Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
Resource
win7-20240903-en
General
-
Target
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
-
Size
83KB
-
MD5
cc843f29569041b4c5f5cfbda3acbbba
-
SHA1
00f60f53883096623fd59c71beebb5dd172f2e03
-
SHA256
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f
-
SHA512
95c7f249f15992a059ba2e5c43f201ffa5319267ab2563cef62ed43654f4899bc0ff2eff4040fb23d602a8b20524684c18cb8d49c2f8f2b8a915e47b6eb6ca18
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QR:ymb3NkkiQ3mdBjFIIp9L9QrrA8m
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/3024-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/636-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1440 pjdjd.exe 700 1jddv.exe 2120 bthbnh.exe 2696 pjvdv.exe 2716 llffrrf.exe 2852 lfllfrl.exe 2592 7nbnbn.exe 2580 dvjpv.exe 2348 jdpjv.exe 636 3llxrrf.exe 1792 7rlrlfr.exe 2364 1nnhnt.exe 1604 3dpdj.exe 1952 dvpdj.exe 772 rrlfxlx.exe 1320 xxfxxrr.exe 1856 hbtnbn.exe 2808 bbhnth.exe 2272 dpjjd.exe 2868 3vvjp.exe 1084 xrlrlrf.exe 1224 llflrll.exe 3036 ttnnbb.exe 1044 hbnthn.exe 920 ppjpv.exe 1628 vpdvv.exe 2460 rfxfllr.exe 1004 3rflrrf.exe 2368 hhbnhn.exe 1440 bnbbbh.exe 2016 vpdpd.exe 1736 1xfxxrr.exe 2848 llxlrfr.exe 3048 tthbnn.exe 3044 nhnntb.exe 2804 nhntbh.exe 2692 djvvj.exe 2820 ppjvj.exe 2704 5lxxffr.exe 3008 7rrlffl.exe 2688 7rlrfrl.exe 2580 bbnbht.exe 2348 btnnbb.exe 872 jdpvd.exe 1520 pjvdj.exe 1684 rrrxlll.exe 1036 fxlrxfr.exe 1436 nnhthh.exe 1660 5nbtbb.exe 1984 7tntnh.exe 1444 dpddp.exe 1144 ddpvv.exe 1852 fxrxflx.exe 2428 7hnthh.exe 2964 hbtthn.exe 2200 jjvjv.exe 1560 1jdpp.exe 1600 ffxxxfl.exe 996 xlxlffr.exe 1636 3thnhn.exe 544 hnnntt.exe 2464 vvppd.exe 2412 xfrrxxf.exe 2100 xrfxxxl.exe -
resource yara_rule behavioral1/memory/3024-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/636-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1440 3024 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 3024 wrote to memory of 1440 3024 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 3024 wrote to memory of 1440 3024 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 3024 wrote to memory of 1440 3024 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 1440 wrote to memory of 700 1440 pjdjd.exe 32 PID 1440 wrote to memory of 700 1440 pjdjd.exe 32 PID 1440 wrote to memory of 700 1440 pjdjd.exe 32 PID 1440 wrote to memory of 700 1440 pjdjd.exe 32 PID 700 wrote to memory of 2120 700 1jddv.exe 33 PID 700 wrote to memory of 2120 700 1jddv.exe 33 PID 700 wrote to memory of 2120 700 1jddv.exe 33 PID 700 wrote to memory of 2120 700 1jddv.exe 33 PID 2120 wrote to memory of 2696 2120 bthbnh.exe 34 PID 2120 wrote to memory of 2696 2120 bthbnh.exe 34 PID 2120 wrote to memory of 2696 2120 bthbnh.exe 34 PID 2120 wrote to memory of 2696 2120 bthbnh.exe 34 PID 2696 wrote to memory of 2716 2696 pjvdv.exe 35 PID 2696 wrote to memory of 2716 2696 pjvdv.exe 35 PID 2696 wrote to memory of 2716 2696 pjvdv.exe 35 PID 2696 wrote to memory of 2716 2696 pjvdv.exe 35 PID 2716 wrote to memory of 2852 2716 llffrrf.exe 36 PID 2716 wrote to memory of 2852 2716 llffrrf.exe 36 PID 2716 wrote to memory of 2852 2716 llffrrf.exe 36 PID 2716 wrote to memory of 2852 2716 llffrrf.exe 36 PID 2852 wrote to memory of 2592 2852 lfllfrl.exe 37 PID 2852 wrote to memory of 2592 2852 lfllfrl.exe 37 PID 2852 wrote to memory of 2592 2852 lfllfrl.exe 37 PID 2852 wrote to memory of 2592 2852 lfllfrl.exe 37 PID 2592 wrote to memory of 2580 2592 7nbnbn.exe 38 PID 2592 wrote to memory of 2580 2592 7nbnbn.exe 38 PID 2592 wrote to memory of 2580 2592 7nbnbn.exe 38 PID 2592 wrote to memory of 2580 2592 7nbnbn.exe 38 PID 2580 wrote to memory of 2348 2580 dvjpv.exe 39 PID 2580 wrote to memory of 2348 2580 dvjpv.exe 39 PID 2580 wrote to memory of 2348 2580 dvjpv.exe 39 PID 2580 wrote to memory of 2348 2580 dvjpv.exe 39 PID 2348 wrote to memory of 636 2348 jdpjv.exe 40 PID 2348 wrote to memory of 636 2348 jdpjv.exe 40 PID 2348 wrote to memory of 636 2348 jdpjv.exe 40 PID 2348 wrote to memory of 636 2348 jdpjv.exe 40 PID 636 wrote to memory of 1792 636 3llxrrf.exe 41 PID 636 wrote to memory of 1792 636 3llxrrf.exe 41 PID 636 wrote to memory of 1792 636 3llxrrf.exe 41 PID 636 wrote to memory of 1792 636 3llxrrf.exe 41 PID 1792 wrote to memory of 2364 1792 7rlrlfr.exe 42 PID 1792 wrote to memory of 2364 1792 7rlrlfr.exe 42 PID 1792 wrote to memory of 2364 1792 7rlrlfr.exe 42 PID 1792 wrote to memory of 2364 1792 7rlrlfr.exe 42 PID 2364 wrote to memory of 1604 2364 1nnhnt.exe 43 PID 2364 wrote to memory of 1604 2364 1nnhnt.exe 43 PID 2364 wrote to memory of 1604 2364 1nnhnt.exe 43 PID 2364 wrote to memory of 1604 2364 1nnhnt.exe 43 PID 1604 wrote to memory of 1952 1604 3dpdj.exe 44 PID 1604 wrote to memory of 1952 1604 3dpdj.exe 44 PID 1604 wrote to memory of 1952 1604 3dpdj.exe 44 PID 1604 wrote to memory of 1952 1604 3dpdj.exe 44 PID 1952 wrote to memory of 772 1952 dvpdj.exe 45 PID 1952 wrote to memory of 772 1952 dvpdj.exe 45 PID 1952 wrote to memory of 772 1952 dvpdj.exe 45 PID 1952 wrote to memory of 772 1952 dvpdj.exe 45 PID 772 wrote to memory of 1320 772 rrlfxlx.exe 46 PID 772 wrote to memory of 1320 772 rrlfxlx.exe 46 PID 772 wrote to memory of 1320 772 rrlfxlx.exe 46 PID 772 wrote to memory of 1320 772 rrlfxlx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\pjdjd.exec:\pjdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\1jddv.exec:\1jddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\bthbnh.exec:\bthbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\pjvdv.exec:\pjvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\llffrrf.exec:\llffrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lfllfrl.exec:\lfllfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7nbnbn.exec:\7nbnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\dvjpv.exec:\dvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jdpjv.exec:\jdpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\3llxrrf.exec:\3llxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\7rlrlfr.exec:\7rlrlfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\1nnhnt.exec:\1nnhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\3dpdj.exec:\3dpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\dvpdj.exec:\dvpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rrlfxlx.exec:\rrlfxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe17⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hbtnbn.exec:\hbtnbn.exe18⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bbhnth.exec:\bbhnth.exe19⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dpjjd.exec:\dpjjd.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3vvjp.exec:\3vvjp.exe21⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe22⤵
- Executes dropped EXE
PID:1084 -
\??\c:\llflrll.exec:\llflrll.exe23⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ttnnbb.exec:\ttnnbb.exe24⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hbnthn.exec:\hbnthn.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ppjpv.exec:\ppjpv.exe26⤵
- Executes dropped EXE
PID:920 -
\??\c:\vpdvv.exec:\vpdvv.exe27⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rfxfllr.exec:\rfxfllr.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3rflrrf.exec:\3rflrrf.exe29⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hhbnhn.exec:\hhbnhn.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bnbbbh.exec:\bnbbbh.exe31⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vpdpd.exec:\vpdpd.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\1xfxxrr.exec:\1xfxxrr.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\llxlrfr.exec:\llxlrfr.exe34⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tthbnn.exec:\tthbnn.exe35⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nhnntb.exec:\nhnntb.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nhntbh.exec:\nhntbh.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\djvvj.exec:\djvvj.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ppjvj.exec:\ppjvj.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\5lxxffr.exec:\5lxxffr.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7rrlffl.exec:\7rrlffl.exe41⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7rlrfrl.exec:\7rlrfrl.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bbnbht.exec:\bbnbht.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\btnnbb.exec:\btnnbb.exe44⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jdpvd.exec:\jdpvd.exe45⤵
- Executes dropped EXE
PID:872 -
\??\c:\pjvdj.exec:\pjvdj.exe46⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rrrxlll.exec:\rrrxlll.exe47⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nnhthh.exec:\nnhthh.exe49⤵
- Executes dropped EXE
PID:1436 -
\??\c:\5nbtbb.exec:\5nbtbb.exe50⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7tntnh.exec:\7tntnh.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dpddp.exec:\dpddp.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\ddpvv.exec:\ddpvv.exe53⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fxrxflx.exec:\fxrxflx.exe54⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7hnthh.exec:\7hnthh.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbtthn.exec:\hbtthn.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jjvjv.exec:\jjvjv.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1jdpp.exec:\1jdpp.exe58⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ffxxxfl.exec:\ffxxxfl.exe59⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xlxlffr.exec:\xlxlffr.exe60⤵
- Executes dropped EXE
PID:996 -
\??\c:\3thnhn.exec:\3thnhn.exe61⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hnnntt.exec:\hnnntt.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\vvppd.exec:\vvppd.exe63⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xfrrxxf.exec:\xfrrxxf.exe64⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe65⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hnttbb.exec:\hnttbb.exe66⤵PID:1860
-
\??\c:\hhnnhb.exec:\hhnnhb.exe67⤵PID:2896
-
\??\c:\dpdpj.exec:\dpdpj.exe68⤵PID:2228
-
\??\c:\vpvdd.exec:\vpvdd.exe69⤵PID:1584
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe70⤵PID:3020
-
\??\c:\ffrxrxr.exec:\ffrxrxr.exe71⤵PID:1512
-
\??\c:\tbthhb.exec:\tbthhb.exe72⤵PID:1336
-
\??\c:\hnnbbt.exec:\hnnbbt.exe73⤵PID:2660
-
\??\c:\vvjpj.exec:\vvjpj.exe74⤵PID:2780
-
\??\c:\jpvvv.exec:\jpvvv.exe75⤵PID:2724
-
\??\c:\ppjpd.exec:\ppjpd.exe76⤵PID:2836
-
\??\c:\7lxfllx.exec:\7lxfllx.exe77⤵PID:2684
-
\??\c:\xlfrlfl.exec:\xlfrlfl.exe78⤵PID:2604
-
\??\c:\nnbbhh.exec:\nnbbhh.exe79⤵PID:2960
-
\??\c:\nhtbht.exec:\nhtbht.exe80⤵PID:2680
-
\??\c:\jvjpp.exec:\jvjpp.exe81⤵PID:2488
-
\??\c:\pjdjp.exec:\pjdjp.exe82⤵PID:2688
-
\??\c:\frfrlrx.exec:\frfrlrx.exe83⤵PID:1936
-
\??\c:\llfxrrx.exec:\llfxrrx.exe84⤵PID:1716
-
\??\c:\hbnbtt.exec:\hbnbtt.exe85⤵PID:1676
-
\??\c:\tnnntt.exec:\tnnntt.exe86⤵PID:1664
-
\??\c:\dpvjj.exec:\dpvjj.exe87⤵PID:1632
-
\??\c:\3vddd.exec:\3vddd.exe88⤵PID:596
-
\??\c:\9ffxxfr.exec:\9ffxxfr.exe89⤵PID:2040
-
\??\c:\btnhtt.exec:\btnhtt.exe90⤵PID:2496
-
\??\c:\tnnntn.exec:\tnnntn.exe91⤵PID:1924
-
\??\c:\djjdd.exec:\djjdd.exe92⤵PID:2032
-
\??\c:\7vjdj.exec:\7vjdj.exe93⤵PID:2988
-
\??\c:\1lllllx.exec:\1lllllx.exe94⤵PID:2808
-
\??\c:\3rlxxfr.exec:\3rlxxfr.exe95⤵PID:2272
-
\??\c:\hnthnb.exec:\hnthnb.exe96⤵PID:1516
-
\??\c:\bthhnn.exec:\bthhnn.exe97⤵PID:444
-
\??\c:\7jdpd.exec:\7jdpd.exe98⤵PID:968
-
\??\c:\jvdjp.exec:\jvdjp.exe99⤵PID:648
-
\??\c:\9rfflfx.exec:\9rfflfx.exe100⤵PID:1028
-
\??\c:\rlffffr.exec:\rlffffr.exe101⤵PID:1620
-
\??\c:\nnhbnn.exec:\nnhbnn.exe102⤵PID:1812
-
\??\c:\vppjj.exec:\vppjj.exe103⤵PID:1368
-
\??\c:\7vpvv.exec:\7vpvv.exe104⤵PID:2928
-
\??\c:\xrfflrx.exec:\xrfflrx.exe105⤵PID:896
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe106⤵PID:936
-
\??\c:\ttbntt.exec:\ttbntt.exe107⤵PID:2180
-
\??\c:\7nttbn.exec:\7nttbn.exe108⤵PID:1692
-
\??\c:\pjvdd.exec:\pjvdd.exe109⤵PID:2156
-
\??\c:\jdvdp.exec:\jdvdp.exe110⤵PID:2416
-
\??\c:\3xxxflf.exec:\3xxxflf.exe111⤵PID:572
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe112⤵PID:2768
-
\??\c:\nhbnbb.exec:\nhbnbb.exe113⤵PID:2708
-
\??\c:\9thhtb.exec:\9thhtb.exe114⤵PID:2780
-
\??\c:\9vpjv.exec:\9vpjv.exe115⤵PID:2144
-
\??\c:\pjppd.exec:\pjppd.exe116⤵PID:2716
-
\??\c:\xrfxflx.exec:\xrfxflx.exe117⤵PID:2852
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe118⤵PID:2736
-
\??\c:\tnhthn.exec:\tnhthn.exe119⤵PID:2632
-
\??\c:\bbbtnh.exec:\bbbtnh.exe120⤵PID:2680
-
\??\c:\5dppp.exec:\5dppp.exe121⤵PID:3052
-
\??\c:\dpddp.exec:\dpddp.exe122⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-