dropped EXE
PID:1048 -
\??\c:\dvjpd.exec:\dvjpd.exe59⤵
- Executes dropped EXE
PID:948 -
\??\c:\pjdpd.exec:\pjdpd.exe60⤵
- Executes dropped EXE
PID:1388 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe61⤵
- Executes dropped EXE
PID:896 -
\??\c:\lxxxlll.exec:\lxxxlll.exe62⤵
- Executes dropped EXE
PID:1536 -
\??\c:\llrlxfr.exec:\llrlxfr.exe63⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bnbbnn.exec:\bnbbnn.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hthnbb.exec:\hthnbb.exe65⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7jdvp.exec:\7jdvp.exe66⤵PID:2092
-
\??\c:\vjdjj.exec:\vjdjj.exe67⤵PID:2268
-
\??\c:\xllllrf.exec:\xllllrf.exe68⤵PID:1760
-
\??\c:\xxllxxf.exec:\xxllxxf.exe69⤵PID:1276
-
\??\c:\1bbhhn.exec:\1bbhhn.exe70⤵PID:2148
-
\??\c:\1nnbbh.exec:\1nnbbh.exe71⤵PID:2712
-
\??\c:\tnbhbb.exec:\tnbhbb.exe72⤵PID:2844
-
\??\c:\1jvpp.exec:\1jvpp.exe73⤵PID:2960
-
\??\c:\jdjdj.exec:\jdjdj.exe74⤵PID:2820
-
\??\c:\xxlxxfl.exec:\xxlxxfl.exe75⤵PID:2824
-
\??\c:\xxlrllr.exec:\xxlrllr.exe76⤵PID:2812
-
\??\c:\xlrlxrx.exec:\xlrlxrx.exe77⤵PID:2592
-
\??\c:\bnttbb.exec:\bnttbb.exe78⤵PID:2560
-
\??\c:\nhbhhh.exec:\nhbhhh.exe79⤵PID:3044
-
\??\c:\3dpvd.exec:\3dpvd.exe80⤵PID:2096
-
\??\c:\vjvvv.exec:\vjvvv.exe81⤵PID:2564
-
\??\c:\lxfxfxl.exec:\lxfxfxl.exe82⤵PID:2196
-
\??\c:\nhbbnn.exec:\nhbbnn.exe83⤵PID:2788
-
\??\c:\vpdjv.exec:\vpdjv.exe84⤵PID:628
-
\??\c:\pjpvj.exec:\pjpvj.exe85⤵PID:2888
-
\??\c:\7lxxfxf.exec:\7lxxfxf.exe86⤵PID:2060
-
\??\c:\3xrxrrl.exec:\3xrxrrl.exe87⤵PID:2744
-
\??\c:\fxxxffl.exec:\fxxxffl.exe88⤵PID:2800
-
\??\c:\bhnbbn.exec:\bhnbbn.exe89⤵PID:2024
-
\??\c:\hbhnbb.exec:\hbhnbb.exe90⤵PID:588
-
\??\c:\djvpp.exec:\djvpp.exe91⤵PID:1456
-
\??\c:\pdjpv.exec:\pdjpv.exe92⤵PID:2984
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe93⤵PID:2180
-
\??\c:\lxllxxf.exec:\lxllxxf.exe94⤵PID:2228
-
\??\c:\nhbtnh.exec:\nhbtnh.exe95⤵PID:2136
-
\??\c:\thtntt.exec:\thtntt.exe96⤵PID:408
-
\??\c:\pvdvv.exec:\pvdvv.exe97⤵PID:2220
-
\??\c:\dppdv.exec:\dppdv.exe98⤵PID:840
-
\??\c:\lxrxffl.exec:\lxrxffl.exe99⤵PID:1648
-
\??\c:\lrflxlr.exec:\lrflxlr.exe100⤵PID:704
-
\??\c:\thnnnb.exec:\thnnnb.exe101⤵PID:1044
-
\??\c:\3ttthb.exec:\3ttthb.exe102⤵PID:2256
-
\??\c:\btnthn.exec:\btnthn.exe103⤵PID:2336
-
\??\c:\pjppv.exec:\pjppv.exe104⤵PID:2244
-
\??\c:\jvjvd.exec:\jvjvd.exe105⤵PID:3012
-
\??\c:\lxlxffr.exec:\lxlxffr.exe106⤵PID:2492
-
\??\c:\rxxflrr.exec:\rxxflrr.exe107⤵PID:1828
-
\??\c:\hbbtbb.exec:\hbbtbb.exe108⤵PID:1332
-
\??\c:\nbnhhb.exec:\nbnhhb.exe109⤵PID:2664
-
\??\c:\ntbbnt.exec:\ntbbnt.exe110⤵PID:1592
-
\??\c:\pjvpj.exec:\pjvpj.exe111⤵PID:2848
-
\??\c:\5pddj.exec:\5pddj.exe112⤵PID:2864
-
\??\c:\lfrxfff.exec:\lfrxfff.exe113⤵PID:2960
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe114⤵PID:3060
-
\??\c:\9nhtnh.exec:\9nhtnh.exe115⤵PID:2824
-
\??\c:\7bbbbt.exec:\7bbbbt.exe116⤵PID:2632
-
\??\c:\pdddv.exec:\pdddv.exe117⤵PID:2768
-
\??\c:\dpjjp.exec:\dpjjp.exe118⤵PID:3048
-
\??\c:\3jjdj.exec:\3jjdj.exe119⤵PID:2204
-
\??\c:\llfrrff.exec:\llfrrff.exe120⤵PID:3032
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe121⤵PID:2432
-
\??\c:\bnhntb.exec:\bnhntb.exe122⤵PID:348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-