Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe
Resource
win7-20240903-en
General
-
Target
3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe
-
Size
66KB
-
MD5
0c8535cb9f7a6c49d176d0a2bb466650
-
SHA1
73b6d4f2a09888ed363b87e7b6b0823d0302ac8c
-
SHA256
3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96
-
SHA512
a0bedadf9905fb04b30e191671718ab8b74b96f27a2e3e20730922c312c8cd9210f1b6d7e1a0f279e71643c274de71957cfc21e3795a8482dd9a14846c6ef611
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxeQ:ymb3NkkiQ3mdBjF0y7kbUQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2112-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1200 tbthht.exe 2480 5ppdd.exe 3032 5tbttn.exe 2960 9jvjv.exe 2700 3xlxlrf.exe 2976 rlfrffl.exe 2856 tbbtnn.exe 2588 jdpvj.exe 2000 xlffllr.exe 2636 btnbhn.exe 2236 jdppd.exe 2392 dvpvj.exe 2300 5lxfrxf.exe 1956 bbnbhn.exe 1968 nhbhbb.exe 1680 jddpv.exe 1232 lrfrlrr.exe 1792 frfflfl.exe 2832 hbbnth.exe 2940 5nhhnn.exe 2936 pjjpd.exe 1588 ffrlrfx.exe 2192 frxrxxf.exe 1704 nhbhth.exe 2848 1vpvv.exe 332 rlflrxl.exe 2284 thbtbn.exe 3000 htbbht.exe 2144 vpdpd.exe 1728 llffrxf.exe 2424 tnhnhb.exe 2072 hthhhn.exe 2480 jdjdv.exe 2008 rrlxrfr.exe 2400 rxxxlxx.exe 2756 7thtbb.exe 2700 jdvpv.exe 2768 3pvvj.exe 2692 rflfllx.exe 2212 bhnbtb.exe 2596 tbbhhb.exe 2588 3jdpv.exe 2828 jpjvp.exe 2612 5frlfff.exe 1324 rxfflll.exe 760 3bbbnn.exe 2392 3nnhnt.exe 2300 3tnbbh.exe 1072 jpjvv.exe 1944 1fllxlf.exe 316 fxlfxxl.exe 1408 bnbhhb.exe 1800 nhhtnb.exe 1792 hbthnt.exe 2932 dvpjj.exe 2904 dvjpp.exe 2404 lxlrrxl.exe 780 9frxrfl.exe 700 nnhntt.exe 1700 tththh.exe 644 vvpjv.exe 932 5vvdp.exe 1536 xxrrlxx.exe 2496 lrlfrlf.exe -
resource yara_rule behavioral1/memory/2112-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-270-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1200 2112 3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe 30 PID 2112 wrote to memory of 1200 2112 3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe 30 PID 2112 wrote to memory of 1200 2112 3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe 30 PID 2112 wrote to memory of 1200 2112 3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe 30 PID 1200 wrote to memory of 2480 1200 tbthht.exe 31 PID 1200 wrote to memory of 2480 1200 tbthht.exe 31 PID 1200 wrote to memory of 2480 1200 tbthht.exe 31 PID 1200 wrote to memory of 2480 1200 tbthht.exe 31 PID 2480 wrote to memory of 3032 2480 5ppdd.exe 32 PID 2480 wrote to memory of 3032 2480 5ppdd.exe 32 PID 2480 wrote to memory of 3032 2480 5ppdd.exe 32 PID 2480 wrote to memory of 3032 2480 5ppdd.exe 32 PID 3032 wrote to memory of 2960 3032 5tbttn.exe 33 PID 3032 wrote to memory of 2960 3032 5tbttn.exe 33 PID 3032 wrote to memory of 2960 3032 5tbttn.exe 33 PID 3032 wrote to memory of 2960 3032 5tbttn.exe 33 PID 2960 wrote to memory of 2700 2960 9jvjv.exe 34 PID 2960 wrote to memory of 2700 2960 9jvjv.exe 34 PID 2960 wrote to memory of 2700 2960 9jvjv.exe 34 PID 2960 wrote to memory of 2700 2960 9jvjv.exe 34 PID 2700 wrote to memory of 2976 2700 3xlxlrf.exe 35 PID 2700 wrote to memory of 2976 2700 3xlxlrf.exe 35 PID 2700 wrote to memory of 2976 2700 3xlxlrf.exe 35 PID 2700 wrote to memory of 2976 2700 3xlxlrf.exe 35 PID 2976 wrote to memory of 2856 2976 rlfrffl.exe 36 PID 2976 wrote to memory of 2856 2976 rlfrffl.exe 36 PID 2976 wrote to memory of 2856 2976 rlfrffl.exe 36 PID 2976 wrote to memory of 2856 2976 rlfrffl.exe 36 PID 2856 wrote to memory of 2588 2856 tbbtnn.exe 37 PID 2856 wrote to memory of 2588 2856 tbbtnn.exe 37 PID 2856 wrote to memory of 2588 2856 tbbtnn.exe 37 PID 2856 wrote to memory of 2588 2856 tbbtnn.exe 37 PID 2588 wrote to memory of 2000 2588 jdpvj.exe 38 PID 2588 wrote to memory of 2000 2588 jdpvj.exe 38 PID 2588 wrote to memory of 2000 2588 jdpvj.exe 38 PID 2588 wrote to memory of 2000 2588 jdpvj.exe 38 PID 2000 wrote to memory of 2636 2000 xlffllr.exe 39 PID 2000 wrote to memory of 2636 2000 xlffllr.exe 39 PID 2000 wrote to memory of 2636 2000 xlffllr.exe 39 PID 2000 wrote to memory of 2636 2000 xlffllr.exe 39 PID 2636 wrote to memory of 2236 2636 btnbhn.exe 40 PID 2636 wrote to memory of 2236 2636 btnbhn.exe 40 PID 2636 wrote to memory of 2236 2636 btnbhn.exe 40 PID 2636 wrote to memory of 2236 2636 btnbhn.exe 40 PID 2236 wrote to memory of 2392 2236 jdppd.exe 41 PID 2236 wrote to memory of 2392 2236 jdppd.exe 41 PID 2236 wrote to memory of 2392 2236 jdppd.exe 41 PID 2236 wrote to memory of 2392 2236 jdppd.exe 41 PID 2392 wrote to memory of 2300 2392 dvpvj.exe 42 PID 2392 wrote to memory of 2300 2392 dvpvj.exe 42 PID 2392 wrote to memory of 2300 2392 dvpvj.exe 42 PID 2392 wrote to memory of 2300 2392 dvpvj.exe 42 PID 2300 wrote to memory of 1956 2300 5lxfrxf.exe 43 PID 2300 wrote to memory of 1956 2300 5lxfrxf.exe 43 PID 2300 wrote to memory of 1956 2300 5lxfrxf.exe 43 PID 2300 wrote to memory of 1956 2300 5lxfrxf.exe 43 PID 1956 wrote to memory of 1968 1956 bbnbhn.exe 44 PID 1956 wrote to memory of 1968 1956 bbnbhn.exe 44 PID 1956 wrote to memory of 1968 1956 bbnbhn.exe 44 PID 1956 wrote to memory of 1968 1956 bbnbhn.exe 44 PID 1968 wrote to memory of 1680 1968 nhbhbb.exe 45 PID 1968 wrote to memory of 1680 1968 nhbhbb.exe 45 PID 1968 wrote to memory of 1680 1968 nhbhbb.exe 45 PID 1968 wrote to memory of 1680 1968 nhbhbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe"C:\Users\Admin\AppData\Local\Temp\3102d2b1579244e3a14d73747bfa01139f0493af1ee471ab10d0bc7bca581d96N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tbthht.exec:\tbthht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\5ppdd.exec:\5ppdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\5tbttn.exec:\5tbttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\9jvjv.exec:\9jvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\3xlxlrf.exec:\3xlxlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rlfrffl.exec:\rlfrffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\tbbtnn.exec:\tbbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jdpvj.exec:\jdpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xlffllr.exec:\xlffllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\btnbhn.exec:\btnbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jdppd.exec:\jdppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\5lxfrxf.exec:\5lxfrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\bbnbhn.exec:\bbnbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\nhbhbb.exec:\nhbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jddpv.exec:\jddpv.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lrfrlrr.exec:\lrfrlrr.exe18⤵
- Executes dropped EXE
PID:1232 -
\??\c:\frfflfl.exec:\frfflfl.exe19⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hbbnth.exec:\hbbnth.exe20⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5nhhnn.exec:\5nhhnn.exe21⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjjpd.exec:\pjjpd.exe22⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ffrlrfx.exec:\ffrlrfx.exe23⤵
- Executes dropped EXE
PID:1588 -
\??\c:\frxrxxf.exec:\frxrxxf.exe24⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhbhth.exec:\nhbhth.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1vpvv.exec:\1vpvv.exe26⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rlflrxl.exec:\rlflrxl.exe27⤵
- Executes dropped EXE
PID:332 -
\??\c:\thbtbn.exec:\thbtbn.exe28⤵
- Executes dropped EXE
PID:2284 -
\??\c:\htbbht.exec:\htbbht.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vpdpd.exec:\vpdpd.exe30⤵
- Executes dropped EXE
PID:2144 -
\??\c:\llffrxf.exec:\llffrxf.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tnhnhb.exec:\tnhnhb.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hthhhn.exec:\hthhhn.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jdjdv.exec:\jdjdv.exe34⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrlxrfr.exec:\rrlxrfr.exe35⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rxxxlxx.exec:\rxxxlxx.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7thtbb.exec:\7thtbb.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jdvpv.exec:\jdvpv.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3pvvj.exec:\3pvvj.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rflfllx.exec:\rflfllx.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bhnbtb.exec:\bhnbtb.exe41⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbbhhb.exec:\tbbhhb.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3jdpv.exec:\3jdpv.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jpjvp.exec:\jpjvp.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5frlfff.exec:\5frlfff.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rxfflll.exec:\rxfflll.exe46⤵
- Executes dropped EXE
PID:1324 -
\??\c:\3bbbnn.exec:\3bbbnn.exe47⤵
- Executes dropped EXE
PID:760 -
\??\c:\3nnhnt.exec:\3nnhnt.exe48⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3tnbbh.exec:\3tnbbh.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jpjvv.exec:\jpjvv.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1fllxlf.exec:\1fllxlf.exe51⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fxlfxxl.exec:\fxlfxxl.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\bnbhhb.exec:\bnbhhb.exe53⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nhhtnb.exec:\nhhtnb.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hbthnt.exec:\hbthnt.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvpjj.exec:\dvpjj.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dvjpp.exec:\dvjpp.exe57⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lxlrrxl.exec:\lxlrrxl.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9frxrfl.exec:\9frxrfl.exe59⤵
- Executes dropped EXE
PID:780 -
\??\c:\nnhntt.exec:\nnhntt.exe60⤵
- Executes dropped EXE
PID:700 -
\??\c:\tththh.exec:\tththh.exe61⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vvpjv.exec:\vvpjv.exe62⤵
- Executes dropped EXE
PID:644 -
\??\c:\5vvdp.exec:\5vvdp.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\xxrrlxx.exec:\xxrrlxx.exe64⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bnbbbh.exec:\bnbbbh.exe66⤵PID:2384
-
\??\c:\nhbntt.exec:\nhbntt.exe67⤵PID:2364
-
\??\c:\vjdvv.exec:\vjdvv.exe68⤵PID:2324
-
\??\c:\dvdvv.exec:\dvdvv.exe69⤵PID:1616
-
\??\c:\7pdjj.exec:\7pdjj.exe70⤵PID:1992
-
\??\c:\rlrflrf.exec:\rlrflrf.exe71⤵PID:2040
-
\??\c:\1rrxxfr.exec:\1rrxxfr.exe72⤵PID:3016
-
\??\c:\hbbhbt.exec:\hbbhbt.exe73⤵PID:2128
-
\??\c:\tntnnn.exec:\tntnnn.exe74⤵PID:3032
-
\??\c:\djdpd.exec:\djdpd.exe75⤵PID:2708
-
\??\c:\jpjvv.exec:\jpjvv.exe76⤵PID:2712
-
\??\c:\5llfrxl.exec:\5llfrxl.exe77⤵PID:2688
-
\??\c:\xlllrlr.exec:\xlllrlr.exe78⤵PID:2760
-
\??\c:\nbtbhn.exec:\nbtbhn.exe79⤵PID:2196
-
\??\c:\tbbnbh.exec:\tbbnbh.exe80⤵PID:2724
-
\??\c:\1vjpp.exec:\1vjpp.exe81⤵PID:2556
-
\??\c:\xflfxfx.exec:\xflfxfx.exe82⤵PID:1724
-
\??\c:\rlfrlxl.exec:\rlfrlxl.exe83⤵PID:1488
-
\??\c:\5thhhn.exec:\5thhhn.exe84⤵PID:684
-
\??\c:\bbhttb.exec:\bbhttb.exe85⤵PID:1392
-
\??\c:\vvpdv.exec:\vvpdv.exe86⤵PID:1528
-
\??\c:\llflrxx.exec:\llflrxx.exe87⤵PID:1904
-
\??\c:\lxlxxlf.exec:\lxlxxlf.exe88⤵PID:1952
-
\??\c:\nhthnn.exec:\nhthnn.exe89⤵PID:1972
-
\??\c:\hnhtht.exec:\hnhtht.exe90⤵PID:2456
-
\??\c:\jdjvv.exec:\jdjvv.exe91⤵PID:1620
-
\??\c:\dpjjp.exec:\dpjjp.exe92⤵PID:2748
-
\??\c:\5lrrxfl.exec:\5lrrxfl.exe93⤵PID:1936
-
\??\c:\hbhnnn.exec:\hbhnnn.exe94⤵PID:2228
-
\??\c:\nhttbh.exec:\nhttbh.exe95⤵PID:2824
-
\??\c:\7vpdd.exec:\7vpdd.exe96⤵PID:2648
-
\??\c:\vpjvj.exec:\vpjvj.exe97⤵PID:2892
-
\??\c:\ffrllff.exec:\ffrllff.exe98⤵PID:1484
-
\??\c:\hnthht.exec:\hnthht.exe99⤵PID:2156
-
\??\c:\5tnhnn.exec:\5tnhnn.exe100⤵PID:984
-
\??\c:\3pvpd.exec:\3pvpd.exe101⤵PID:2380
-
\??\c:\llffrrf.exec:\llffrrf.exe102⤵PID:2004
-
\??\c:\9llxrxr.exec:\9llxrxr.exe103⤵PID:332
-
\??\c:\hbhtnb.exec:\hbhtnb.exe104⤵PID:880
-
\??\c:\btbhtn.exec:\btbhtn.exe105⤵PID:2312
-
\??\c:\7jvdp.exec:\7jvdp.exe106⤵PID:2304
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe107⤵PID:2296
-
\??\c:\xfflfrr.exec:\xfflfrr.exe108⤵PID:2108
-
\??\c:\btntnb.exec:\btntnb.exe109⤵PID:1808
-
\??\c:\nnnnbb.exec:\nnnnbb.exe110⤵PID:3028
-
\??\c:\jjvdd.exec:\jjvdd.exe111⤵PID:2644
-
\??\c:\pjpvp.exec:\pjpvp.exe112⤵PID:2120
-
\??\c:\flrflrf.exec:\flrflrf.exe113⤵PID:2152
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe114⤵PID:2960
-
\??\c:\tnhtbn.exec:\tnhtbn.exe115⤵PID:2716
-
\??\c:\xxrxllr.exec:\xxrxllr.exe116⤵PID:2876
-
\??\c:\llfffxf.exec:\llfffxf.exe117⤵PID:2868
-
\??\c:\hnnbbn.exec:\hnnbbn.exe118⤵PID:2696
-
\??\c:\jvdvd.exec:\jvdvd.exe119⤵PID:2564
-
\??\c:\ddvdj.exec:\ddvdj.exe120⤵PID:2596
-
\??\c:\lxxxlll.exec:\lxxxlll.exe121⤵PID:3048
-
\??\c:\rlflrrf.exec:\rlflrrf.exe122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-