Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe
Resource
win7-20240729-en
General
-
Target
71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe
-
Size
82KB
-
MD5
43fece1f89a797acee543c174ed7abf0
-
SHA1
a9a0b33b8dcca231929cbcc49cf912054a5c4c59
-
SHA256
71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764
-
SHA512
0d289313da1bece1d747daf206017e5aeaf4fc2b3579c86d731e68a14d765a802744bec08bf247af4a39f23bee284276b26670861382b4c785f07111893416f8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QE:ymb3NkkiQ3mdBjFIIp9L9QrrA8l
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2500-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2436 vjjjp.exe 1884 9bhbhb.exe 2068 nhnntb.exe 2236 3djdj.exe 2780 1xrrrrr.exe 2756 3bnbbb.exe 1716 vjvdj.exe 2828 xlxxxrx.exe 2676 htnnbb.exe 2384 jvjpv.exe 1432 xrxlxrx.exe 2920 7flrxxx.exe 1720 htnntn.exe 848 bthbnt.exe 272 1pjjv.exe 1936 lfxrxrx.exe 844 9rllxxf.exe 2340 bttnnn.exe 2076 jddvv.exe 2124 9dvpd.exe 1048 5flllrr.exe 2672 1frfrxf.exe 1548 hhbbnh.exe 984 tnnhht.exe 1704 9jvvp.exe 572 rlrrrrx.exe 1084 hbntbh.exe 1444 hnnhnn.exe 1420 1dvvd.exe 2568 xlxxlff.exe 2464 9tbhth.exe 2436 7nbbhn.exe 2212 jdvdp.exe 2820 xxrxfxf.exe 2404 lflffff.exe 2724 hthnbb.exe 2892 3bhhnt.exe 2780 3jvdv.exe 2836 dpdpp.exe 2896 rllfrfl.exe 1716 3flrffl.exe 2636 bnbbth.exe 2752 btnntb.exe 2676 vpvjp.exe 1128 pdppp.exe 2948 fxlxxxf.exe 1408 1rffrxx.exe 2040 nnthbh.exe 2360 tnthnt.exe 2912 jdjjp.exe 1064 pdddj.exe 1944 lflrfrx.exe 2160 5fllrrr.exe 1576 ttntbh.exe 2156 btntbt.exe 1168 vvjpv.exe 1072 jdvdj.exe 1380 fxflffl.exe 1048 5lrxflr.exe 2200 hbhntt.exe 2180 thhbht.exe 1600 9pvpp.exe 1916 djpdd.exe 2092 xxllxfr.exe -
resource yara_rule behavioral1/memory/2500-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-311-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2436 2500 71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe 30 PID 2500 wrote to memory of 2436 2500 71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe 30 PID 2500 wrote to memory of 2436 2500 71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe 30 PID 2500 wrote to memory of 2436 2500 71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe 30 PID 2436 wrote to memory of 1884 2436 vjjjp.exe 31 PID 2436 wrote to memory of 1884 2436 vjjjp.exe 31 PID 2436 wrote to memory of 1884 2436 vjjjp.exe 31 PID 2436 wrote to memory of 1884 2436 vjjjp.exe 31 PID 1884 wrote to memory of 2068 1884 9bhbhb.exe 32 PID 1884 wrote to memory of 2068 1884 9bhbhb.exe 32 PID 1884 wrote to memory of 2068 1884 9bhbhb.exe 32 PID 1884 wrote to memory of 2068 1884 9bhbhb.exe 32 PID 2068 wrote to memory of 2236 2068 nhnntb.exe 33 PID 2068 wrote to memory of 2236 2068 nhnntb.exe 33 PID 2068 wrote to memory of 2236 2068 nhnntb.exe 33 PID 2068 wrote to memory of 2236 2068 nhnntb.exe 33 PID 2236 wrote to memory of 2780 2236 3djdj.exe 34 PID 2236 wrote to memory of 2780 2236 3djdj.exe 34 PID 2236 wrote to memory of 2780 2236 3djdj.exe 34 PID 2236 wrote to memory of 2780 2236 3djdj.exe 34 PID 2780 wrote to memory of 2756 2780 1xrrrrr.exe 35 PID 2780 wrote to memory of 2756 2780 1xrrrrr.exe 35 PID 2780 wrote to memory of 2756 2780 1xrrrrr.exe 35 PID 2780 wrote to memory of 2756 2780 1xrrrrr.exe 35 PID 2756 wrote to memory of 1716 2756 3bnbbb.exe 36 PID 2756 wrote to memory of 1716 2756 3bnbbb.exe 36 PID 2756 wrote to memory of 1716 2756 3bnbbb.exe 36 PID 2756 wrote to memory of 1716 2756 3bnbbb.exe 36 PID 1716 wrote to memory of 2828 1716 vjvdj.exe 37 PID 1716 wrote to memory of 2828 1716 vjvdj.exe 37 PID 1716 wrote to memory of 2828 1716 vjvdj.exe 37 PID 1716 wrote to memory of 2828 1716 vjvdj.exe 37 PID 2828 wrote to memory of 2676 2828 xlxxxrx.exe 38 PID 2828 wrote to memory of 2676 2828 xlxxxrx.exe 38 PID 2828 wrote to memory of 2676 2828 xlxxxrx.exe 38 PID 2828 wrote to memory of 2676 2828 xlxxxrx.exe 38 PID 2676 wrote to memory of 2384 2676 htnnbb.exe 39 PID 2676 wrote to memory of 2384 2676 htnnbb.exe 39 PID 2676 wrote to memory of 2384 2676 htnnbb.exe 39 PID 2676 wrote to memory of 2384 2676 htnnbb.exe 39 PID 2384 wrote to memory of 1432 2384 jvjpv.exe 40 PID 2384 wrote to memory of 1432 2384 jvjpv.exe 40 PID 2384 wrote to memory of 1432 2384 jvjpv.exe 40 PID 2384 wrote to memory of 1432 2384 jvjpv.exe 40 PID 1432 wrote to memory of 2920 1432 xrxlxrx.exe 41 PID 1432 wrote to memory of 2920 1432 xrxlxrx.exe 41 PID 1432 wrote to memory of 2920 1432 xrxlxrx.exe 41 PID 1432 wrote to memory of 2920 1432 xrxlxrx.exe 41 PID 2920 wrote to memory of 1720 2920 7flrxxx.exe 42 PID 2920 wrote to memory of 1720 2920 7flrxxx.exe 42 PID 2920 wrote to memory of 1720 2920 7flrxxx.exe 42 PID 2920 wrote to memory of 1720 2920 7flrxxx.exe 42 PID 1720 wrote to memory of 848 1720 htnntn.exe 43 PID 1720 wrote to memory of 848 1720 htnntn.exe 43 PID 1720 wrote to memory of 848 1720 htnntn.exe 43 PID 1720 wrote to memory of 848 1720 htnntn.exe 43 PID 848 wrote to memory of 272 848 bthbnt.exe 44 PID 848 wrote to memory of 272 848 bthbnt.exe 44 PID 848 wrote to memory of 272 848 bthbnt.exe 44 PID 848 wrote to memory of 272 848 bthbnt.exe 44 PID 272 wrote to memory of 1936 272 1pjjv.exe 45 PID 272 wrote to memory of 1936 272 1pjjv.exe 45 PID 272 wrote to memory of 1936 272 1pjjv.exe 45 PID 272 wrote to memory of 1936 272 1pjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe"C:\Users\Admin\AppData\Local\Temp\71565bc0d58b7a2e369988d935550f7ed32ef9a5cc221eff985a95903cdc3764N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vjjjp.exec:\vjjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9bhbhb.exec:\9bhbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\nhnntb.exec:\nhnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\3djdj.exec:\3djdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\1xrrrrr.exec:\1xrrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\3bnbbb.exec:\3bnbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vjvdj.exec:\vjvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\htnnbb.exec:\htnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jvjpv.exec:\jvjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xrxlxrx.exec:\xrxlxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\7flrxxx.exec:\7flrxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\htnntn.exec:\htnntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\bthbnt.exec:\bthbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\1pjjv.exec:\1pjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe17⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9rllxxf.exec:\9rllxxf.exe18⤵
- Executes dropped EXE
PID:844 -
\??\c:\bttnnn.exec:\bttnnn.exe19⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jddvv.exec:\jddvv.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9dvpd.exec:\9dvpd.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5flllrr.exec:\5flllrr.exe22⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1frfrxf.exec:\1frfrxf.exe23⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hhbbnh.exec:\hhbbnh.exe24⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tnnhht.exec:\tnnhht.exe25⤵
- Executes dropped EXE
PID:984 -
\??\c:\9jvvp.exec:\9jvvp.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe27⤵
- Executes dropped EXE
PID:572 -
\??\c:\hbntbh.exec:\hbntbh.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hnnhnn.exec:\hnnhnn.exe29⤵
- Executes dropped EXE
PID:1444 -
\??\c:\1dvvd.exec:\1dvvd.exe30⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xlxxlff.exec:\xlxxlff.exe31⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9tbhth.exec:\9tbhth.exe32⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7nbbhn.exec:\7nbbhn.exe33⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jdvdp.exec:\jdvdp.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxrxfxf.exec:\xxrxfxf.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lflffff.exec:\lflffff.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hthnbb.exec:\hthnbb.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3bhhnt.exec:\3bhhnt.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3jvdv.exec:\3jvdv.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dpdpp.exec:\dpdpp.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rllfrfl.exec:\rllfrfl.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3flrffl.exec:\3flrffl.exe42⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bnbbth.exec:\bnbbth.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btnntb.exec:\btnntb.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpvjp.exec:\vpvjp.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pdppp.exec:\pdppp.exe46⤵
- Executes dropped EXE
PID:1128 -
\??\c:\fxlxxxf.exec:\fxlxxxf.exe47⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1rffrxx.exec:\1rffrxx.exe48⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nnthbh.exec:\nnthbh.exe49⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tnthnt.exec:\tnthnt.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jdjjp.exec:\jdjjp.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdddj.exec:\pdddj.exe52⤵
- Executes dropped EXE
PID:1064 -
\??\c:\lflrfrx.exec:\lflrfrx.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5fllrrr.exec:\5fllrrr.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ttntbh.exec:\ttntbh.exe55⤵
- Executes dropped EXE
PID:1576 -
\??\c:\btntbt.exec:\btntbt.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvjpv.exec:\vvjpv.exe57⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jdvdj.exec:\jdvdj.exe58⤵
- Executes dropped EXE
PID:1072 -
\??\c:\fxflffl.exec:\fxflffl.exe59⤵
- Executes dropped EXE
PID:1380 -
\??\c:\5lrxflr.exec:\5lrxflr.exe60⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hbhntt.exec:\hbhntt.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\thhbht.exec:\thhbht.exe62⤵
- Executes dropped EXE
PID:2180 -
\??\c:\9pvpp.exec:\9pvpp.exe63⤵
- Executes dropped EXE
PID:1600 -
\??\c:\djpdd.exec:\djpdd.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xxllxfr.exec:\xxllxfr.exe65⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxflxxf.exec:\fxflxxf.exe66⤵PID:544
-
\??\c:\tnntbb.exec:\tnntbb.exe67⤵PID:2268
-
\??\c:\ththhb.exec:\ththhb.exe68⤵PID:876
-
\??\c:\jddvd.exec:\jddvd.exe69⤵PID:2188
-
\??\c:\jvdvd.exec:\jvdvd.exe70⤵PID:3016
-
\??\c:\fxllxfl.exec:\fxllxfl.exe71⤵PID:2564
-
\??\c:\fxflrfl.exec:\fxflrfl.exe72⤵PID:2412
-
\??\c:\nhbnbh.exec:\nhbnbh.exe73⤵PID:2560
-
\??\c:\bnbbhh.exec:\bnbbhh.exe74⤵PID:1908
-
\??\c:\dvjvd.exec:\dvjvd.exe75⤵PID:2068
-
\??\c:\7pvpj.exec:\7pvpj.exe76⤵PID:2900
-
\??\c:\lfllxxl.exec:\lfllxxl.exe77⤵PID:2876
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe78⤵PID:2888
-
\??\c:\hhbhbh.exec:\hhbhbh.exe79⤵PID:2788
-
\??\c:\5nhbbt.exec:\5nhbbt.exe80⤵PID:2756
-
\??\c:\9vjpp.exec:\9vjpp.exe81⤵PID:2732
-
\??\c:\vjvvd.exec:\vjvvd.exe82⤵PID:2332
-
\??\c:\9lrfxxf.exec:\9lrfxxf.exe83⤵PID:2704
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe84⤵PID:2648
-
\??\c:\5thhhb.exec:\5thhhb.exe85⤵PID:2164
-
\??\c:\5nhnhb.exec:\5nhnhb.exe86⤵PID:1980
-
\??\c:\jdvvp.exec:\jdvvp.exe87⤵PID:1432
-
\??\c:\7dpjp.exec:\7dpjp.exe88⤵PID:2956
-
\??\c:\xrflrrx.exec:\xrflrrx.exe89⤵PID:2372
-
\??\c:\7xrrxfl.exec:\7xrrxfl.exe90⤵PID:2408
-
\??\c:\nhnthh.exec:\nhnthh.exe91⤵PID:2944
-
\??\c:\ntbtth.exec:\ntbtth.exe92⤵PID:272
-
\??\c:\vvpvd.exec:\vvpvd.exe93⤵PID:1936
-
\??\c:\dpdpv.exec:\dpdpv.exe94⤵PID:2168
-
\??\c:\rlrxllf.exec:\rlrxllf.exe95⤵PID:2056
-
\??\c:\frxrxrx.exec:\frxrxrx.exe96⤵PID:2468
-
\??\c:\nhthhn.exec:\nhthhn.exe97⤵PID:2532
-
\??\c:\bnnthh.exec:\bnnthh.exe98⤵PID:1796
-
\??\c:\1thhnh.exec:\1thhnh.exe99⤵PID:3068
-
\??\c:\vpjpv.exec:\vpjpv.exe100⤵PID:796
-
\??\c:\3djpd.exec:\3djpd.exe101⤵PID:548
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe102⤵PID:340
-
\??\c:\tnbbhn.exec:\tnbbhn.exe103⤵PID:1728
-
\??\c:\hbnnbt.exec:\hbnnbt.exe104⤵PID:1704
-
\??\c:\htnhtt.exec:\htnhtt.exe105⤵PID:740
-
\??\c:\5dvjv.exec:\5dvjv.exe106⤵PID:1284
-
\??\c:\pjpvj.exec:\pjpvj.exe107⤵PID:2296
-
\??\c:\frllrrr.exec:\frllrrr.exe108⤵PID:2272
-
\??\c:\3fflllr.exec:\3fflllr.exe109⤵PID:1420
-
\??\c:\ntbhbb.exec:\ntbhbb.exe110⤵PID:2452
-
\??\c:\nnbtnn.exec:\nnbtnn.exe111⤵PID:2568
-
\??\c:\vpppd.exec:\vpppd.exe112⤵PID:2448
-
\??\c:\9dpdd.exec:\9dpdd.exe113⤵PID:2436
-
\??\c:\3lffffl.exec:\3lffffl.exe114⤵PID:2712
-
\??\c:\xlxxfxl.exec:\xlxxfxl.exe115⤵PID:2988
-
\??\c:\tnbnhh.exec:\tnbnhh.exe116⤵PID:2352
-
\??\c:\bbnnhn.exec:\bbnnhn.exe117⤵PID:2236
-
\??\c:\thbhtb.exec:\thbhtb.exe118⤵PID:2848
-
\??\c:\5jvdp.exec:\5jvdp.exe119⤵PID:2780
-
\??\c:\jdvvj.exec:\jdvvj.exe120⤵PID:2792
-
\??\c:\3lllllx.exec:\3lllllx.exe121⤵PID:2680
-
\??\c:\3rxlfrr.exec:\3rxlfrr.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-