Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe
Resource
win7-20240903-en
General
-
Target
b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe
-
Size
82KB
-
MD5
4ee152c31e1671b2e904510a13db0a70
-
SHA1
5f48b6a05fe1a676160096ed842d6cac672ddba7
-
SHA256
b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9
-
SHA512
0baef0e2e84e51aaf89fcb7a04a800e4285024bc9bd5e64a088b37a7100568fe0760a01e7f5389a49401da3391e850842a32f50b27c6e583e64e754b6332b14c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gth:ymb3NkkiQ3mdBjFo73thgQ/wEko
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2256-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2480 nhtbht.exe 2100 ppjvv.exe 1108 nbnbhn.exe 2776 thbhnn.exe 2792 3pjpv.exe 2592 llflrfx.exe 2604 thhbbb.exe 2616 3htnbn.exe 1644 3vjpd.exe 1816 rxxrllx.exe 536 nntbnt.exe 2804 nbhttb.exe 2052 jpvjd.exe 1180 jvjjp.exe 1436 rxllxfr.exe 1784 rrxflrf.exe 3024 nhttht.exe 1980 htbhbn.exe 2432 1jjdp.exe 448 rxlfffl.exe 1192 xrfxxfr.exe 1244 5lflxff.exe 2988 hnnhht.exe 920 dddpv.exe 940 jjvpj.exe 1008 xllxrlf.exe 1084 tnbbnb.exe 2260 tnbhnn.exe 2300 vpdpp.exe 2096 djdjv.exe 1560 ffrrflx.exe 2700 btbbht.exe 2212 bthnbh.exe 2280 vpdjv.exe 2776 1pjvj.exe 2692 pjjjd.exe 2720 5frflrf.exe 2812 xlxxrxl.exe 2632 hhtbtn.exe 2576 hbhhnn.exe 1028 jdpjj.exe 2044 5pjjp.exe 1736 5rrxflx.exe 1396 xrflrrx.exe 2872 nhhhhn.exe 320 7vppd.exe 2084 ppppj.exe 2916 3xxlllx.exe 848 1rllllf.exe 2132 3hhhtb.exe 2144 ntnbnb.exe 3024 5vjdj.exe 2012 djvvv.exe 2020 1fflrrf.exe 2308 bbtbnt.exe 448 nhttbb.exe 1456 ppjpp.exe 1724 9frlrxl.exe 1744 ffxlxll.exe 996 nnhhnh.exe 1516 tnbttt.exe 1652 7vpjj.exe 1076 5rlrlfr.exe 3004 xrlxlff.exe -
resource yara_rule behavioral1/memory/2256-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-312-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2480 2256 b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe 31 PID 2256 wrote to memory of 2480 2256 b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe 31 PID 2256 wrote to memory of 2480 2256 b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe 31 PID 2256 wrote to memory of 2480 2256 b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe 31 PID 2480 wrote to memory of 2100 2480 nhtbht.exe 32 PID 2480 wrote to memory of 2100 2480 nhtbht.exe 32 PID 2480 wrote to memory of 2100 2480 nhtbht.exe 32 PID 2480 wrote to memory of 2100 2480 nhtbht.exe 32 PID 2100 wrote to memory of 1108 2100 ppjvv.exe 33 PID 2100 wrote to memory of 1108 2100 ppjvv.exe 33 PID 2100 wrote to memory of 1108 2100 ppjvv.exe 33 PID 2100 wrote to memory of 1108 2100 ppjvv.exe 33 PID 1108 wrote to memory of 2776 1108 nbnbhn.exe 34 PID 1108 wrote to memory of 2776 1108 nbnbhn.exe 34 PID 1108 wrote to memory of 2776 1108 nbnbhn.exe 34 PID 1108 wrote to memory of 2776 1108 nbnbhn.exe 34 PID 2776 wrote to memory of 2792 2776 thbhnn.exe 35 PID 2776 wrote to memory of 2792 2776 thbhnn.exe 35 PID 2776 wrote to memory of 2792 2776 thbhnn.exe 35 PID 2776 wrote to memory of 2792 2776 thbhnn.exe 35 PID 2792 wrote to memory of 2592 2792 3pjpv.exe 36 PID 2792 wrote to memory of 2592 2792 3pjpv.exe 36 PID 2792 wrote to memory of 2592 2792 3pjpv.exe 36 PID 2792 wrote to memory of 2592 2792 3pjpv.exe 36 PID 2592 wrote to memory of 2604 2592 llflrfx.exe 37 PID 2592 wrote to memory of 2604 2592 llflrfx.exe 37 PID 2592 wrote to memory of 2604 2592 llflrfx.exe 37 PID 2592 wrote to memory of 2604 2592 llflrfx.exe 37 PID 2604 wrote to memory of 2616 2604 thhbbb.exe 38 PID 2604 wrote to memory of 2616 2604 thhbbb.exe 38 PID 2604 wrote to memory of 2616 2604 thhbbb.exe 38 PID 2604 wrote to memory of 2616 2604 thhbbb.exe 38 PID 2616 wrote to memory of 1644 2616 3htnbn.exe 39 PID 2616 wrote to memory of 1644 2616 3htnbn.exe 39 PID 2616 wrote to memory of 1644 2616 3htnbn.exe 39 PID 2616 wrote to memory of 1644 2616 3htnbn.exe 39 PID 1644 wrote to memory of 1816 1644 3vjpd.exe 40 PID 1644 wrote to memory of 1816 1644 3vjpd.exe 40 PID 1644 wrote to memory of 1816 1644 3vjpd.exe 40 PID 1644 wrote to memory of 1816 1644 3vjpd.exe 40 PID 1816 wrote to memory of 536 1816 rxxrllx.exe 41 PID 1816 wrote to memory of 536 1816 rxxrllx.exe 41 PID 1816 wrote to memory of 536 1816 rxxrllx.exe 41 PID 1816 wrote to memory of 536 1816 rxxrllx.exe 41 PID 536 wrote to memory of 2804 536 nntbnt.exe 42 PID 536 wrote to memory of 2804 536 nntbnt.exe 42 PID 536 wrote to memory of 2804 536 nntbnt.exe 42 PID 536 wrote to memory of 2804 536 nntbnt.exe 42 PID 2804 wrote to memory of 2052 2804 nbhttb.exe 43 PID 2804 wrote to memory of 2052 2804 nbhttb.exe 43 PID 2804 wrote to memory of 2052 2804 nbhttb.exe 43 PID 2804 wrote to memory of 2052 2804 nbhttb.exe 43 PID 2052 wrote to memory of 1180 2052 jpvjd.exe 44 PID 2052 wrote to memory of 1180 2052 jpvjd.exe 44 PID 2052 wrote to memory of 1180 2052 jpvjd.exe 44 PID 2052 wrote to memory of 1180 2052 jpvjd.exe 44 PID 1180 wrote to memory of 1436 1180 jvjjp.exe 45 PID 1180 wrote to memory of 1436 1180 jvjjp.exe 45 PID 1180 wrote to memory of 1436 1180 jvjjp.exe 45 PID 1180 wrote to memory of 1436 1180 jvjjp.exe 45 PID 1436 wrote to memory of 1784 1436 rxllxfr.exe 46 PID 1436 wrote to memory of 1784 1436 rxllxfr.exe 46 PID 1436 wrote to memory of 1784 1436 rxllxfr.exe 46 PID 1436 wrote to memory of 1784 1436 rxllxfr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe"C:\Users\Admin\AppData\Local\Temp\b9bfde52331d733a7121d06bcd7eedd0a808e7176888f001df7341d263da49a9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\nhtbht.exec:\nhtbht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ppjvv.exec:\ppjvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\nbnbhn.exec:\nbnbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\thbhnn.exec:\thbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\3pjpv.exec:\3pjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\llflrfx.exec:\llflrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\thhbbb.exec:\thhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\3htnbn.exec:\3htnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\3vjpd.exec:\3vjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\rxxrllx.exec:\rxxrllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\nntbnt.exec:\nntbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nbhttb.exec:\nbhttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jpvjd.exec:\jpvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\jvjjp.exec:\jvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\rxllxfr.exec:\rxllxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\rrxflrf.exec:\rrxflrf.exe17⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nhttht.exec:\nhttht.exe18⤵
- Executes dropped EXE
PID:3024 -
\??\c:\htbhbn.exec:\htbhbn.exe19⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1jjdp.exec:\1jjdp.exe20⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rxlfffl.exec:\rxlfffl.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\xrfxxfr.exec:\xrfxxfr.exe22⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5lflxff.exec:\5lflxff.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\hnnhht.exec:\hnnhht.exe24⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dddpv.exec:\dddpv.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\jjvpj.exec:\jjvpj.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\xllxrlf.exec:\xllxrlf.exe27⤵
- Executes dropped EXE
PID:1008 -
\??\c:\tnbbnb.exec:\tnbbnb.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tnbhnn.exec:\tnbhnn.exe29⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpdpp.exec:\vpdpp.exe30⤵
- Executes dropped EXE
PID:2300 -
\??\c:\djdjv.exec:\djdjv.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ffrrflx.exec:\ffrrflx.exe32⤵
- Executes dropped EXE
PID:1560 -
\??\c:\btbbht.exec:\btbbht.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bthnbh.exec:\bthnbh.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vpdjv.exec:\vpdjv.exe35⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1pjvj.exec:\1pjvj.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjjjd.exec:\pjjjd.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5frflrf.exec:\5frflrf.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xlxxrxl.exec:\xlxxrxl.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hhtbtn.exec:\hhtbtn.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbhhnn.exec:\hbhhnn.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jdpjj.exec:\jdpjj.exe42⤵
- Executes dropped EXE
PID:1028 -
\??\c:\5pjjp.exec:\5pjjp.exe43⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5rrxflx.exec:\5rrxflx.exe44⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrflrrx.exec:\xrflrrx.exe45⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nhhhhn.exec:\nhhhhn.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7vppd.exec:\7vppd.exe47⤵
- Executes dropped EXE
PID:320 -
\??\c:\ppppj.exec:\ppppj.exe48⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3xxlllx.exec:\3xxlllx.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1rllllf.exec:\1rllllf.exe50⤵
- Executes dropped EXE
PID:848 -
\??\c:\3hhhtb.exec:\3hhhtb.exe51⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ntnbnb.exec:\ntnbnb.exe52⤵
- Executes dropped EXE
PID:2144 -
\??\c:\5vjdj.exec:\5vjdj.exe53⤵
- Executes dropped EXE
PID:3024 -
\??\c:\djvvv.exec:\djvvv.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1fflrrf.exec:\1fflrrf.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bbtbnt.exec:\bbtbnt.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nhttbb.exec:\nhttbb.exe57⤵
- Executes dropped EXE
PID:448 -
\??\c:\ppjpp.exec:\ppjpp.exe58⤵
- Executes dropped EXE
PID:1456 -
\??\c:\9frlrxl.exec:\9frlrxl.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ffxlxll.exec:\ffxlxll.exe60⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nnhhnh.exec:\nnhhnh.exe61⤵
- Executes dropped EXE
PID:996 -
\??\c:\tnbttt.exec:\tnbttt.exe62⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7vpjj.exec:\7vpjj.exe63⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5rlrlfr.exec:\5rlrlfr.exe64⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xrlxlff.exec:\xrlxlff.exe65⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tthnhh.exec:\tthnhh.exe66⤵PID:1836
-
\??\c:\tththn.exec:\tththn.exe67⤵PID:2276
-
\??\c:\vpdvj.exec:\vpdvj.exe68⤵PID:2452
-
\??\c:\jjjjd.exec:\jjjjd.exe69⤵PID:2952
-
\??\c:\7frxfxf.exec:\7frxfxf.exe70⤵PID:2100
-
\??\c:\tnhnnt.exec:\tnhnnt.exe71⤵PID:2708
-
\??\c:\hnbnbb.exec:\hnbnbb.exe72⤵PID:2976
-
\??\c:\1pjdj.exec:\1pjdj.exe73⤵PID:2652
-
\??\c:\jdvdp.exec:\jdvdp.exe74⤵PID:2676
-
\??\c:\fxffllr.exec:\fxffllr.exe75⤵PID:2964
-
\??\c:\lfllfxr.exec:\lfllfxr.exe76⤵PID:2696
-
\??\c:\hnbbhn.exec:\hnbbhn.exe77⤵PID:2556
-
\??\c:\vjdpd.exec:\vjdpd.exe78⤵PID:2812
-
\??\c:\vddvd.exec:\vddvd.exe79⤵PID:2600
-
\??\c:\1rrrlfl.exec:\1rrrlfl.exe80⤵PID:1644
-
\??\c:\1hthnt.exec:\1hthnt.exe81⤵PID:2736
-
\??\c:\nnhhth.exec:\nnhhth.exe82⤵PID:2044
-
\??\c:\3vjvv.exec:\3vjvv.exe83⤵PID:640
-
\??\c:\dvddd.exec:\dvddd.exe84⤵PID:2908
-
\??\c:\lfxxlxx.exec:\lfxxlxx.exe85⤵PID:2872
-
\??\c:\3nttnn.exec:\3nttnn.exe86⤵PID:1968
-
\??\c:\5hhtbh.exec:\5hhtbh.exe87⤵PID:2052
-
\??\c:\jdjdd.exec:\jdjdd.exe88⤵PID:1264
-
\??\c:\pdpjp.exec:\pdpjp.exe89⤵PID:3040
-
\??\c:\rrfllll.exec:\rrfllll.exe90⤵PID:1632
-
\??\c:\fflxrxl.exec:\fflxrxl.exe91⤵PID:1820
-
\??\c:\3ntnbn.exec:\3ntnbn.exe92⤵PID:1064
-
\??\c:\djjjp.exec:\djjjp.exe93⤵PID:2432
-
\??\c:\jpjdj.exec:\jpjdj.exe94⤵PID:236
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe95⤵PID:1476
-
\??\c:\frllffl.exec:\frllffl.exe96⤵PID:1672
-
\??\c:\1nbhnn.exec:\1nbhnn.exe97⤵PID:1316
-
\??\c:\hbhtht.exec:\hbhtht.exe98⤵PID:2440
-
\??\c:\dddvd.exec:\dddvd.exe99⤵PID:1208
-
\??\c:\pdpjp.exec:\pdpjp.exe100⤵PID:940
-
\??\c:\xllrflr.exec:\xllrflr.exe101⤵PID:1648
-
\??\c:\xfxxrlx.exec:\xfxxrlx.exe102⤵PID:1008
-
\??\c:\1htthh.exec:\1htthh.exe103⤵PID:528
-
\??\c:\hhtbht.exec:\hhtbht.exe104⤵PID:2072
-
\??\c:\5vppp.exec:\5vppp.exe105⤵PID:1680
-
\??\c:\djdpp.exec:\djdpp.exe106⤵PID:1352
-
\??\c:\9jvdd.exec:\9jvdd.exe107⤵PID:2488
-
\??\c:\7lxrrlx.exec:\7lxrrlx.exe108⤵PID:2668
-
\??\c:\llflxfl.exec:\llflxfl.exe109⤵PID:2700
-
\??\c:\9nbhnt.exec:\9nbhnt.exe110⤵PID:1108
-
\??\c:\htnthh.exec:\htnthh.exe111⤵PID:2564
-
\??\c:\djvpv.exec:\djvpv.exe112⤵PID:2716
-
\??\c:\llxxflx.exec:\llxxflx.exe113⤵PID:2584
-
\??\c:\9rrfrfl.exec:\9rrfrfl.exe114⤵PID:2728
-
\??\c:\frxxfxf.exec:\frxxfxf.exe115⤵PID:2552
-
\??\c:\ntbtbb.exec:\ntbtbb.exe116⤵PID:3044
-
\??\c:\bhbtth.exec:\bhbtth.exe117⤵PID:2604
-
\??\c:\3jpvj.exec:\3jpvj.exe118⤵PID:3060
-
\??\c:\jppvj.exec:\jppvj.exe119⤵PID:2396
-
\??\c:\xxllrxf.exec:\xxllrxf.exe120⤵PID:1816
-
\??\c:\flrfxfx.exec:\flrfxfx.exe121⤵PID:2544
-
\??\c:\ttnbbt.exec:\ttnbbt.exe122⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-