Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe
Resource
win7-20240729-en
General
-
Target
899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe
-
Size
82KB
-
MD5
f4f8241fc9d81bfd489ebead911bd6bb
-
SHA1
33500321b4f7a3fa6d059f6df286434dac12320f
-
SHA256
899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106
-
SHA512
dc09e95e0a13011ad9255c39f5ea1ee6abf6a10072b520990f77b2bd108c89e04fc62e35f489acb72469d4ef568e03314fafea261223629d08b6c17ec33757a5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q1:ymb3NkkiQ3mdBjFIIp9L9QrrA82
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1832-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1832 btttbb.exe 2712 pjpvj.exe 2960 tnhhtb.exe 2944 pddpv.exe 2912 fxflrrx.exe 2776 hhhthn.exe 2768 7pppd.exe 2232 xrrxllr.exe 2068 nhhhnn.exe 2448 pvjpj.exe 2268 7fxfxfl.exe 2492 rxfxxrf.exe 2792 3tbhtt.exe 1060 ddvjd.exe 1100 rlxlrrf.exe 340 1bnbth.exe 2024 nbtnnb.exe 1648 9jvvj.exe 2164 3rrfxlr.exe 2208 xxrfllf.exe 1164 nntnhb.exe 936 jjvvj.exe 1096 fffxlfx.exe 1200 ntthth.exe 2400 vpjpp.exe 1788 jdpdj.exe 540 bbtbnn.exe 2320 tttbtt.exe 1684 dvpdp.exe 2988 9fxlrxf.exe 704 7rxlxlr.exe 1704 bntnnt.exe 2808 vvvjd.exe 2868 pvvdp.exe 2728 3lxxlxr.exe 2860 9httbh.exe 2628 bbbnbn.exe 2652 fxxfrxf.exe 2616 bbnnbn.exe 1092 nhbbhn.exe 2768 5vjvj.exe 2088 5lrrffr.exe 2872 fxfxfrf.exe 1984 5ttbhh.exe 2452 tthttb.exe 2416 7vvjd.exe 2268 dvdjp.exe 1556 lffxfff.exe 844 7hbnnn.exe 956 nhbhtb.exe 2052 vpdjj.exe 500 jdjjv.exe 2040 5fflrxf.exe 2024 9nhhnn.exe 1580 3btnbb.exe 2228 1jdvv.exe 2396 jdpvd.exe 1696 xrflrxl.exe 2280 xfrxflr.exe 1964 thnnnt.exe 684 vvjjv.exe 1808 ddjvp.exe 2424 rlrfrxl.exe 1800 frlrrxf.exe -
resource yara_rule behavioral1/memory/2544-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-306-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1832 2544 899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe 29 PID 2544 wrote to memory of 1832 2544 899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe 29 PID 2544 wrote to memory of 1832 2544 899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe 29 PID 2544 wrote to memory of 1832 2544 899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe 29 PID 1832 wrote to memory of 2712 1832 btttbb.exe 30 PID 1832 wrote to memory of 2712 1832 btttbb.exe 30 PID 1832 wrote to memory of 2712 1832 btttbb.exe 30 PID 1832 wrote to memory of 2712 1832 btttbb.exe 30 PID 2712 wrote to memory of 2960 2712 pjpvj.exe 31 PID 2712 wrote to memory of 2960 2712 pjpvj.exe 31 PID 2712 wrote to memory of 2960 2712 pjpvj.exe 31 PID 2712 wrote to memory of 2960 2712 pjpvj.exe 31 PID 2960 wrote to memory of 2944 2960 tnhhtb.exe 32 PID 2960 wrote to memory of 2944 2960 tnhhtb.exe 32 PID 2960 wrote to memory of 2944 2960 tnhhtb.exe 32 PID 2960 wrote to memory of 2944 2960 tnhhtb.exe 32 PID 2944 wrote to memory of 2912 2944 pddpv.exe 33 PID 2944 wrote to memory of 2912 2944 pddpv.exe 33 PID 2944 wrote to memory of 2912 2944 pddpv.exe 33 PID 2944 wrote to memory of 2912 2944 pddpv.exe 33 PID 2912 wrote to memory of 2776 2912 fxflrrx.exe 34 PID 2912 wrote to memory of 2776 2912 fxflrrx.exe 34 PID 2912 wrote to memory of 2776 2912 fxflrrx.exe 34 PID 2912 wrote to memory of 2776 2912 fxflrrx.exe 34 PID 2776 wrote to memory of 2768 2776 hhhthn.exe 35 PID 2776 wrote to memory of 2768 2776 hhhthn.exe 35 PID 2776 wrote to memory of 2768 2776 hhhthn.exe 35 PID 2776 wrote to memory of 2768 2776 hhhthn.exe 35 PID 2768 wrote to memory of 2232 2768 7pppd.exe 36 PID 2768 wrote to memory of 2232 2768 7pppd.exe 36 PID 2768 wrote to memory of 2232 2768 7pppd.exe 36 PID 2768 wrote to memory of 2232 2768 7pppd.exe 36 PID 2232 wrote to memory of 2068 2232 xrrxllr.exe 37 PID 2232 wrote to memory of 2068 2232 xrrxllr.exe 37 PID 2232 wrote to memory of 2068 2232 xrrxllr.exe 37 PID 2232 wrote to memory of 2068 2232 xrrxllr.exe 37 PID 2068 wrote to memory of 2448 2068 nhhhnn.exe 38 PID 2068 wrote to memory of 2448 2068 nhhhnn.exe 38 PID 2068 wrote to memory of 2448 2068 nhhhnn.exe 38 PID 2068 wrote to memory of 2448 2068 nhhhnn.exe 38 PID 2448 wrote to memory of 2268 2448 pvjpj.exe 39 PID 2448 wrote to memory of 2268 2448 pvjpj.exe 39 PID 2448 wrote to memory of 2268 2448 pvjpj.exe 39 PID 2448 wrote to memory of 2268 2448 pvjpj.exe 39 PID 2268 wrote to memory of 2492 2268 7fxfxfl.exe 40 PID 2268 wrote to memory of 2492 2268 7fxfxfl.exe 40 PID 2268 wrote to memory of 2492 2268 7fxfxfl.exe 40 PID 2268 wrote to memory of 2492 2268 7fxfxfl.exe 40 PID 2492 wrote to memory of 2792 2492 rxfxxrf.exe 41 PID 2492 wrote to memory of 2792 2492 rxfxxrf.exe 41 PID 2492 wrote to memory of 2792 2492 rxfxxrf.exe 41 PID 2492 wrote to memory of 2792 2492 rxfxxrf.exe 41 PID 2792 wrote to memory of 1060 2792 3tbhtt.exe 42 PID 2792 wrote to memory of 1060 2792 3tbhtt.exe 42 PID 2792 wrote to memory of 1060 2792 3tbhtt.exe 42 PID 2792 wrote to memory of 1060 2792 3tbhtt.exe 42 PID 1060 wrote to memory of 1100 1060 ddvjd.exe 43 PID 1060 wrote to memory of 1100 1060 ddvjd.exe 43 PID 1060 wrote to memory of 1100 1060 ddvjd.exe 43 PID 1060 wrote to memory of 1100 1060 ddvjd.exe 43 PID 1100 wrote to memory of 340 1100 rlxlrrf.exe 44 PID 1100 wrote to memory of 340 1100 rlxlrrf.exe 44 PID 1100 wrote to memory of 340 1100 rlxlrrf.exe 44 PID 1100 wrote to memory of 340 1100 rlxlrrf.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe"C:\Users\Admin\AppData\Local\Temp\899fc589a4a7c023e7497fe780629e6f9e04b3bd01bd2425179ce011894d5106.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\btttbb.exec:\btttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\pjpvj.exec:\pjpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\tnhhtb.exec:\tnhhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\pddpv.exec:\pddpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\fxflrrx.exec:\fxflrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hhhthn.exec:\hhhthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7pppd.exec:\7pppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xrrxllr.exec:\xrrxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\nhhhnn.exec:\nhhhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\pvjpj.exec:\pvjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\7fxfxfl.exec:\7fxfxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\rxfxxrf.exec:\rxfxxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\3tbhtt.exec:\3tbhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ddvjd.exec:\ddvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\1bnbth.exec:\1bnbth.exe17⤵
- Executes dropped EXE
PID:340 -
\??\c:\nbtnnb.exec:\nbtnnb.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9jvvj.exec:\9jvvj.exe19⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3rrfxlr.exec:\3rrfxlr.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxrfllf.exec:\xxrfllf.exe21⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nntnhb.exec:\nntnhb.exe22⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jjvvj.exec:\jjvvj.exe23⤵
- Executes dropped EXE
PID:936 -
\??\c:\fffxlfx.exec:\fffxlfx.exe24⤵
- Executes dropped EXE
PID:1096 -
\??\c:\ntthth.exec:\ntthth.exe25⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vpjpp.exec:\vpjpp.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jdpdj.exec:\jdpdj.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bbtbnn.exec:\bbtbnn.exe28⤵
- Executes dropped EXE
PID:540 -
\??\c:\tttbtt.exec:\tttbtt.exe29⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dvpdp.exec:\dvpdp.exe30⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9fxlrxf.exec:\9fxlrxf.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7rxlxlr.exec:\7rxlxlr.exe32⤵
- Executes dropped EXE
PID:704 -
\??\c:\bntnnt.exec:\bntnnt.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vvvjd.exec:\vvvjd.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pvvdp.exec:\pvvdp.exe35⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3lxxlxr.exec:\3lxxlxr.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9httbh.exec:\9httbh.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bbbnbn.exec:\bbbnbn.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bbnnbn.exec:\bbnnbn.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nhbbhn.exec:\nhbbhn.exe41⤵
- Executes dropped EXE
PID:1092 -
\??\c:\5vjvj.exec:\5vjvj.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5lrrffr.exec:\5lrrffr.exe43⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fxfxfrf.exec:\fxfxfrf.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5ttbhh.exec:\5ttbhh.exe45⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tthttb.exec:\tthttb.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7vvjd.exec:\7vvjd.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dvdjp.exec:\dvdjp.exe48⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lffxfff.exec:\lffxfff.exe49⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7hbnnn.exec:\7hbnnn.exe50⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhbhtb.exec:\nhbhtb.exe51⤵
- Executes dropped EXE
PID:956 -
\??\c:\vpdjj.exec:\vpdjj.exe52⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jdjjv.exec:\jdjjv.exe53⤵
- Executes dropped EXE
PID:500 -
\??\c:\5fflrxf.exec:\5fflrxf.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9nhhnn.exec:\9nhhnn.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3btnbb.exec:\3btnbb.exe56⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1jdvv.exec:\1jdvv.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jdpvd.exec:\jdpvd.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrflrxl.exec:\xrflrxl.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xfrxflr.exec:\xfrxflr.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\thnnnt.exec:\thnnnt.exe61⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvjjv.exec:\vvjjv.exe62⤵
- Executes dropped EXE
PID:684 -
\??\c:\ddjvp.exec:\ddjvp.exe63⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe64⤵
- Executes dropped EXE
PID:2424 -
\??\c:\frlrrxf.exec:\frlrrxf.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hhbhtt.exec:\hhbhtt.exe66⤵PID:1916
-
\??\c:\hbnbbb.exec:\hbnbbb.exe67⤵PID:3056
-
\??\c:\vdppp.exec:\vdppp.exe68⤵PID:2328
-
\??\c:\lllxfrf.exec:\lllxfrf.exe69⤵PID:896
-
\??\c:\9lxllrf.exec:\9lxllrf.exe70⤵PID:2992
-
\??\c:\nnnhth.exec:\nnnhth.exe71⤵PID:2732
-
\??\c:\ddvdj.exec:\ddvdj.exe72⤵PID:1592
-
\??\c:\vvvjp.exec:\vvvjp.exe73⤵PID:1600
-
\??\c:\ffxflll.exec:\ffxflll.exe74⤵PID:2300
-
\??\c:\rllxllf.exec:\rllxllf.exe75⤵PID:2712
-
\??\c:\bbtbhb.exec:\bbtbhb.exe76⤵PID:2764
-
\??\c:\1thnbh.exec:\1thnbh.exe77⤵PID:1928
-
\??\c:\vvpvj.exec:\vvpvj.exe78⤵PID:2740
-
\??\c:\rllrxll.exec:\rllrxll.exe79⤵PID:2912
-
\??\c:\3flrlxl.exec:\3flrlxl.exe80⤵PID:1616
-
\??\c:\nhhnnn.exec:\nhhnnn.exe81⤵PID:2668
-
\??\c:\tbbbnh.exec:\tbbbnh.exe82⤵PID:2224
-
\??\c:\vdjdj.exec:\vdjdj.exe83⤵PID:2576
-
\??\c:\ffxxxlr.exec:\ffxxxlr.exe84⤵PID:2072
-
\??\c:\fxlxflx.exec:\fxlxflx.exe85⤵PID:2840
-
\??\c:\5nhbhn.exec:\5nhbhn.exe86⤵PID:1984
-
\??\c:\nnhnhh.exec:\nnhnhh.exe87⤵PID:2672
-
\??\c:\vvpvd.exec:\vvpvd.exe88⤵PID:2908
-
\??\c:\jjdvv.exec:\jjdvv.exe89⤵PID:2644
-
\??\c:\rrflrrf.exec:\rrflrrf.exe90⤵PID:1484
-
\??\c:\rllxflf.exec:\rllxflf.exe91⤵PID:2904
-
\??\c:\3nhnhb.exec:\3nhnhb.exe92⤵PID:2488
-
\??\c:\hbhhhh.exec:\hbhhhh.exe93⤵PID:1872
-
\??\c:\pppvj.exec:\pppvj.exe94⤵PID:2000
-
\??\c:\vvjjv.exec:\vvjjv.exe95⤵PID:1352
-
\??\c:\xxrrflx.exec:\xxrrflx.exe96⤵PID:1648
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe97⤵PID:2332
-
\??\c:\hbbhhn.exec:\hbbhhn.exe98⤵PID:2384
-
\??\c:\5bntbh.exec:\5bntbh.exe99⤵PID:1012
-
\??\c:\vvpjd.exec:\vvpjd.exe100⤵PID:620
-
\??\c:\dvpdp.exec:\dvpdp.exe101⤵PID:2112
-
\??\c:\1xrfrxl.exec:\1xrfrxl.exe102⤵PID:1096
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe103⤵PID:488
-
\??\c:\5tthnb.exec:\5tthnb.exe104⤵PID:2408
-
\??\c:\hhnhtt.exec:\hhnhtt.exe105⤵PID:1288
-
\??\c:\1dddv.exec:\1dddv.exe106⤵PID:1656
-
\??\c:\rllrxff.exec:\rllrxff.exe107⤵PID:1700
-
\??\c:\5xfrrfx.exec:\5xfrrfx.exe108⤵PID:2324
-
\??\c:\7bbtbn.exec:\7bbtbn.exe109⤵PID:1256
-
\??\c:\5htnnt.exec:\5htnnt.exe110⤵PID:2684
-
\??\c:\dvjpp.exec:\dvjpp.exe111⤵PID:2988
-
\??\c:\pjpjd.exec:\pjpjd.exe112⤵PID:1572
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe113⤵PID:2244
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe114⤵PID:2816
-
\??\c:\hbhnbb.exec:\hbhnbb.exe115⤵PID:1388
-
\??\c:\3tbhtb.exec:\3tbhtb.exe116⤵PID:2960
-
\??\c:\jdvpd.exec:\jdvpd.exe117⤵PID:2832
-
\??\c:\jdjpd.exec:\jdjpd.exe118⤵PID:2800
-
\??\c:\rlrrxlr.exec:\rlrrxlr.exe119⤵PID:2916
-
\??\c:\rrlxflx.exec:\rrlxflx.exe120⤵PID:2724
-
\??\c:\nnbnbh.exec:\nnbnbh.exe121⤵PID:3032
-
\??\c:\7jppd.exec:\7jppd.exe122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-