Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe
Resource
win7-20240903-en
General
-
Target
2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe
-
Size
64KB
-
MD5
6f5a2351c19c138a2c343f9f8c9e6940
-
SHA1
78ab3fdc9e427069c9d6af93ad2183c21981da17
-
SHA256
2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6
-
SHA512
d3fbfb84213b312c502a7d611d0dce182d52cd0ec77145287ef6ae6c91b25b37f96218162930b01590c56001f0cd19ac2b2858426882c64da7650f908dc0eedd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbx7:ymb3NkkiQ3mdBjF0y7kbZ
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/2636-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/680-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-287-0x0000000077590000-0x000000007768A000-memory.dmp family_blackmoon behavioral1/memory/2312-286-0x0000000077690000-0x00000000777AF000-memory.dmp family_blackmoon behavioral1/memory/2312-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2636 jpjdp.exe 2752 rxxfllr.exe 2548 nnbhhn.exe 2668 7pdvv.exe 2804 rrfrlrr.exe 2536 bhnbbt.exe 2344 jjjpp.exe 768 5vpjd.exe 2984 bbnthn.exe 2136 5djdv.exe 700 frrrrlx.exe 764 3lfxrxf.exe 2272 bttnhn.exe 1044 pvddj.exe 680 5rrxffx.exe 1624 nnbhtt.exe 2520 ppvpv.exe 348 rllrrfl.exe 2900 nnhttn.exe 2912 vpjpd.exe 2124 rrxrrll.exe 1424 7rflxlx.exe 2516 vvvjd.exe 896 9ddpd.exe 1208 lfxfxrf.exe 1804 lxllrrr.exe 1292 bbbbbh.exe 988 dddpd.exe 1988 7xfxfrx.exe 2312 nnnhtn.exe 2744 jppjp.exe 2740 nnbhbn.exe 2648 5vvpp.exe 2676 dvjpj.exe 2792 ffxxrfr.exe 292 hnntbt.exe 2584 7bbhhn.exe 2964 7pvvv.exe 2344 7dvdp.exe 2592 llrxffl.exe 2188 hhhnnn.exe 2984 bbtntn.exe 2032 pjjpd.exe 2136 fxlxfrf.exe 700 lrrfllx.exe 2056 ttnhbb.exe 2064 btbbnn.exe 1300 3pjvv.exe 1044 llrfflf.exe 288 rlrrffl.exe 2904 bbbhtn.exe 2860 nhnthn.exe 1368 jjdvd.exe 348 lfrfxfr.exe 884 lrlrlxf.exe 2240 1nnhtb.exe 2124 ddpdp.exe 1336 vjdvv.exe 2144 lllrxrf.exe 1744 ttthth.exe 2828 bbnthh.exe 2160 vppdp.exe 1596 fxxlrrr.exe 2504 ffxrlrf.exe -
resource yara_rule behavioral1/memory/2636-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/680-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-286-0x0000000077690000-0x00000000777AF000-memory.dmp upx behavioral1/memory/2312-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2636 3024 2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe 31 PID 3024 wrote to memory of 2636 3024 2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe 31 PID 3024 wrote to memory of 2636 3024 2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe 31 PID 3024 wrote to memory of 2636 3024 2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe 31 PID 2636 wrote to memory of 2752 2636 jpjdp.exe 32 PID 2636 wrote to memory of 2752 2636 jpjdp.exe 32 PID 2636 wrote to memory of 2752 2636 jpjdp.exe 32 PID 2636 wrote to memory of 2752 2636 jpjdp.exe 32 PID 2752 wrote to memory of 2548 2752 rxxfllr.exe 33 PID 2752 wrote to memory of 2548 2752 rxxfllr.exe 33 PID 2752 wrote to memory of 2548 2752 rxxfllr.exe 33 PID 2752 wrote to memory of 2548 2752 rxxfllr.exe 33 PID 2548 wrote to memory of 2668 2548 nnbhhn.exe 34 PID 2548 wrote to memory of 2668 2548 nnbhhn.exe 34 PID 2548 wrote to memory of 2668 2548 nnbhhn.exe 34 PID 2548 wrote to memory of 2668 2548 nnbhhn.exe 34 PID 2668 wrote to memory of 2804 2668 7pdvv.exe 35 PID 2668 wrote to memory of 2804 2668 7pdvv.exe 35 PID 2668 wrote to memory of 2804 2668 7pdvv.exe 35 PID 2668 wrote to memory of 2804 2668 7pdvv.exe 35 PID 2804 wrote to memory of 2536 2804 rrfrlrr.exe 36 PID 2804 wrote to memory of 2536 2804 rrfrlrr.exe 36 PID 2804 wrote to memory of 2536 2804 rrfrlrr.exe 36 PID 2804 wrote to memory of 2536 2804 rrfrlrr.exe 36 PID 2536 wrote to memory of 2344 2536 bhnbbt.exe 37 PID 2536 wrote to memory of 2344 2536 bhnbbt.exe 37 PID 2536 wrote to memory of 2344 2536 bhnbbt.exe 37 PID 2536 wrote to memory of 2344 2536 bhnbbt.exe 37 PID 2344 wrote to memory of 768 2344 jjjpp.exe 38 PID 2344 wrote to memory of 768 2344 jjjpp.exe 38 PID 2344 wrote to memory of 768 2344 jjjpp.exe 38 PID 2344 wrote to memory of 768 2344 jjjpp.exe 38 PID 768 wrote to memory of 2984 768 5vpjd.exe 39 PID 768 wrote to memory of 2984 768 5vpjd.exe 39 PID 768 wrote to memory of 2984 768 5vpjd.exe 39 PID 768 wrote to memory of 2984 768 5vpjd.exe 39 PID 2984 wrote to memory of 2136 2984 bbnthn.exe 40 PID 2984 wrote to memory of 2136 2984 bbnthn.exe 40 PID 2984 wrote to memory of 2136 2984 bbnthn.exe 40 PID 2984 wrote to memory of 2136 2984 bbnthn.exe 40 PID 2136 wrote to memory of 700 2136 5djdv.exe 41 PID 2136 wrote to memory of 700 2136 5djdv.exe 41 PID 2136 wrote to memory of 700 2136 5djdv.exe 41 PID 2136 wrote to memory of 700 2136 5djdv.exe 41 PID 700 wrote to memory of 764 700 frrrrlx.exe 42 PID 700 wrote to memory of 764 700 frrrrlx.exe 42 PID 700 wrote to memory of 764 700 frrrrlx.exe 42 PID 700 wrote to memory of 764 700 frrrrlx.exe 42 PID 764 wrote to memory of 2272 764 3lfxrxf.exe 43 PID 764 wrote to memory of 2272 764 3lfxrxf.exe 43 PID 764 wrote to memory of 2272 764 3lfxrxf.exe 43 PID 764 wrote to memory of 2272 764 3lfxrxf.exe 43 PID 2272 wrote to memory of 1044 2272 bttnhn.exe 44 PID 2272 wrote to memory of 1044 2272 bttnhn.exe 44 PID 2272 wrote to memory of 1044 2272 bttnhn.exe 44 PID 2272 wrote to memory of 1044 2272 bttnhn.exe 44 PID 1044 wrote to memory of 680 1044 pvddj.exe 45 PID 1044 wrote to memory of 680 1044 pvddj.exe 45 PID 1044 wrote to memory of 680 1044 pvddj.exe 45 PID 1044 wrote to memory of 680 1044 pvddj.exe 45 PID 680 wrote to memory of 1624 680 5rrxffx.exe 46 PID 680 wrote to memory of 1624 680 5rrxffx.exe 46 PID 680 wrote to memory of 1624 680 5rrxffx.exe 46 PID 680 wrote to memory of 1624 680 5rrxffx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe"C:\Users\Admin\AppData\Local\Temp\2cc867eeb019a50c7387105e0a8c2ccdab3fb4b2769971840f59b39e498140f6N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jpjdp.exec:\jpjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rxxfllr.exec:\rxxfllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\nnbhhn.exec:\nnbhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\7pdvv.exec:\7pdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rrfrlrr.exec:\rrfrlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bhnbbt.exec:\bhnbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jjjpp.exec:\jjjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\5vpjd.exec:\5vpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\bbnthn.exec:\bbnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\5djdv.exec:\5djdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\frrrrlx.exec:\frrrrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\3lfxrxf.exec:\3lfxrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\bttnhn.exec:\bttnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\pvddj.exec:\pvddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\5rrxffx.exec:\5rrxffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\nnbhtt.exec:\nnbhtt.exe17⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ppvpv.exec:\ppvpv.exe18⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rllrrfl.exec:\rllrrfl.exe19⤵
- Executes dropped EXE
PID:348 -
\??\c:\nnhttn.exec:\nnhttn.exe20⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vpjpd.exec:\vpjpd.exe21⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrxrrll.exec:\rrxrrll.exe22⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7rflxlx.exec:\7rflxlx.exe23⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vvvjd.exec:\vvvjd.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9ddpd.exec:\9ddpd.exe25⤵
- Executes dropped EXE
PID:896 -
\??\c:\lfxfxrf.exec:\lfxfxrf.exe26⤵
- Executes dropped EXE
PID:1208 -
\??\c:\lxllrrr.exec:\lxllrrr.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bbbbbh.exec:\bbbbbh.exe28⤵
- Executes dropped EXE
PID:1292 -
\??\c:\dddpd.exec:\dddpd.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\7xfxfrx.exec:\7xfxfrx.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nnnhtn.exec:\nnnhtn.exe31⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btnthn.exec:\btnthn.exe32⤵PID:1576
-
\??\c:\jppjp.exec:\jppjp.exe33⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nnbhbn.exec:\nnbhbn.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5vvpp.exec:\5vvpp.exe35⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dvjpj.exec:\dvjpj.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ffxxrfr.exec:\ffxxrfr.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hnntbt.exec:\hnntbt.exe38⤵
- Executes dropped EXE
PID:292 -
\??\c:\7bbhhn.exec:\7bbhhn.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7pvvv.exec:\7pvvv.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7dvdp.exec:\7dvdp.exe41⤵
- Executes dropped EXE
PID:2344 -
\??\c:\llrxffl.exec:\llrxffl.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hhhnnn.exec:\hhhnnn.exe43⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bbtntn.exec:\bbtntn.exe44⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pjjpd.exec:\pjjpd.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\fxlxfrf.exec:\fxlxfrf.exe46⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lrrfllx.exec:\lrrfllx.exe47⤵
- Executes dropped EXE
PID:700 -
\??\c:\ttnhbb.exec:\ttnhbb.exe48⤵
- Executes dropped EXE
PID:2056 -
\??\c:\btbbnn.exec:\btbbnn.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3pjvv.exec:\3pjvv.exe50⤵
- Executes dropped EXE
PID:1300 -
\??\c:\llrfflf.exec:\llrfflf.exe51⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rlrrffl.exec:\rlrrffl.exe52⤵
- Executes dropped EXE
PID:288 -
\??\c:\bbbhtn.exec:\bbbhtn.exe53⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nhnthn.exec:\nhnthn.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jjdvd.exec:\jjdvd.exe55⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lfrfxfr.exec:\lfrfxfr.exe56⤵
- Executes dropped EXE
PID:348 -
\??\c:\lrlrlxf.exec:\lrlrlxf.exe57⤵
- Executes dropped EXE
PID:884 -
\??\c:\1nnhtb.exec:\1nnhtb.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ddpdp.exec:\ddpdp.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vjdvv.exec:\vjdvv.exe60⤵
- Executes dropped EXE
PID:1336 -
\??\c:\lllrxrf.exec:\lllrxrf.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ttthth.exec:\ttthth.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bbnthh.exec:\bbnthh.exe63⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vppdp.exec:\vppdp.exe64⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxxlrrr.exec:\fxxlrrr.exe65⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ffxrlrf.exec:\ffxrlrf.exe66⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ttnhnh.exec:\ttnhnh.exe67⤵PID:996
-
\??\c:\tthbnn.exec:\tthbnn.exe68⤵PID:2820
-
\??\c:\7vdvj.exec:\7vdvj.exe69⤵PID:2472
-
\??\c:\rlxxffr.exec:\rlxxffr.exe70⤵PID:1496
-
\??\c:\xxxlxfl.exec:\xxxlxfl.exe71⤵PID:2392
-
\??\c:\nhtbnt.exec:\nhtbnt.exe72⤵PID:1556
-
\??\c:\1jppd.exec:\1jppd.exe73⤵PID:2700
-
\??\c:\1xfrrrr.exec:\1xfrrrr.exe74⤵PID:2384
-
\??\c:\fxxlxfl.exec:\fxxlxfl.exe75⤵PID:2568
-
\??\c:\7hhbtb.exec:\7hhbtb.exe76⤵PID:2716
-
\??\c:\bnhntb.exec:\bnhntb.exe77⤵PID:2804
-
\??\c:\jjppd.exec:\jjppd.exe78⤵PID:2656
-
\??\c:\dvvvj.exec:\dvvvj.exe79⤵PID:2044
-
\??\c:\3rflffx.exec:\3rflffx.exe80⤵PID:1800
-
\??\c:\5nbttt.exec:\5nbttt.exe81⤵PID:2644
-
\??\c:\tnhtbb.exec:\tnhtbb.exe82⤵PID:2856
-
\??\c:\9vpjp.exec:\9vpjp.exe83⤵PID:1060
-
\??\c:\7rrfrff.exec:\7rrfrff.exe84⤵PID:612
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe85⤵PID:1948
-
\??\c:\hbthtn.exec:\hbthtn.exe86⤵PID:1692
-
\??\c:\ntnbbt.exec:\ntnbbt.exe87⤵PID:2352
-
\??\c:\pvvpd.exec:\pvvpd.exe88⤵PID:2076
-
\??\c:\flxrfrl.exec:\flxrfrl.exe89⤵PID:2836
-
\??\c:\rrlflfl.exec:\rrlflfl.exe90⤵PID:2280
-
\??\c:\bbtbth.exec:\bbtbth.exe91⤵PID:1508
-
\??\c:\9jddv.exec:\9jddv.exe92⤵PID:284
-
\??\c:\pjppv.exec:\pjppv.exe93⤵PID:2904
-
\??\c:\5rxlxxl.exec:\5rxlxxl.exe94⤵PID:2128
-
\??\c:\bthtbh.exec:\bthtbh.exe95⤵PID:2900
-
\??\c:\hththn.exec:\hththn.exe96⤵PID:2224
-
\??\c:\jdvpp.exec:\jdvpp.exe97⤵PID:2328
-
\??\c:\xrlxxlr.exec:\xrlxxlr.exe98⤵PID:2416
-
\??\c:\1rrrlrf.exec:\1rrrlrf.exe99⤵PID:2372
-
\??\c:\ttnttb.exec:\ttnttb.exe100⤵PID:2020
-
\??\c:\ttnbnt.exec:\ttnbnt.exe101⤵PID:2144
-
\??\c:\dvpdp.exec:\dvpdp.exe102⤵PID:1032
-
\??\c:\7rlxrfr.exec:\7rlxrfr.exe103⤵PID:1960
-
\??\c:\fffrlxl.exec:\fffrlxl.exe104⤵PID:1756
-
\??\c:\9hhtht.exec:\9hhtht.exe105⤵PID:1708
-
\??\c:\btntnt.exec:\btntnt.exe106⤵PID:2000
-
\??\c:\ppvpd.exec:\ppvpd.exe107⤵PID:868
-
\??\c:\xxrrrxl.exec:\xxrrrxl.exe108⤵PID:1572
-
\??\c:\5lrfrxl.exec:\5lrfrxl.exe109⤵PID:1772
-
\??\c:\tnbthn.exec:\tnbthn.exe110⤵PID:2760
-
\??\c:\jjjdv.exec:\jjjdv.exe111⤵PID:2392
-
\??\c:\jdvvd.exec:\jdvvd.exe112⤵PID:2684
-
\??\c:\lfxxrfr.exec:\lfxxrfr.exe113⤵PID:2800
-
\??\c:\ntbttn.exec:\ntbttn.exe114⤵PID:2852
-
\??\c:\htnttn.exec:\htnttn.exe115⤵PID:2808
-
\??\c:\7djvp.exec:\7djvp.exe116⤵PID:2332
-
\??\c:\lxrrrxr.exec:\lxrrrxr.exe117⤵PID:2544
-
\??\c:\5flrfrx.exec:\5flrfrx.exe118⤵PID:2620
-
\??\c:\7bhnbn.exec:\7bhnbn.exe119⤵PID:2976
-
\??\c:\7htbhn.exec:\7htbhn.exe120⤵PID:1812
-
\??\c:\ddvdp.exec:\ddvdp.exe121⤵PID:1856
-
\??\c:\frllxfr.exec:\frllxfr.exe122⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-