Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe
Resource
win7-20240708-en
General
-
Target
0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe
-
Size
59KB
-
MD5
a50d0c8b93ee5501fdab131d957baec0
-
SHA1
c0c01a3bc75dabdb82bcccdf6a9a4c0c146aad67
-
SHA256
0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305
-
SHA512
f05de455f218ab8f2a92a5d18f7b6f6af9328de916cad4ea92e0724963c6dd8558e377be21b6272e13da9c28369789b13e25d90965eb64725e813fae9d9da4d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgTdx:ymb3NkkiQ3mdBjFIg/
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2052-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/396-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 396 rfffflr.exe 2280 9htthb.exe 2872 bnnttt.exe 2288 pdpjd.exe 2568 9dppv.exe 2728 btthnt.exe 2576 9btthn.exe 2480 xxffxrr.exe 2512 9fxllll.exe 2508 tnbnnn.exe 1532 7tbhnn.exe 1688 pjvvj.exe 1912 rflfxlf.exe 1660 xrlrrxr.exe 2008 httnnn.exe 2356 nhhhbt.exe 1804 dvdjd.exe 1556 pjvjp.exe 2520 xxxfxlf.exe 2900 3nhhnt.exe 2972 bnbttn.exe 2336 pjddp.exe 1420 jpvvd.exe 2320 1xllxxl.exe 1564 xflllff.exe 936 5nbhhh.exe 2284 tbhttt.exe 2180 pjddj.exe 1964 rfxfxxx.exe 1048 3fxxffl.exe 3056 5nthhb.exe 2228 bhbnhn.exe 1228 dppvp.exe 844 jvddv.exe 2808 1xlrlff.exe 2248 xllrxff.exe 2996 bnbttt.exe 1552 htnhhh.exe 2688 bnbtnh.exe 2612 jvjvd.exe 2820 pdjjj.exe 2660 lrxrlff.exe 2256 lxxrrxf.exe 2664 lfllrrr.exe 2472 thnhhn.exe 2272 5hhbtt.exe 2524 jdjvd.exe 1616 7jjjp.exe 2212 9xfxrlx.exe 276 frfxfrl.exe 1896 nbhnnh.exe 1972 bbnhbn.exe 2008 9tbtnb.exe 1812 5jvpj.exe 1588 jvjjj.exe 2444 lrlxxll.exe 2752 7xfrrrx.exe 1908 3bhbbt.exe 2912 hbhbhn.exe 2968 dpvdj.exe 2184 ddjjv.exe 1732 vdddd.exe 2168 lxxrlrf.exe 996 xrfrxlr.exe -
resource yara_rule behavioral1/memory/2052-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/396-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/396-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/396-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 396 2052 0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe 28 PID 2052 wrote to memory of 396 2052 0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe 28 PID 2052 wrote to memory of 396 2052 0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe 28 PID 2052 wrote to memory of 396 2052 0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe 28 PID 396 wrote to memory of 2280 396 rfffflr.exe 29 PID 396 wrote to memory of 2280 396 rfffflr.exe 29 PID 396 wrote to memory of 2280 396 rfffflr.exe 29 PID 396 wrote to memory of 2280 396 rfffflr.exe 29 PID 2280 wrote to memory of 2872 2280 9htthb.exe 30 PID 2280 wrote to memory of 2872 2280 9htthb.exe 30 PID 2280 wrote to memory of 2872 2280 9htthb.exe 30 PID 2280 wrote to memory of 2872 2280 9htthb.exe 30 PID 2872 wrote to memory of 2288 2872 bnnttt.exe 31 PID 2872 wrote to memory of 2288 2872 bnnttt.exe 31 PID 2872 wrote to memory of 2288 2872 bnnttt.exe 31 PID 2872 wrote to memory of 2288 2872 bnnttt.exe 31 PID 2288 wrote to memory of 2568 2288 pdpjd.exe 32 PID 2288 wrote to memory of 2568 2288 pdpjd.exe 32 PID 2288 wrote to memory of 2568 2288 pdpjd.exe 32 PID 2288 wrote to memory of 2568 2288 pdpjd.exe 32 PID 2568 wrote to memory of 2728 2568 9dppv.exe 33 PID 2568 wrote to memory of 2728 2568 9dppv.exe 33 PID 2568 wrote to memory of 2728 2568 9dppv.exe 33 PID 2568 wrote to memory of 2728 2568 9dppv.exe 33 PID 2728 wrote to memory of 2576 2728 btthnt.exe 34 PID 2728 wrote to memory of 2576 2728 btthnt.exe 34 PID 2728 wrote to memory of 2576 2728 btthnt.exe 34 PID 2728 wrote to memory of 2576 2728 btthnt.exe 34 PID 2576 wrote to memory of 2480 2576 9btthn.exe 35 PID 2576 wrote to memory of 2480 2576 9btthn.exe 35 PID 2576 wrote to memory of 2480 2576 9btthn.exe 35 PID 2576 wrote to memory of 2480 2576 9btthn.exe 35 PID 2480 wrote to memory of 2512 2480 xxffxrr.exe 36 PID 2480 wrote to memory of 2512 2480 xxffxrr.exe 36 PID 2480 wrote to memory of 2512 2480 xxffxrr.exe 36 PID 2480 wrote to memory of 2512 2480 xxffxrr.exe 36 PID 2512 wrote to memory of 2508 2512 9fxllll.exe 37 PID 2512 wrote to memory of 2508 2512 9fxllll.exe 37 PID 2512 wrote to memory of 2508 2512 9fxllll.exe 37 PID 2512 wrote to memory of 2508 2512 9fxllll.exe 37 PID 2508 wrote to memory of 1532 2508 tnbnnn.exe 38 PID 2508 wrote to memory of 1532 2508 tnbnnn.exe 38 PID 2508 wrote to memory of 1532 2508 tnbnnn.exe 38 PID 2508 wrote to memory of 1532 2508 tnbnnn.exe 38 PID 1532 wrote to memory of 1688 1532 7tbhnn.exe 39 PID 1532 wrote to memory of 1688 1532 7tbhnn.exe 39 PID 1532 wrote to memory of 1688 1532 7tbhnn.exe 39 PID 1532 wrote to memory of 1688 1532 7tbhnn.exe 39 PID 1688 wrote to memory of 1912 1688 pjvvj.exe 40 PID 1688 wrote to memory of 1912 1688 pjvvj.exe 40 PID 1688 wrote to memory of 1912 1688 pjvvj.exe 40 PID 1688 wrote to memory of 1912 1688 pjvvj.exe 40 PID 1912 wrote to memory of 1660 1912 rflfxlf.exe 41 PID 1912 wrote to memory of 1660 1912 rflfxlf.exe 41 PID 1912 wrote to memory of 1660 1912 rflfxlf.exe 41 PID 1912 wrote to memory of 1660 1912 rflfxlf.exe 41 PID 1660 wrote to memory of 2008 1660 xrlrrxr.exe 42 PID 1660 wrote to memory of 2008 1660 xrlrrxr.exe 42 PID 1660 wrote to memory of 2008 1660 xrlrrxr.exe 42 PID 1660 wrote to memory of 2008 1660 xrlrrxr.exe 42 PID 2008 wrote to memory of 2356 2008 httnnn.exe 43 PID 2008 wrote to memory of 2356 2008 httnnn.exe 43 PID 2008 wrote to memory of 2356 2008 httnnn.exe 43 PID 2008 wrote to memory of 2356 2008 httnnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe"C:\Users\Admin\AppData\Local\Temp\0d1ec1b806cc1742419653d61dcf4de5d03cc548ca0eac9190c8a60f3bea8305N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rfffflr.exec:\rfffflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\9htthb.exec:\9htthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bnnttt.exec:\bnnttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\pdpjd.exec:\pdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\9dppv.exec:\9dppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\btthnt.exec:\btthnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9btthn.exec:\9btthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\xxffxrr.exec:\xxffxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\9fxllll.exec:\9fxllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\tnbnnn.exec:\tnbnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\7tbhnn.exec:\7tbhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\pjvvj.exec:\pjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\rflfxlf.exec:\rflfxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\xrlrrxr.exec:\xrlrrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\httnnn.exec:\httnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\nhhhbt.exec:\nhhhbt.exe17⤵
- Executes dropped EXE
PID:2356 -
\??\c:\dvdjd.exec:\dvdjd.exe18⤵
- Executes dropped EXE
PID:1804 -
\??\c:\pjvjp.exec:\pjvjp.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xxxfxlf.exec:\xxxfxlf.exe20⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3nhhnt.exec:\3nhhnt.exe21⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bnbttn.exec:\bnbttn.exe22⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pjddp.exec:\pjddp.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jpvvd.exec:\jpvvd.exe24⤵
- Executes dropped EXE
PID:1420 -
\??\c:\1xllxxl.exec:\1xllxxl.exe25⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xflllff.exec:\xflllff.exe26⤵
- Executes dropped EXE
PID:1564 -
\??\c:\5nbhhh.exec:\5nbhhh.exe27⤵
- Executes dropped EXE
PID:936 -
\??\c:\tbhttt.exec:\tbhttt.exe28⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pjddj.exec:\pjddj.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rfxfxxx.exec:\rfxfxxx.exe30⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3fxxffl.exec:\3fxxffl.exe31⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5nthhb.exec:\5nthhb.exe32⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bhbnhn.exec:\bhbnhn.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dppvp.exec:\dppvp.exe34⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jvddv.exec:\jvddv.exe35⤵
- Executes dropped EXE
PID:844 -
\??\c:\1xlrlff.exec:\1xlrlff.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xllrxff.exec:\xllrxff.exe37⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bnbttt.exec:\bnbttt.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\htnhhh.exec:\htnhhh.exe39⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bnbtnh.exec:\bnbtnh.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jvjvd.exec:\jvjvd.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pdjjj.exec:\pdjjj.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lrxrlff.exec:\lrxrlff.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lxxrrxf.exec:\lxxrrxf.exe44⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lfllrrr.exec:\lfllrrr.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\thnhhn.exec:\thnhhn.exe46⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5hhbtt.exec:\5hhbtt.exe47⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jdjvd.exec:\jdjvd.exe48⤵
- Executes dropped EXE
PID:2524 -
\??\c:\7jjjp.exec:\7jjjp.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9xfxrlx.exec:\9xfxrlx.exe50⤵
- Executes dropped EXE
PID:2212 -
\??\c:\frfxfrl.exec:\frfxfrl.exe51⤵
- Executes dropped EXE
PID:276 -
\??\c:\nbhnnh.exec:\nbhnnh.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bbnhbn.exec:\bbnhbn.exe53⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9tbtnb.exec:\9tbtnb.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5jvpj.exec:\5jvpj.exe55⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jvjjj.exec:\jvjjj.exe56⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lrlxxll.exec:\lrlxxll.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7xfrrrx.exec:\7xfrrrx.exe58⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3bhbbt.exec:\3bhbbt.exe59⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hbhbhn.exec:\hbhbhn.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dpvdj.exec:\dpvdj.exe61⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddjjv.exec:\ddjjv.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vdddd.exec:\vdddd.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxxrlrf.exec:\lxxrlrf.exe64⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrfrxlr.exec:\xrfrxlr.exe65⤵
- Executes dropped EXE
PID:996 -
\??\c:\bnnnbt.exec:\bnnnbt.exe66⤵PID:2340
-
\??\c:\thhbnn.exec:\thhbnn.exe67⤵PID:2440
-
\??\c:\vjpjd.exec:\vjpjd.exe68⤵PID:2172
-
\??\c:\pjvjp.exec:\pjvjp.exe69⤵PID:1320
-
\??\c:\lxfxrll.exec:\lxfxrll.exe70⤵PID:2836
-
\??\c:\xrflrrx.exec:\xrflrrx.exe71⤵PID:1452
-
\??\c:\frxlfxr.exec:\frxlfxr.exe72⤵PID:1048
-
\??\c:\nbhhnh.exec:\nbhhnh.exe73⤵PID:2136
-
\??\c:\vpddd.exec:\vpddd.exe74⤵PID:1664
-
\??\c:\xlrxxrl.exec:\xlrxxrl.exe75⤵PID:2896
-
\??\c:\rllffxf.exec:\rllffxf.exe76⤵PID:3064
-
\??\c:\nbbnnh.exec:\nbbnnh.exe77⤵PID:844
-
\??\c:\nbbbtt.exec:\nbbbtt.exe78⤵PID:1536
-
\??\c:\1jpjj.exec:\1jpjj.exe79⤵PID:1540
-
\??\c:\dvjvj.exec:\dvjvj.exe80⤵PID:1652
-
\??\c:\3frrxrx.exec:\3frrxrx.exe81⤵PID:2720
-
\??\c:\xrxlxxf.exec:\xrxlxxf.exe82⤵PID:2584
-
\??\c:\lxflxxx.exec:\lxflxxx.exe83⤵PID:2332
-
\??\c:\bbtbnn.exec:\bbtbnn.exe84⤵PID:2692
-
\??\c:\bntbbh.exec:\bntbbh.exe85⤵PID:2596
-
\??\c:\dpvpp.exec:\dpvpp.exe86⤵PID:2456
-
\??\c:\dpjdj.exec:\dpjdj.exe87⤵PID:2500
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe88⤵PID:2988
-
\??\c:\fxllrxf.exec:\fxllrxf.exe89⤵PID:1456
-
\??\c:\rlxxfff.exec:\rlxxfff.exe90⤵PID:2240
-
\??\c:\bbbnbt.exec:\bbbnbt.exe91⤵PID:1648
-
\??\c:\dvjvp.exec:\dvjvp.exe92⤵PID:1656
-
\??\c:\jddjp.exec:\jddjp.exe93⤵PID:1644
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe94⤵PID:1960
-
\??\c:\rlffflr.exec:\rlffflr.exe95⤵PID:1720
-
\??\c:\frxffxf.exec:\frxffxf.exe96⤵PID:2008
-
\??\c:\bnbhtt.exec:\bnbhtt.exe97⤵PID:2744
-
\??\c:\tbnbbt.exec:\tbnbbt.exe98⤵PID:1844
-
\??\c:\jjvjp.exec:\jjvjp.exe99⤵PID:2908
-
\??\c:\dvddj.exec:\dvddj.exe100⤵PID:2952
-
\??\c:\rllrrxf.exec:\rllrrxf.exe101⤵PID:2788
-
\??\c:\3fxfrrr.exec:\3fxfrrr.exe102⤵PID:692
-
\??\c:\lfrfrrx.exec:\lfrfrrx.exe103⤵PID:1436
-
\??\c:\nhthnn.exec:\nhthnn.exe104⤵PID:2348
-
\??\c:\pjppp.exec:\pjppp.exe105⤵PID:1472
-
\??\c:\djdjd.exec:\djdjd.exe106⤵PID:2748
-
\??\c:\jvddp.exec:\jvddp.exe107⤵PID:1580
-
\??\c:\lrlrlfx.exec:\lrlrlfx.exe108⤵PID:2080
-
\??\c:\lfrfrrx.exec:\lfrfrrx.exe109⤵PID:328
-
\??\c:\1httbt.exec:\1httbt.exe110⤵PID:3012
-
\??\c:\7tnhtt.exec:\7tnhtt.exe111⤵PID:2152
-
\??\c:\vpjvd.exec:\vpjvd.exe112⤵PID:1028
-
\??\c:\5pppp.exec:\5pppp.exe113⤵PID:3040
-
\??\c:\jvpvv.exec:\jvpvv.exe114⤵PID:3044
-
\??\c:\xrlrffl.exec:\xrlrffl.exe115⤵PID:1696
-
\??\c:\7xllxfr.exec:\7xllxfr.exe116⤵PID:2132
-
\??\c:\tnhnbb.exec:\tnhnbb.exe117⤵PID:2868
-
\??\c:\5htbnn.exec:\5htbnn.exe118⤵PID:2980
-
\??\c:\hhbbhh.exec:\hhbbhh.exe119⤵PID:2236
-
\??\c:\vpddd.exec:\vpddd.exe120⤵PID:1528
-
\??\c:\1jddj.exec:\1jddj.exe121⤵PID:1544
-
\??\c:\xrxfrlr.exec:\xrxfrlr.exe122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-