Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a70452c242e05c369eaea355195d600N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
8a70452c242e05c369eaea355195d600N.exe
-
Size
445KB
-
MD5
8a70452c242e05c369eaea355195d600
-
SHA1
b69b7cce0137fe213088af52cd702fc8e5a4139c
-
SHA256
5b3c04c6d97746fd514c2be784aabce7af36049d41fee7e0927107b8228a3d33
-
SHA512
23f8a5a116661aea008dc8b8a238d1fbee340c326263966738641780b1542361894035602af5bb548d810aea7792a0d05574722319a777a1a192395f42d8ceb0
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09Jg:n3C9ytvn8whkb4i3e3GFO6Jg
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3004-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 dppvd.exe 2604 xxrxrxf.exe 2600 jdddj.exe 2740 hhbbtb.exe 2624 1jdpv.exe 2492 tbthbn.exe 2032 vjddp.exe 832 1btbnn.exe 2880 1pjjd.exe 1460 tnbhnb.exe 2844 jddvj.exe 772 xlrrrlx.exe 2712 5hbnbh.exe 1148 5dvvj.exe 1628 llxlrrl.exe 892 5nbbtn.exe 3052 xfffrlr.exe 2300 nnbthn.exe 944 vpjpd.exe 1644 7lxxlrf.exe 688 nttntb.exe 1840 rlfrffx.exe 1540 fxrxflr.exe 2028 jdppj.exe 2276 ffrfrxf.exe 1332 vvdjp.exe 2272 llrrxfl.exe 1812 hnhhth.exe 2944 1pdvj.exe 3048 nnbhnb.exe 1692 9vddj.exe 2584 tttbtn.exe 2732 bnbbbt.exe 2904 rllfrrf.exe 2896 rxrlllr.exe 2836 tnhnbb.exe 2740 7pvdj.exe 2460 ppjpd.exe 2632 xxlxfxr.exe 3060 btntnt.exe 320 pjdjv.exe 1636 fxxxrlf.exe 1576 tnhbnt.exe 1964 tnnbnt.exe 2636 pppvj.exe 1460 rfxxllx.exe 2844 xxxxllx.exe 2760 1btbnt.exe 436 1vpvd.exe 1132 rfxxlrf.exe 872 thhnbb.exe 1628 5pjjj.exe 2096 vdvjv.exe 2104 frfrxxx.exe 548 tttnth.exe 1776 dpddd.exe 944 rlflxlx.exe 348 tnhttn.exe 820 tbthbh.exe 2092 jdddp.exe 2540 5rfxlrl.exe 2024 ntbbnn.exe 1736 9pppp.exe 2884 7xrxxlf.exe -
resource yara_rule behavioral1/memory/3004-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-312-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2552 3004 8a70452c242e05c369eaea355195d600N.exe 30 PID 3004 wrote to memory of 2552 3004 8a70452c242e05c369eaea355195d600N.exe 30 PID 3004 wrote to memory of 2552 3004 8a70452c242e05c369eaea355195d600N.exe 30 PID 3004 wrote to memory of 2552 3004 8a70452c242e05c369eaea355195d600N.exe 30 PID 2552 wrote to memory of 2604 2552 dppvd.exe 31 PID 2552 wrote to memory of 2604 2552 dppvd.exe 31 PID 2552 wrote to memory of 2604 2552 dppvd.exe 31 PID 2552 wrote to memory of 2604 2552 dppvd.exe 31 PID 2604 wrote to memory of 2600 2604 xxrxrxf.exe 32 PID 2604 wrote to memory of 2600 2604 xxrxrxf.exe 32 PID 2604 wrote to memory of 2600 2604 xxrxrxf.exe 32 PID 2604 wrote to memory of 2600 2604 xxrxrxf.exe 32 PID 2600 wrote to memory of 2740 2600 jdddj.exe 33 PID 2600 wrote to memory of 2740 2600 jdddj.exe 33 PID 2600 wrote to memory of 2740 2600 jdddj.exe 33 PID 2600 wrote to memory of 2740 2600 jdddj.exe 33 PID 2740 wrote to memory of 2624 2740 hhbbtb.exe 34 PID 2740 wrote to memory of 2624 2740 hhbbtb.exe 34 PID 2740 wrote to memory of 2624 2740 hhbbtb.exe 34 PID 2740 wrote to memory of 2624 2740 hhbbtb.exe 34 PID 2624 wrote to memory of 2492 2624 1jdpv.exe 35 PID 2624 wrote to memory of 2492 2624 1jdpv.exe 35 PID 2624 wrote to memory of 2492 2624 1jdpv.exe 35 PID 2624 wrote to memory of 2492 2624 1jdpv.exe 35 PID 2492 wrote to memory of 2032 2492 tbthbn.exe 36 PID 2492 wrote to memory of 2032 2492 tbthbn.exe 36 PID 2492 wrote to memory of 2032 2492 tbthbn.exe 36 PID 2492 wrote to memory of 2032 2492 tbthbn.exe 36 PID 2032 wrote to memory of 832 2032 vjddp.exe 37 PID 2032 wrote to memory of 832 2032 vjddp.exe 37 PID 2032 wrote to memory of 832 2032 vjddp.exe 37 PID 2032 wrote to memory of 832 2032 vjddp.exe 37 PID 832 wrote to memory of 2880 832 1btbnn.exe 38 PID 832 wrote to memory of 2880 832 1btbnn.exe 38 PID 832 wrote to memory of 2880 832 1btbnn.exe 38 PID 832 wrote to memory of 2880 832 1btbnn.exe 38 PID 2880 wrote to memory of 1460 2880 1pjjd.exe 39 PID 2880 wrote to memory of 1460 2880 1pjjd.exe 39 PID 2880 wrote to memory of 1460 2880 1pjjd.exe 39 PID 2880 wrote to memory of 1460 2880 1pjjd.exe 39 PID 1460 wrote to memory of 2844 1460 tnbhnb.exe 40 PID 1460 wrote to memory of 2844 1460 tnbhnb.exe 40 PID 1460 wrote to memory of 2844 1460 tnbhnb.exe 40 PID 1460 wrote to memory of 2844 1460 tnbhnb.exe 40 PID 2844 wrote to memory of 772 2844 jddvj.exe 41 PID 2844 wrote to memory of 772 2844 jddvj.exe 41 PID 2844 wrote to memory of 772 2844 jddvj.exe 41 PID 2844 wrote to memory of 772 2844 jddvj.exe 41 PID 772 wrote to memory of 2712 772 xlrrrlx.exe 42 PID 772 wrote to memory of 2712 772 xlrrrlx.exe 42 PID 772 wrote to memory of 2712 772 xlrrrlx.exe 42 PID 772 wrote to memory of 2712 772 xlrrrlx.exe 42 PID 2712 wrote to memory of 1148 2712 5hbnbh.exe 43 PID 2712 wrote to memory of 1148 2712 5hbnbh.exe 43 PID 2712 wrote to memory of 1148 2712 5hbnbh.exe 43 PID 2712 wrote to memory of 1148 2712 5hbnbh.exe 43 PID 1148 wrote to memory of 1628 1148 5dvvj.exe 44 PID 1148 wrote to memory of 1628 1148 5dvvj.exe 44 PID 1148 wrote to memory of 1628 1148 5dvvj.exe 44 PID 1148 wrote to memory of 1628 1148 5dvvj.exe 44 PID 1628 wrote to memory of 892 1628 llxlrrl.exe 45 PID 1628 wrote to memory of 892 1628 llxlrrl.exe 45 PID 1628 wrote to memory of 892 1628 llxlrrl.exe 45 PID 1628 wrote to memory of 892 1628 llxlrrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a70452c242e05c369eaea355195d600N.exe"C:\Users\Admin\AppData\Local\Temp\8a70452c242e05c369eaea355195d600N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\dppvd.exec:\dppvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xxrxrxf.exec:\xxrxrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jdddj.exec:\jdddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hhbbtb.exec:\hhbbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\1jdpv.exec:\1jdpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\tbthbn.exec:\tbthbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\vjddp.exec:\vjddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\1btbnn.exec:\1btbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\1pjjd.exec:\1pjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tnbhnb.exec:\tnbhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\jddvj.exec:\jddvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xlrrrlx.exec:\xlrrrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\5hbnbh.exec:\5hbnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5dvvj.exec:\5dvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\llxlrrl.exec:\llxlrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\5nbbtn.exec:\5nbbtn.exe17⤵
- Executes dropped EXE
PID:892 -
\??\c:\xfffrlr.exec:\xfffrlr.exe18⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nnbthn.exec:\nnbthn.exe19⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vpjpd.exec:\vpjpd.exe20⤵
- Executes dropped EXE
PID:944 -
\??\c:\7lxxlrf.exec:\7lxxlrf.exe21⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nttntb.exec:\nttntb.exe22⤵
- Executes dropped EXE
PID:688 -
\??\c:\rlfrffx.exec:\rlfrffx.exe23⤵
- Executes dropped EXE
PID:1840 -
\??\c:\fxrxflr.exec:\fxrxflr.exe24⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jdppj.exec:\jdppj.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe26⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vvdjp.exec:\vvdjp.exe27⤵
- Executes dropped EXE
PID:1332 -
\??\c:\llrrxfl.exec:\llrrxfl.exe28⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hnhhth.exec:\hnhhth.exe29⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1pdvj.exec:\1pdvj.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nnbhnb.exec:\nnbhnb.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9vddj.exec:\9vddj.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tttbtn.exec:\tttbtn.exe33⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bnbbbt.exec:\bnbbbt.exe34⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rllfrrf.exec:\rllfrrf.exe35⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rxrlllr.exec:\rxrlllr.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tnhnbb.exec:\tnhnbb.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7pvdj.exec:\7pvdj.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ppjpd.exec:\ppjpd.exe39⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xxlxfxr.exec:\xxlxfxr.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\btntnt.exec:\btntnt.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjdjv.exec:\pjdjv.exe42⤵
- Executes dropped EXE
PID:320 -
\??\c:\fxxxrlf.exec:\fxxxrlf.exe43⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tnhbnt.exec:\tnhbnt.exe44⤵
- Executes dropped EXE
PID:1576 -
\??\c:\tnnbnt.exec:\tnnbnt.exe45⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pppvj.exec:\pppvj.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rfxxllx.exec:\rfxxllx.exe47⤵
- Executes dropped EXE
PID:1460 -
\??\c:\xxxxllx.exec:\xxxxllx.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1btbnt.exec:\1btbnt.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\1vpvd.exec:\1vpvd.exe50⤵
- Executes dropped EXE
PID:436 -
\??\c:\rfxxlrf.exec:\rfxxlrf.exe51⤵
- Executes dropped EXE
PID:1132 -
\??\c:\thhnbb.exec:\thhnbb.exe52⤵
- Executes dropped EXE
PID:872 -
\??\c:\5pjjj.exec:\5pjjj.exe53⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vdvjv.exec:\vdvjv.exe54⤵
- Executes dropped EXE
PID:2096 -
\??\c:\frfrxxx.exec:\frfrxxx.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tttnth.exec:\tttnth.exe56⤵
- Executes dropped EXE
PID:548 -
\??\c:\dpddd.exec:\dpddd.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rlflxlx.exec:\rlflxlx.exe58⤵
- Executes dropped EXE
PID:944 -
\??\c:\tnhttn.exec:\tnhttn.exe59⤵
- Executes dropped EXE
PID:348 -
\??\c:\tbthbh.exec:\tbthbh.exe60⤵
- Executes dropped EXE
PID:820 -
\??\c:\jdddp.exec:\jdddp.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5rfxlrl.exec:\5rfxlrl.exe62⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ntbbnn.exec:\ntbbnn.exe63⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9pppp.exec:\9pppp.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7xrxxlf.exec:\7xrxxlf.exe65⤵
- Executes dropped EXE
PID:2884 -
\??\c:\thttbb.exec:\thttbb.exe66⤵PID:972
-
\??\c:\9nhhhb.exec:\9nhhhb.exe67⤵PID:996
-
\??\c:\dvjjv.exec:\dvjjv.exe68⤵PID:1912
-
\??\c:\lxrfflr.exec:\lxrfflr.exe69⤵PID:1648
-
\??\c:\1btthn.exec:\1btthn.exe70⤵PID:1304
-
\??\c:\3pjvj.exec:\3pjvj.exe71⤵PID:1704
-
\??\c:\vpjpd.exec:\vpjpd.exe72⤵PID:1988
-
\??\c:\rlxxffr.exec:\rlxxffr.exe73⤵PID:2344
-
\??\c:\thtbhn.exec:\thtbhn.exe74⤵PID:2616
-
\??\c:\hntntb.exec:\hntntb.exe75⤵PID:2468
-
\??\c:\7jvjv.exec:\7jvjv.exe76⤵PID:2904
-
\??\c:\frfrxxf.exec:\frfrxxf.exe77⤵PID:2896
-
\??\c:\xxlxrff.exec:\xxlxrff.exe78⤵PID:2688
-
\??\c:\jjvjp.exec:\jjvjp.exe79⤵PID:2456
-
\??\c:\pdpvv.exec:\pdpvv.exe80⤵PID:2984
-
\??\c:\xllrflf.exec:\xllrflf.exe81⤵PID:1684
-
\??\c:\bbtnbh.exec:\bbtnbh.exe82⤵PID:1384
-
\??\c:\nhtbnb.exec:\nhtbnb.exe83⤵PID:2808
-
\??\c:\pjdjv.exec:\pjdjv.exe84⤵PID:332
-
\??\c:\fxllrrf.exec:\fxllrrf.exe85⤵PID:2440
-
\??\c:\lfxflrf.exec:\lfxflrf.exe86⤵PID:2828
-
\??\c:\1btthn.exec:\1btthn.exe87⤵PID:2420
-
\??\c:\dddvj.exec:\dddvj.exe88⤵PID:2920
-
\??\c:\3rfflxf.exec:\3rfflxf.exe89⤵PID:2768
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe90⤵PID:2188
-
\??\c:\7hnhhh.exec:\7hnhhh.exe91⤵PID:2136
-
\??\c:\pvvpd.exec:\pvvpd.exe92⤵PID:2316
-
\??\c:\flflrfl.exec:\flflrfl.exe93⤵PID:2168
-
\??\c:\bbbbhb.exec:\bbbbhb.exe94⤵PID:2888
-
\??\c:\7tnnbh.exec:\7tnnbh.exe95⤵PID:2352
-
\??\c:\jjdpd.exec:\jjdpd.exe96⤵PID:2068
-
\??\c:\xlxxffr.exec:\xlxxffr.exe97⤵PID:1856
-
\??\c:\tbbhnt.exec:\tbbhnt.exe98⤵PID:2248
-
\??\c:\tnhnbh.exec:\tnhnbh.exe99⤵PID:2364
-
\??\c:\1pjjv.exec:\1pjjv.exe100⤵PID:2052
-
\??\c:\ffxlxfl.exec:\ffxlxfl.exe101⤵PID:1824
-
\??\c:\3rrxrxf.exec:\3rrxrxf.exe102⤵PID:2816
-
\??\c:\7nhhnt.exec:\7nhhnt.exe103⤵PID:3036
-
\??\c:\5hhnbb.exec:\5hhnbb.exe104⤵PID:2240
-
\??\c:\1pdjp.exec:\1pdjp.exe105⤵PID:2276
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe106⤵PID:2752
-
\??\c:\rrlrrrf.exec:\rrlrrrf.exe107⤵PID:1508
-
\??\c:\nnbhtt.exec:\nnbhtt.exe108⤵PID:1348
-
\??\c:\vvvjv.exec:\vvvjv.exe109⤵PID:2380
-
\??\c:\rlxlrxr.exec:\rlxlrxr.exe110⤵PID:1648
-
\??\c:\3hhntb.exec:\3hhntb.exe111⤵PID:1596
-
\??\c:\3ntbnn.exec:\3ntbnn.exe112⤵PID:2660
-
\??\c:\dvddd.exec:\dvddd.exe113⤵PID:2680
-
\??\c:\dvppj.exec:\dvppj.exe114⤵PID:2700
-
\??\c:\3ffllrf.exec:\3ffllrf.exe115⤵PID:2692
-
\??\c:\1bntbh.exec:\1bntbh.exe116⤵PID:2600
-
\??\c:\nhhntt.exec:\nhhntt.exe117⤵PID:2832
-
\??\c:\jdvvj.exec:\jdvvj.exe118⤵PID:2508
-
\??\c:\3rlrrxl.exec:\3rlrrxl.exe119⤵PID:2536
-
\??\c:\7lllrfr.exec:\7lllrfr.exe120⤵PID:2492
-
\??\c:\hhbhbh.exec:\hhbhbh.exe121⤵PID:2528
-
\??\c:\rllfrlx.exec:\rllfrlx.exe122⤵PID:2192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-