Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe
Resource
win7-20240903-en
General
-
Target
138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe
-
Size
71KB
-
MD5
a9a021d58ca4d986043a6f294e5c6540
-
SHA1
4c90fbd0e006777e408762a02da2adf0601a8f6d
-
SHA256
138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907ca
-
SHA512
ba73e7a01230c229039ae9c8bc9ce8ebf618cc2c84f59800c88e5238ab5f59024cc651b6f69eb3097906f684816e3a581a3c96fa4f03e672ed216b421a01e205
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjD:ymb3NkkiQ3mdBjFI4VT
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/1708-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2164 1fflxlf.exe 2428 nnhnhn.exe 2752 ffrrxxx.exe 3068 nnbntb.exe 2896 1pjdp.exe 2880 lxxrlxf.exe 2780 tnhnbn.exe 1152 jjddd.exe 1312 lfrfrrf.exe 1956 llxlfff.exe 1444 nhthbt.exe 2800 vppvd.exe 3016 pdppv.exe 2944 xlrrrrf.exe 1728 btnbnt.exe 1740 ddvvp.exe 3040 lfxllrf.exe 2140 1xlrrxf.exe 2196 thtthb.exe 1660 dvpvd.exe 2588 1flxrrl.exe 1980 1bnbtb.exe 1372 dpdjp.exe 1752 dddjv.exe 604 xrxxxff.exe 1836 tnhhnt.exe 2544 rlfxxrf.exe 1748 rlfrrlr.exe 1688 hbttbb.exe 2308 dvppp.exe 1896 vvvjv.exe 2180 lxrxflr.exe 2756 5hnbth.exe 2032 pvjpj.exe 2856 jvvvj.exe 3068 lxlffxx.exe 2896 7hbtbb.exe 2656 7nhbhh.exe 2880 pjddd.exe 1176 dvjjj.exe 1032 frxxrrl.exe 608 bhthht.exe 1380 hbnbhb.exe 1548 pjpvv.exe 2948 ppjjp.exe 2828 9lflrxf.exe 1972 3frrfxf.exe 1500 nhntbt.exe 2904 tnbttn.exe 2460 dpddj.exe 3012 dvpvj.exe 768 xlxxxrr.exe 2520 bthtbb.exe 2140 hnnbnt.exe 1052 1jjdp.exe 824 jppjd.exe 772 7rflllf.exe 952 hhbthn.exe 760 thbbbh.exe 2064 httbhh.exe 2688 pjvpv.exe 1992 dddjd.exe 2476 rfxfllx.exe 3064 xflrflx.exe -
resource yara_rule behavioral1/memory/1708-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2164 1708 138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe 31 PID 1708 wrote to memory of 2164 1708 138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe 31 PID 1708 wrote to memory of 2164 1708 138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe 31 PID 1708 wrote to memory of 2164 1708 138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe 31 PID 2164 wrote to memory of 2428 2164 1fflxlf.exe 32 PID 2164 wrote to memory of 2428 2164 1fflxlf.exe 32 PID 2164 wrote to memory of 2428 2164 1fflxlf.exe 32 PID 2164 wrote to memory of 2428 2164 1fflxlf.exe 32 PID 2428 wrote to memory of 2752 2428 nnhnhn.exe 33 PID 2428 wrote to memory of 2752 2428 nnhnhn.exe 33 PID 2428 wrote to memory of 2752 2428 nnhnhn.exe 33 PID 2428 wrote to memory of 2752 2428 nnhnhn.exe 33 PID 2752 wrote to memory of 3068 2752 ffrrxxx.exe 34 PID 2752 wrote to memory of 3068 2752 ffrrxxx.exe 34 PID 2752 wrote to memory of 3068 2752 ffrrxxx.exe 34 PID 2752 wrote to memory of 3068 2752 ffrrxxx.exe 34 PID 3068 wrote to memory of 2896 3068 nnbntb.exe 35 PID 3068 wrote to memory of 2896 3068 nnbntb.exe 35 PID 3068 wrote to memory of 2896 3068 nnbntb.exe 35 PID 3068 wrote to memory of 2896 3068 nnbntb.exe 35 PID 2896 wrote to memory of 2880 2896 1pjdp.exe 36 PID 2896 wrote to memory of 2880 2896 1pjdp.exe 36 PID 2896 wrote to memory of 2880 2896 1pjdp.exe 36 PID 2896 wrote to memory of 2880 2896 1pjdp.exe 36 PID 2880 wrote to memory of 2780 2880 lxxrlxf.exe 37 PID 2880 wrote to memory of 2780 2880 lxxrlxf.exe 37 PID 2880 wrote to memory of 2780 2880 lxxrlxf.exe 37 PID 2880 wrote to memory of 2780 2880 lxxrlxf.exe 37 PID 2780 wrote to memory of 1152 2780 tnhnbn.exe 38 PID 2780 wrote to memory of 1152 2780 tnhnbn.exe 38 PID 2780 wrote to memory of 1152 2780 tnhnbn.exe 38 PID 2780 wrote to memory of 1152 2780 tnhnbn.exe 38 PID 1152 wrote to memory of 1312 1152 jjddd.exe 39 PID 1152 wrote to memory of 1312 1152 jjddd.exe 39 PID 1152 wrote to memory of 1312 1152 jjddd.exe 39 PID 1152 wrote to memory of 1312 1152 jjddd.exe 39 PID 1312 wrote to memory of 1956 1312 lfrfrrf.exe 40 PID 1312 wrote to memory of 1956 1312 lfrfrrf.exe 40 PID 1312 wrote to memory of 1956 1312 lfrfrrf.exe 40 PID 1312 wrote to memory of 1956 1312 lfrfrrf.exe 40 PID 1956 wrote to memory of 1444 1956 llxlfff.exe 41 PID 1956 wrote to memory of 1444 1956 llxlfff.exe 41 PID 1956 wrote to memory of 1444 1956 llxlfff.exe 41 PID 1956 wrote to memory of 1444 1956 llxlfff.exe 41 PID 1444 wrote to memory of 2800 1444 nhthbt.exe 42 PID 1444 wrote to memory of 2800 1444 nhthbt.exe 42 PID 1444 wrote to memory of 2800 1444 nhthbt.exe 42 PID 1444 wrote to memory of 2800 1444 nhthbt.exe 42 PID 2800 wrote to memory of 3016 2800 vppvd.exe 43 PID 2800 wrote to memory of 3016 2800 vppvd.exe 43 PID 2800 wrote to memory of 3016 2800 vppvd.exe 43 PID 2800 wrote to memory of 3016 2800 vppvd.exe 43 PID 3016 wrote to memory of 2944 3016 pdppv.exe 44 PID 3016 wrote to memory of 2944 3016 pdppv.exe 44 PID 3016 wrote to memory of 2944 3016 pdppv.exe 44 PID 3016 wrote to memory of 2944 3016 pdppv.exe 44 PID 2944 wrote to memory of 1728 2944 xlrrrrf.exe 45 PID 2944 wrote to memory of 1728 2944 xlrrrrf.exe 45 PID 2944 wrote to memory of 1728 2944 xlrrrrf.exe 45 PID 2944 wrote to memory of 1728 2944 xlrrrrf.exe 45 PID 1728 wrote to memory of 1740 1728 btnbnt.exe 46 PID 1728 wrote to memory of 1740 1728 btnbnt.exe 46 PID 1728 wrote to memory of 1740 1728 btnbnt.exe 46 PID 1728 wrote to memory of 1740 1728 btnbnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe"C:\Users\Admin\AppData\Local\Temp\138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\1fflxlf.exec:\1fflxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\nnhnhn.exec:\nnhnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\nnbntb.exec:\nnbntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\1pjdp.exec:\1pjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lxxrlxf.exec:\lxxrlxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tnhnbn.exec:\tnhnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jjddd.exec:\jjddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\llxlfff.exec:\llxlfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\nhthbt.exec:\nhthbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\vppvd.exec:\vppvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\pdppv.exec:\pdppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\btnbnt.exec:\btnbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ddvvp.exec:\ddvvp.exe17⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lfxllrf.exec:\lfxllrf.exe18⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1xlrrxf.exec:\1xlrrxf.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\thtthb.exec:\thtthb.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dvpvd.exec:\dvpvd.exe21⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1flxrrl.exec:\1flxrrl.exe22⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1bnbtb.exec:\1bnbtb.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dpdjp.exec:\dpdjp.exe24⤵
- Executes dropped EXE
PID:1372 -
\??\c:\dddjv.exec:\dddjv.exe25⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xrxxxff.exec:\xrxxxff.exe26⤵
- Executes dropped EXE
PID:604 -
\??\c:\tnhhnt.exec:\tnhhnt.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rlfxxrf.exec:\rlfxxrf.exe28⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rlfrrlr.exec:\rlfrrlr.exe29⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hbttbb.exec:\hbttbb.exe30⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dvppp.exec:\dvppp.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vvvjv.exec:\vvvjv.exe32⤵
- Executes dropped EXE
PID:1896 -
\??\c:\lxrxflr.exec:\lxrxflr.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5hnbth.exec:\5hnbth.exe34⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pvjpj.exec:\pvjpj.exe35⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvvvj.exec:\jvvvj.exe36⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lxlffxx.exec:\lxlffxx.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\7hbtbb.exec:\7hbtbb.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7nhbhh.exec:\7nhbhh.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjddd.exec:\pjddd.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dvjjj.exec:\dvjjj.exe41⤵
- Executes dropped EXE
PID:1176 -
\??\c:\frxxrrl.exec:\frxxrrl.exe42⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bhthht.exec:\bhthht.exe43⤵
- Executes dropped EXE
PID:608 -
\??\c:\hbnbhb.exec:\hbnbhb.exe44⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pjpvv.exec:\pjpvv.exe45⤵
- Executes dropped EXE
PID:1548 -
\??\c:\ppjjp.exec:\ppjjp.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9lflrxf.exec:\9lflrxf.exe47⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3frrfxf.exec:\3frrfxf.exe48⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhntbt.exec:\nhntbt.exe49⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnbttn.exec:\tnbttn.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dpddj.exec:\dpddj.exe51⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dvpvj.exec:\dvpvj.exe52⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlxxxrr.exec:\xlxxxrr.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\bthtbb.exec:\bthtbb.exe54⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hnnbnt.exec:\hnnbnt.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1jjdp.exec:\1jjdp.exe56⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jppjd.exec:\jppjd.exe57⤵
- Executes dropped EXE
PID:824 -
\??\c:\7rflllf.exec:\7rflllf.exe58⤵
- Executes dropped EXE
PID:772 -
\??\c:\hhbthn.exec:\hhbthn.exe59⤵
- Executes dropped EXE
PID:952 -
\??\c:\thbbbh.exec:\thbbbh.exe60⤵
- Executes dropped EXE
PID:760 -
\??\c:\httbhh.exec:\httbhh.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjvpv.exec:\pjvpv.exe62⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dddjd.exec:\dddjd.exe63⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rfxfllx.exec:\rfxfllx.exe64⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xflrflx.exec:\xflrflx.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\thhbbt.exec:\thhbbt.exe66⤵PID:2544
-
\??\c:\jdvdj.exec:\jdvdj.exe67⤵PID:2080
-
\??\c:\vvvdp.exec:\vvvdp.exe68⤵PID:2104
-
\??\c:\rfrrffl.exec:\rfrrffl.exe69⤵PID:1580
-
\??\c:\hthhtb.exec:\hthhtb.exe70⤵PID:2308
-
\??\c:\hbnntt.exec:\hbnntt.exe71⤵PID:3044
-
\??\c:\1nntbt.exec:\1nntbt.exe72⤵PID:2876
-
\??\c:\7dddj.exec:\7dddj.exe73⤵PID:2428
-
\??\c:\xlxxffr.exec:\xlxxffr.exe74⤵PID:2740
-
\??\c:\thtbbb.exec:\thtbbb.exe75⤵PID:2768
-
\??\c:\tbtttb.exec:\tbtttb.exe76⤵PID:2968
-
\??\c:\ddppp.exec:\ddppp.exe77⤵PID:2956
-
\??\c:\5pjvp.exec:\5pjvp.exe78⤵PID:2628
-
\??\c:\xxxlrxf.exec:\xxxlrxf.exe79⤵PID:2780
-
\??\c:\9hnhhh.exec:\9hnhhh.exe80⤵PID:2672
-
\??\c:\hbthtt.exec:\hbthtt.exe81⤵PID:1476
-
\??\c:\vvpvd.exec:\vvpvd.exe82⤵PID:292
-
\??\c:\7vjdp.exec:\7vjdp.exe83⤵PID:2808
-
\??\c:\lffffxf.exec:\lffffxf.exe84⤵PID:2596
-
\??\c:\nnhttt.exec:\nnhttt.exe85⤵PID:2924
-
\??\c:\tntbhh.exec:\tntbhh.exe86⤵PID:2816
-
\??\c:\jjvvp.exec:\jjvvp.exe87⤵PID:2936
-
\??\c:\jdpvv.exec:\jdpvv.exe88⤵PID:1984
-
\??\c:\fxllrlr.exec:\fxllrlr.exe89⤵PID:3028
-
\??\c:\nhbtbt.exec:\nhbtbt.exe90⤵PID:2648
-
\??\c:\bthhbb.exec:\bthhbb.exe91⤵PID:2192
-
\??\c:\5vjpp.exec:\5vjpp.exe92⤵PID:2100
-
\??\c:\pdvpv.exec:\pdvpv.exe93⤵PID:2144
-
\??\c:\ffxxllx.exec:\ffxxllx.exe94⤵PID:2992
-
\??\c:\3xxflxf.exec:\3xxflxf.exe95⤵PID:300
-
\??\c:\hnbtnb.exec:\hnbtnb.exe96⤵PID:528
-
\??\c:\3djvd.exec:\3djvd.exe97⤵PID:948
-
\??\c:\djpjv.exec:\djpjv.exe98⤵PID:1980
-
\??\c:\rflrxrx.exec:\rflrxrx.exe99⤵PID:1668
-
\??\c:\hhtthn.exec:\hhtthn.exe100⤵PID:2072
-
\??\c:\btbntt.exec:\btbntt.exe101⤵PID:1564
-
\??\c:\7pvjp.exec:\7pvjp.exe102⤵PID:2252
-
\??\c:\1vppv.exec:\1vppv.exe103⤵PID:2056
-
\??\c:\fxllrxf.exec:\fxllrxf.exe104⤵PID:2492
-
\??\c:\lrrffxl.exec:\lrrffxl.exe105⤵PID:1488
-
\??\c:\nhbnth.exec:\nhbnth.exe106⤵PID:2108
-
\??\c:\3jpvd.exec:\3jpvd.exe107⤵PID:1708
-
\??\c:\jdvpd.exec:\jdvpd.exe108⤵PID:1596
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe109⤵PID:1872
-
\??\c:\fffflll.exec:\fffflll.exe110⤵PID:2712
-
\??\c:\ttnntt.exec:\ttnntt.exe111⤵PID:1900
-
\??\c:\ntnhbb.exec:\ntnhbb.exe112⤵PID:2616
-
\??\c:\dvjpp.exec:\dvjpp.exe113⤵PID:2868
-
\??\c:\7vpdj.exec:\7vpdj.exe114⤵PID:2724
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe115⤵PID:1928
-
\??\c:\bntbbh.exec:\bntbbh.exe116⤵PID:2632
-
\??\c:\ttnhtb.exec:\ttnhtb.exe117⤵PID:2640
-
\??\c:\vppjj.exec:\vppjj.exe118⤵PID:2624
-
\??\c:\vjjvv.exec:\vjjvv.exe119⤵PID:2684
-
\??\c:\1rfrrrr.exec:\1rfrrrr.exe120⤵PID:1520
-
\??\c:\hnhbtn.exec:\hnhbtn.exe121⤵PID:2844
-
\??\c:\5thtbb.exec:\5thtbb.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-