Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe
Resource
win7-20240708-en
General
-
Target
2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe
-
Size
68KB
-
MD5
170e0d450d0b9b23a4ab9f5055cb4700
-
SHA1
c2ecaea7c6dad88c8c654c5abea63ffca8e5432a
-
SHA256
2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308
-
SHA512
cf21353c7b73f35139cf940335c827d849aa28d243e6671f0526749897a9a467ee712d78e0c2e651d2dcb2acb4b9ff283ac4a292e1330c003d5dc1449d000032
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcZ:ymb3NkkiQ3mdBjFIsIVcZ
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2032-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1396 tbhhbh.exe 1464 04864.exe 4472 hhnnbn.exe 3140 6842048.exe 2008 fxfxfxx.exe 2884 4022604.exe 2088 068604.exe 3640 fxfxxrx.exe 4800 846860.exe 4280 026486.exe 1112 lffrlff.exe 2788 o286626.exe 820 bttbtn.exe 4416 g2642.exe 3048 nbnthb.exe 60 26282.exe 2984 a0088.exe 4632 7bbbnh.exe 2548 44642.exe 748 426202.exe 3508 jvjdj.exe 3432 bbbhbh.exe 2664 thbnbt.exe 4284 ddvpd.exe 4420 42048.exe 3664 5dppd.exe 4852 1xfxllf.exe 3456 hththb.exe 5076 k64864.exe 4816 i448220.exe 4696 jdddd.exe 4344 pjpjd.exe 2980 8642042.exe 1048 28826.exe 3584 46220.exe 1516 8844882.exe 4996 m4820.exe 3544 xlxfflr.exe 2584 1hbhbn.exe 2556 4260482.exe 3932 djdvj.exe 1564 xlfrfxf.exe 3256 4226082.exe 2256 0004820.exe 3640 0444444.exe 4544 tnhhhn.exe 4440 1vpdj.exe 5052 c804264.exe 3200 666462.exe 3212 a0080.exe 3396 pppjv.exe 2260 062082.exe 720 pddpv.exe 760 2404866.exe 3596 5thnhb.exe 60 9lrlxxr.exe 3040 068222.exe 4488 g2208.exe 2984 86686.exe 4132 5pvjj.exe 1648 vjdpj.exe 1984 lrrfxlx.exe 1304 e62204.exe 3760 bhntbt.exe -
resource yara_rule behavioral2/memory/2032-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2642.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 462664.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1396 2032 2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe 89 PID 2032 wrote to memory of 1396 2032 2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe 89 PID 2032 wrote to memory of 1396 2032 2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe 89 PID 1396 wrote to memory of 1464 1396 tbhhbh.exe 90 PID 1396 wrote to memory of 1464 1396 tbhhbh.exe 90 PID 1396 wrote to memory of 1464 1396 tbhhbh.exe 90 PID 1464 wrote to memory of 4472 1464 04864.exe 91 PID 1464 wrote to memory of 4472 1464 04864.exe 91 PID 1464 wrote to memory of 4472 1464 04864.exe 91 PID 4472 wrote to memory of 3140 4472 hhnnbn.exe 92 PID 4472 wrote to memory of 3140 4472 hhnnbn.exe 92 PID 4472 wrote to memory of 3140 4472 hhnnbn.exe 92 PID 3140 wrote to memory of 2008 3140 6842048.exe 93 PID 3140 wrote to memory of 2008 3140 6842048.exe 93 PID 3140 wrote to memory of 2008 3140 6842048.exe 93 PID 2008 wrote to memory of 2884 2008 fxfxfxx.exe 94 PID 2008 wrote to memory of 2884 2008 fxfxfxx.exe 94 PID 2008 wrote to memory of 2884 2008 fxfxfxx.exe 94 PID 2884 wrote to memory of 2088 2884 4022604.exe 95 PID 2884 wrote to memory of 2088 2884 4022604.exe 95 PID 2884 wrote to memory of 2088 2884 4022604.exe 95 PID 2088 wrote to memory of 3640 2088 068604.exe 96 PID 2088 wrote to memory of 3640 2088 068604.exe 96 PID 2088 wrote to memory of 3640 2088 068604.exe 96 PID 3640 wrote to memory of 4800 3640 fxfxxrx.exe 97 PID 3640 wrote to memory of 4800 3640 fxfxxrx.exe 97 PID 3640 wrote to memory of 4800 3640 fxfxxrx.exe 97 PID 4800 wrote to memory of 4280 4800 846860.exe 98 PID 4800 wrote to memory of 4280 4800 846860.exe 98 PID 4800 wrote to memory of 4280 4800 846860.exe 98 PID 4280 wrote to memory of 1112 4280 026486.exe 99 PID 4280 wrote to memory of 1112 4280 026486.exe 99 PID 4280 wrote to memory of 1112 4280 026486.exe 99 PID 1112 wrote to memory of 2788 1112 lffrlff.exe 100 PID 1112 wrote to memory of 2788 1112 lffrlff.exe 100 PID 1112 wrote to memory of 2788 1112 lffrlff.exe 100 PID 2788 wrote to memory of 820 2788 o286626.exe 101 PID 2788 wrote to memory of 820 2788 o286626.exe 101 PID 2788 wrote to memory of 820 2788 o286626.exe 101 PID 820 wrote to memory of 4416 820 bttbtn.exe 102 PID 820 wrote to memory of 4416 820 bttbtn.exe 102 PID 820 wrote to memory of 4416 820 bttbtn.exe 102 PID 4416 wrote to memory of 3048 4416 g2642.exe 103 PID 4416 wrote to memory of 3048 4416 g2642.exe 103 PID 4416 wrote to memory of 3048 4416 g2642.exe 103 PID 3048 wrote to memory of 60 3048 nbnthb.exe 104 PID 3048 wrote to memory of 60 3048 nbnthb.exe 104 PID 3048 wrote to memory of 60 3048 nbnthb.exe 104 PID 60 wrote to memory of 2984 60 26282.exe 105 PID 60 wrote to memory of 2984 60 26282.exe 105 PID 60 wrote to memory of 2984 60 26282.exe 105 PID 2984 wrote to memory of 4632 2984 a0088.exe 106 PID 2984 wrote to memory of 4632 2984 a0088.exe 106 PID 2984 wrote to memory of 4632 2984 a0088.exe 106 PID 4632 wrote to memory of 2548 4632 7bbbnh.exe 107 PID 4632 wrote to memory of 2548 4632 7bbbnh.exe 107 PID 4632 wrote to memory of 2548 4632 7bbbnh.exe 107 PID 2548 wrote to memory of 748 2548 44642.exe 108 PID 2548 wrote to memory of 748 2548 44642.exe 108 PID 2548 wrote to memory of 748 2548 44642.exe 108 PID 748 wrote to memory of 3508 748 426202.exe 109 PID 748 wrote to memory of 3508 748 426202.exe 109 PID 748 wrote to memory of 3508 748 426202.exe 109 PID 3508 wrote to memory of 3432 3508 jvjdj.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe"C:\Users\Admin\AppData\Local\Temp\2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\tbhhbh.exec:\tbhhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\04864.exec:\04864.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\hhnnbn.exec:\hhnnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\6842048.exec:\6842048.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\4022604.exec:\4022604.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\068604.exec:\068604.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\846860.exec:\846860.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\026486.exec:\026486.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\lffrlff.exec:\lffrlff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\o286626.exec:\o286626.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bttbtn.exec:\bttbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\g2642.exec:\g2642.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\nbnthb.exec:\nbnthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\26282.exec:\26282.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\a0088.exec:\a0088.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\7bbbnh.exec:\7bbbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\44642.exec:\44642.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\426202.exec:\426202.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\jvjdj.exec:\jvjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\bbbhbh.exec:\bbbhbh.exe23⤵
- Executes dropped EXE
PID:3432 -
\??\c:\thbnbt.exec:\thbnbt.exe24⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ddvpd.exec:\ddvpd.exe25⤵
- Executes dropped EXE
PID:4284 -
\??\c:\42048.exec:\42048.exe26⤵
- Executes dropped EXE
PID:4420 -
\??\c:\5dppd.exec:\5dppd.exe27⤵
- Executes dropped EXE
PID:3664 -
\??\c:\1xfxllf.exec:\1xfxllf.exe28⤵
- Executes dropped EXE
PID:4852 -
\??\c:\hththb.exec:\hththb.exe29⤵
- Executes dropped EXE
PID:3456 -
\??\c:\k64864.exec:\k64864.exe30⤵
- Executes dropped EXE
PID:5076 -
\??\c:\i448220.exec:\i448220.exe31⤵
- Executes dropped EXE
PID:4816 -
\??\c:\jdddd.exec:\jdddd.exe32⤵
- Executes dropped EXE
PID:4696 -
\??\c:\pjpjd.exec:\pjpjd.exe33⤵
- Executes dropped EXE
PID:4344 -
\??\c:\8642042.exec:\8642042.exe34⤵
- Executes dropped EXE
PID:2980 -
\??\c:\28826.exec:\28826.exe35⤵
- Executes dropped EXE
PID:1048 -
\??\c:\46220.exec:\46220.exe36⤵
- Executes dropped EXE
PID:3584 -
\??\c:\8844882.exec:\8844882.exe37⤵
- Executes dropped EXE
PID:1516 -
\??\c:\m4820.exec:\m4820.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xlxfflr.exec:\xlxfflr.exe39⤵
- Executes dropped EXE
PID:3544 -
\??\c:\1hbhbn.exec:\1hbhbn.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\4260482.exec:\4260482.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\djdvj.exec:\djdvj.exe42⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xlfrfxf.exec:\xlfrfxf.exe43⤵
- Executes dropped EXE
PID:1564 -
\??\c:\4226082.exec:\4226082.exe44⤵
- Executes dropped EXE
PID:3256 -
\??\c:\0004820.exec:\0004820.exe45⤵
- Executes dropped EXE
PID:2256 -
\??\c:\0444444.exec:\0444444.exe46⤵
- Executes dropped EXE
PID:3640 -
\??\c:\tnhhhn.exec:\tnhhhn.exe47⤵
- Executes dropped EXE
PID:4544 -
\??\c:\1vpdj.exec:\1vpdj.exe48⤵
- Executes dropped EXE
PID:4440 -
\??\c:\c804264.exec:\c804264.exe49⤵
- Executes dropped EXE
PID:5052 -
\??\c:\666462.exec:\666462.exe50⤵
- Executes dropped EXE
PID:3200 -
\??\c:\a0080.exec:\a0080.exe51⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pppjv.exec:\pppjv.exe52⤵
- Executes dropped EXE
PID:3396 -
\??\c:\062082.exec:\062082.exe53⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pddpv.exec:\pddpv.exe54⤵
- Executes dropped EXE
PID:720 -
\??\c:\2404866.exec:\2404866.exe55⤵
- Executes dropped EXE
PID:760 -
\??\c:\5thnhb.exec:\5thnhb.exe56⤵
- Executes dropped EXE
PID:3596 -
\??\c:\9lrlxxr.exec:\9lrlxxr.exe57⤵
- Executes dropped EXE
PID:60 -
\??\c:\068222.exec:\068222.exe58⤵
- Executes dropped EXE
PID:3040 -
\??\c:\g2208.exec:\g2208.exe59⤵
- Executes dropped EXE
PID:4488 -
\??\c:\86686.exec:\86686.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5pvjj.exec:\5pvjj.exe61⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vjdpj.exec:\vjdpj.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lrrfxlx.exec:\lrrfxlx.exe63⤵
- Executes dropped EXE
PID:1984 -
\??\c:\e62204.exec:\e62204.exe64⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bhntbt.exec:\bhntbt.exe65⤵
- Executes dropped EXE
PID:3760 -
\??\c:\86086.exec:\86086.exe66⤵PID:1212
-
\??\c:\6804866.exec:\6804866.exe67⤵PID:4284
-
\??\c:\86480.exec:\86480.exe68⤵PID:448
-
\??\c:\6442620.exec:\6442620.exe69⤵PID:1828
-
\??\c:\frxllxr.exec:\frxllxr.exe70⤵PID:1528
-
\??\c:\4000486.exec:\4000486.exe71⤵PID:2028
-
\??\c:\rffllrr.exec:\rffllrr.exe72⤵PID:5112
-
\??\c:\tnnnnh.exec:\tnnnnh.exe73⤵PID:2484
-
\??\c:\ddjjv.exec:\ddjjv.exe74⤵PID:5076
-
\??\c:\826644.exec:\826644.exe75⤵PID:4148
-
\??\c:\a4420.exec:\a4420.exe76⤵PID:4240
-
\??\c:\4282604.exec:\4282604.exe77⤵PID:3172
-
\??\c:\nbtntn.exec:\nbtntn.exe78⤵PID:4008
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe79⤵PID:2784
-
\??\c:\5fxlrll.exec:\5fxlrll.exe80⤵PID:5020
-
\??\c:\02220.exec:\02220.exe81⤵PID:1464
-
\??\c:\m4486.exec:\m4486.exe82⤵PID:2744
-
\??\c:\a4082.exec:\a4082.exe83⤵PID:1608
-
\??\c:\8282660.exec:\8282660.exe84⤵PID:3644
-
\??\c:\200488.exec:\200488.exe85⤵PID:4216
-
\??\c:\0680260.exec:\0680260.exe86⤵PID:1316
-
\??\c:\s8864.exec:\s8864.exe87⤵PID:4352
-
\??\c:\lrrflfx.exec:\lrrflfx.exe88⤵PID:1888
-
\??\c:\vdpdp.exec:\vdpdp.exe89⤵PID:1268
-
\??\c:\w60420.exec:\w60420.exe90⤵PID:4484
-
\??\c:\444888.exec:\444888.exe91⤵PID:3988
-
\??\c:\pvpdj.exec:\pvpdj.exe92⤵PID:3968
-
\??\c:\o064866.exec:\o064866.exe93⤵PID:4900
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe94⤵PID:3808
-
\??\c:\frlxflx.exec:\frlxflx.exe95⤵PID:3208
-
\??\c:\pdpdv.exec:\pdpdv.exe96⤵PID:3676
-
\??\c:\804228.exec:\804228.exe97⤵PID:1452
-
\??\c:\3hbnbt.exec:\3hbnbt.exe98⤵PID:2624
-
\??\c:\62648.exec:\62648.exe99⤵PID:4492
-
\??\c:\frxrxxf.exec:\frxrxxf.exe100⤵PID:3620
-
\??\c:\9rrlxrf.exec:\9rrlxrf.exe101⤵PID:5008
-
\??\c:\vjjdv.exec:\vjjdv.exe102⤵PID:452
-
\??\c:\jvjjj.exec:\jvjjj.exe103⤵PID:4380
-
\??\c:\86042.exec:\86042.exe104⤵PID:2548
-
\??\c:\882648.exec:\882648.exe105⤵PID:2172
-
\??\c:\a6264.exec:\a6264.exe106⤵PID:3996
-
\??\c:\5hhthh.exec:\5hhthh.exe107⤵PID:3508
-
\??\c:\e06664.exec:\e06664.exe108⤵PID:428
-
\??\c:\frfrfxl.exec:\frfrfxl.exe109⤵PID:3616
-
\??\c:\4406004.exec:\4406004.exe110⤵PID:3412
-
\??\c:\xrfrrlf.exec:\xrfrrlf.exe111⤵PID:1544
-
\??\c:\m8260.exec:\m8260.exe112⤵PID:652
-
\??\c:\6042088.exec:\6042088.exe113⤵PID:624
-
\??\c:\7nnbbt.exec:\7nnbbt.exe114⤵PID:4108
-
\??\c:\084264.exec:\084264.exe115⤵PID:1532
-
\??\c:\tntttn.exec:\tntttn.exe116⤵PID:1160
-
\??\c:\bhnhbb.exec:\bhnhbb.exe117⤵PID:640
-
\??\c:\022648.exec:\022648.exe118⤵PID:3372
-
\??\c:\00064.exec:\00064.exe119⤵PID:1760
-
\??\c:\1llxfxr.exec:\1llxfxr.exe120⤵PID:3820
-
\??\c:\bhbtnh.exec:\bhbtnh.exe121⤵PID:2144
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe122⤵PID:1956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-