Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe
Resource
win7-20240903-en
General
-
Target
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe
-
Size
82KB
-
MD5
7b9f0a7b90de77b4940357127d5be098
-
SHA1
95c14897730771404ce4afe3748ff5ac5341fb61
-
SHA256
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c
-
SHA512
a4d1e321aa4caedda459290e7ed690c45db5bd141bf565732a70231ec5669fd6ee6a2d64c13e2bc9d89b3886d5472ab244767180424610fe709c4781fd8d4548
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqB:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2124-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1820 rxxxrrf.exe 2360 llflllf.exe 2528 jdppv.exe 2712 pjdjp.exe 3064 rlfflll.exe 2744 3llxxrr.exe 1596 tntbhn.exe 2584 9jpdd.exe 2332 jvdjp.exe 1832 9xlxxrr.exe 1468 nbhnnt.exe 332 bnnnhh.exe 2852 dpddp.exe 2684 jvjpp.exe 2812 ffrrxrf.exe 1912 rlxfrxl.exe 1540 btbhnh.exe 3004 nhbbbt.exe 2060 9vpdv.exe 2068 ddjvp.exe 1996 pjvdv.exe 448 xxlxlrf.exe 2568 lllrfrl.exe 1604 lfrrxff.exe 1768 bbnbnt.exe 2188 ddvdj.exe 1828 vpvvj.exe 1804 3jvpp.exe 884 7ddpp.exe 2412 xxxrlrl.exe 2396 xffrrlx.exe 1708 bnhnth.exe 2416 vjdpp.exe 2344 9lffrrf.exe 2880 hhtbht.exe 2728 9vjpd.exe 2432 vpvvp.exe 2692 xlxrrlr.exe 2632 lxfflfl.exe 2628 nbhbhb.exe 2612 9tbbtn.exe 1244 pjpvp.exe 1836 pdvjj.exe 1832 jdpvv.exe 2660 xrffllr.exe 1528 3lxllll.exe 2364 xllrxxf.exe 536 9bhnhn.exe 2040 htbnhb.exe 2812 dpjjd.exe 1568 dpvvp.exe 1912 5jvvv.exe 3016 1fxxrll.exe 2680 5lrxxxf.exe 2052 nhttbh.exe 988 htbbbb.exe 1488 vpdjp.exe 2328 vjvpp.exe 1668 7fxxflr.exe 864 fxrxxrf.exe 912 1tbhnn.exe 1680 dvjjp.exe 1980 pvdvv.exe 2264 flxrrrx.exe -
resource yara_rule behavioral1/memory/2124-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1820 2124 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 30 PID 2124 wrote to memory of 1820 2124 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 30 PID 2124 wrote to memory of 1820 2124 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 30 PID 2124 wrote to memory of 1820 2124 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 30 PID 1820 wrote to memory of 2360 1820 rxxxrrf.exe 31 PID 1820 wrote to memory of 2360 1820 rxxxrrf.exe 31 PID 1820 wrote to memory of 2360 1820 rxxxrrf.exe 31 PID 1820 wrote to memory of 2360 1820 rxxxrrf.exe 31 PID 2360 wrote to memory of 2528 2360 llflllf.exe 32 PID 2360 wrote to memory of 2528 2360 llflllf.exe 32 PID 2360 wrote to memory of 2528 2360 llflllf.exe 32 PID 2360 wrote to memory of 2528 2360 llflllf.exe 32 PID 2528 wrote to memory of 2712 2528 jdppv.exe 33 PID 2528 wrote to memory of 2712 2528 jdppv.exe 33 PID 2528 wrote to memory of 2712 2528 jdppv.exe 33 PID 2528 wrote to memory of 2712 2528 jdppv.exe 33 PID 2712 wrote to memory of 3064 2712 pjdjp.exe 34 PID 2712 wrote to memory of 3064 2712 pjdjp.exe 34 PID 2712 wrote to memory of 3064 2712 pjdjp.exe 34 PID 2712 wrote to memory of 3064 2712 pjdjp.exe 34 PID 3064 wrote to memory of 2744 3064 rlfflll.exe 35 PID 3064 wrote to memory of 2744 3064 rlfflll.exe 35 PID 3064 wrote to memory of 2744 3064 rlfflll.exe 35 PID 3064 wrote to memory of 2744 3064 rlfflll.exe 35 PID 2744 wrote to memory of 1596 2744 3llxxrr.exe 36 PID 2744 wrote to memory of 1596 2744 3llxxrr.exe 36 PID 2744 wrote to memory of 1596 2744 3llxxrr.exe 36 PID 2744 wrote to memory of 1596 2744 3llxxrr.exe 36 PID 1596 wrote to memory of 2584 1596 tntbhn.exe 37 PID 1596 wrote to memory of 2584 1596 tntbhn.exe 37 PID 1596 wrote to memory of 2584 1596 tntbhn.exe 37 PID 1596 wrote to memory of 2584 1596 tntbhn.exe 37 PID 2584 wrote to memory of 2332 2584 9jpdd.exe 38 PID 2584 wrote to memory of 2332 2584 9jpdd.exe 38 PID 2584 wrote to memory of 2332 2584 9jpdd.exe 38 PID 2584 wrote to memory of 2332 2584 9jpdd.exe 38 PID 2332 wrote to memory of 1832 2332 jvdjp.exe 39 PID 2332 wrote to memory of 1832 2332 jvdjp.exe 39 PID 2332 wrote to memory of 1832 2332 jvdjp.exe 39 PID 2332 wrote to memory of 1832 2332 jvdjp.exe 39 PID 1832 wrote to memory of 1468 1832 9xlxxrr.exe 40 PID 1832 wrote to memory of 1468 1832 9xlxxrr.exe 40 PID 1832 wrote to memory of 1468 1832 9xlxxrr.exe 40 PID 1832 wrote to memory of 1468 1832 9xlxxrr.exe 40 PID 1468 wrote to memory of 332 1468 nbhnnt.exe 41 PID 1468 wrote to memory of 332 1468 nbhnnt.exe 41 PID 1468 wrote to memory of 332 1468 nbhnnt.exe 41 PID 1468 wrote to memory of 332 1468 nbhnnt.exe 41 PID 332 wrote to memory of 2852 332 bnnnhh.exe 42 PID 332 wrote to memory of 2852 332 bnnnhh.exe 42 PID 332 wrote to memory of 2852 332 bnnnhh.exe 42 PID 332 wrote to memory of 2852 332 bnnnhh.exe 42 PID 2852 wrote to memory of 2684 2852 dpddp.exe 43 PID 2852 wrote to memory of 2684 2852 dpddp.exe 43 PID 2852 wrote to memory of 2684 2852 dpddp.exe 43 PID 2852 wrote to memory of 2684 2852 dpddp.exe 43 PID 2684 wrote to memory of 2812 2684 jvjpp.exe 44 PID 2684 wrote to memory of 2812 2684 jvjpp.exe 44 PID 2684 wrote to memory of 2812 2684 jvjpp.exe 44 PID 2684 wrote to memory of 2812 2684 jvjpp.exe 44 PID 2812 wrote to memory of 1912 2812 ffrrxrf.exe 45 PID 2812 wrote to memory of 1912 2812 ffrrxrf.exe 45 PID 2812 wrote to memory of 1912 2812 ffrrxrf.exe 45 PID 2812 wrote to memory of 1912 2812 ffrrxrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe"C:\Users\Admin\AppData\Local\Temp\354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\rxxxrrf.exec:\rxxxrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\llflllf.exec:\llflllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jdppv.exec:\jdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\pjdjp.exec:\pjdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rlfflll.exec:\rlfflll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\3llxxrr.exec:\3llxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tntbhn.exec:\tntbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\9jpdd.exec:\9jpdd.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jvdjp.exec:\jvdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\9xlxxrr.exec:\9xlxxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\nbhnnt.exec:\nbhnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\bnnnhh.exec:\bnnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\dpddp.exec:\dpddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jvjpp.exec:\jvjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ffrrxrf.exec:\ffrrxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe17⤵
- Executes dropped EXE
PID:1912 -
\??\c:\btbhnh.exec:\btbhnh.exe18⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nhbbbt.exec:\nhbbbt.exe19⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9vpdv.exec:\9vpdv.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddjvp.exec:\ddjvp.exe21⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pjvdv.exec:\pjvdv.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xxlxlrf.exec:\xxlxlrf.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\lllrfrl.exec:\lllrfrl.exe24⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lfrrxff.exec:\lfrrxff.exe25⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bbnbnt.exec:\bbnbnt.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ddvdj.exec:\ddvdj.exe27⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vpvvj.exec:\vpvvj.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3jvpp.exec:\3jvpp.exe29⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7ddpp.exec:\7ddpp.exe30⤵
- Executes dropped EXE
PID:884 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe31⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xffrrlx.exec:\xffrrlx.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bnhnth.exec:\bnhnth.exe33⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vjdpp.exec:\vjdpp.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9lffrrf.exec:\9lffrrf.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhtbht.exec:\hhtbht.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9vjpd.exec:\9vjpd.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vpvvp.exec:\vpvvp.exe38⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxfflfl.exec:\lxfflfl.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nbhbhb.exec:\nbhbhb.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9tbbtn.exec:\9tbbtn.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pjpvp.exec:\pjpvp.exe43⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pdvjj.exec:\pdvjj.exe44⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jdpvv.exec:\jdpvv.exe45⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xrffllr.exec:\xrffllr.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3lxllll.exec:\3lxllll.exe47⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xllrxxf.exec:\xllrxxf.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9bhnhn.exec:\9bhnhn.exe49⤵
- Executes dropped EXE
PID:536 -
\??\c:\htbnhb.exec:\htbnhb.exe50⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dpjjd.exec:\dpjjd.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dpvvp.exec:\dpvvp.exe52⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5jvvv.exec:\5jvvv.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1fxxrll.exec:\1fxxrll.exe54⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5lrxxxf.exec:\5lrxxxf.exe55⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nhttbh.exec:\nhttbh.exe56⤵
- Executes dropped EXE
PID:2052 -
\??\c:\htbbbb.exec:\htbbbb.exe57⤵
- Executes dropped EXE
PID:988 -
\??\c:\vpdjp.exec:\vpdjp.exe58⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vjvpp.exec:\vjvpp.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7fxxflr.exec:\7fxxflr.exe60⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fxrxxrf.exec:\fxrxxrf.exe61⤵
- Executes dropped EXE
PID:864 -
\??\c:\1tbhnn.exec:\1tbhnn.exe62⤵
- Executes dropped EXE
PID:912 -
\??\c:\dvjjp.exec:\dvjjp.exe63⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pvdvv.exec:\pvdvv.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\flxrrrx.exec:\flxrrrx.exe65⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lffflrx.exec:\lffflrx.exe66⤵PID:2272
-
\??\c:\hthnbh.exec:\hthnbh.exe67⤵PID:1044
-
\??\c:\dvpvd.exec:\dvpvd.exe68⤵PID:1480
-
\??\c:\vvpvj.exec:\vvpvj.exe69⤵PID:2108
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe70⤵PID:2412
-
\??\c:\3llrlrr.exec:\3llrlrr.exe71⤵PID:1940
-
\??\c:\nhnnnb.exec:\nhnnnb.exe72⤵PID:1736
-
\??\c:\bbthtb.exec:\bbthtb.exe73⤵PID:2360
-
\??\c:\jpjpv.exec:\jpjpv.exe74⤵PID:2676
-
\??\c:\ddvjd.exec:\ddvjd.exe75⤵PID:1900
-
\??\c:\3xllxfx.exec:\3xllxfx.exe76⤵PID:2132
-
\??\c:\fxrlxrx.exec:\fxrlxrx.exe77⤵PID:2592
-
\??\c:\5fxxlrf.exec:\5fxxlrf.exe78⤵PID:2932
-
\??\c:\tnbbbb.exec:\tnbbbb.exe79⤵PID:2860
-
\??\c:\bnnttn.exec:\bnnttn.exe80⤵PID:1596
-
\??\c:\vpdpv.exec:\vpdpv.exe81⤵PID:2324
-
\??\c:\vvvdp.exec:\vvvdp.exe82⤵PID:3056
-
\??\c:\fxfffll.exec:\fxfffll.exe83⤵PID:1084
-
\??\c:\lfffllx.exec:\lfffllx.exe84⤵PID:2616
-
\??\c:\rrfxfff.exec:\rrfxfff.exe85⤵PID:2704
-
\??\c:\1thhnn.exec:\1thhnn.exe86⤵PID:1468
-
\??\c:\1hhtbh.exec:\1hhtbh.exe87⤵PID:1616
-
\??\c:\djvvv.exec:\djvvv.exe88⤵PID:556
-
\??\c:\pvppp.exec:\pvppp.exe89⤵PID:2644
-
\??\c:\9lflxfl.exec:\9lflxfl.exe90⤵PID:656
-
\??\c:\tttbbb.exec:\tttbbb.exe91⤵PID:1924
-
\??\c:\dvjpp.exec:\dvjpp.exe92⤵PID:1884
-
\??\c:\djpvp.exec:\djpvp.exe93⤵PID:1540
-
\??\c:\3frxrlx.exec:\3frxrlx.exe94⤵PID:2484
-
\??\c:\1hbhhh.exec:\1hbhhh.exe95⤵PID:776
-
\??\c:\httnhb.exec:\httnhb.exe96⤵PID:1908
-
\??\c:\pjvdd.exec:\pjvdd.exe97⤵PID:3032
-
\??\c:\rlxflfl.exec:\rlxflfl.exe98⤵PID:3024
-
\??\c:\rrlrffx.exec:\rrlrffx.exe99⤵PID:2004
-
\??\c:\nhnnnh.exec:\nhnnnh.exe100⤵PID:2624
-
\??\c:\bbbbbn.exec:\bbbbbn.exe101⤵PID:1052
-
\??\c:\vpdjj.exec:\vpdjj.exe102⤵PID:1232
-
\??\c:\7vjdj.exec:\7vjdj.exe103⤵PID:2056
-
\??\c:\7pddd.exec:\7pddd.exe104⤵PID:828
-
\??\c:\xlfffll.exec:\xlfffll.exe105⤵PID:1360
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe106⤵PID:2384
-
\??\c:\bnttbh.exec:\bnttbh.exe107⤵PID:112
-
\??\c:\7dpjd.exec:\7dpjd.exe108⤵PID:1496
-
\??\c:\vjvpv.exec:\vjvpv.exe109⤵PID:1272
-
\??\c:\fxlxllx.exec:\fxlxllx.exe110⤵PID:1592
-
\??\c:\fxrrxlf.exec:\fxrrxlf.exe111⤵PID:1588
-
\??\c:\bhtnnt.exec:\bhtnnt.exe112⤵PID:1708
-
\??\c:\btnttt.exec:\btnttt.exe113⤵PID:2724
-
\??\c:\pddvv.exec:\pddvv.exe114⤵PID:2912
-
\??\c:\pjvjp.exec:\pjvjp.exe115⤵PID:2260
-
\??\c:\lffffrx.exec:\lffffrx.exe116⤵PID:2712
-
\??\c:\lrfxxxl.exec:\lrfxxxl.exe117⤵PID:2840
-
\??\c:\nnbhth.exec:\nnbhth.exe118⤵PID:2692
-
\??\c:\9jdjj.exec:\9jdjj.exe119⤵PID:2904
-
\??\c:\3jppp.exec:\3jppp.exe120⤵PID:2136
-
\??\c:\xlrffxl.exec:\xlrffxl.exe121⤵PID:2588
-
\??\c:\fxlxrxx.exec:\fxlxrxx.exe122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-