Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f2e5b9f12497d50407f5581dc4e9d4e0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
f2e5b9f12497d50407f5581dc4e9d4e0N.exe
-
Size
86KB
-
MD5
f2e5b9f12497d50407f5581dc4e9d4e0
-
SHA1
51013be31cfdc31724009052c1f85caf69d8bb05
-
SHA256
5e95509de25fbbfc03d6a9606bbc9abe5c3fb1c4990b8e2881118de2e9ef5534
-
SHA512
9e4c83527421c19365ba774d8e92a81899d7ead9024dee5469146e6b7e158fe0d1893062179734cb7c6c7b4f542861f4cebc7c5108ea465d15445275f28634af
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufT7Y:ymb3NkkiQ3mdBjFodt27HobvcyLuf4
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2076-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 9bhhtb.exe 2548 jdpvv.exe 2924 xxlrxxf.exe 592 rlxxffr.exe 2884 tnhtbh.exe 2740 jpjpp.exe 2640 rrrrrxx.exe 2780 tnbtbh.exe 2600 vvjdp.exe 2232 3dvpd.exe 1604 5rrrfrf.exe 1092 bnbtth.exe 1392 nhthnh.exe 1440 pjvdj.exe 356 1xrxrfl.exe 856 3nhhbb.exe 804 nnbnnt.exe 2696 ppvdp.exe 2708 rlxfrfl.exe 2156 xrlxllr.exe 2992 ttbhbh.exe 2816 jjdjv.exe 1124 ppjvj.exe 836 1lflrxr.exe 764 nbttbh.exe 768 hhnbnn.exe 2572 pdppd.exe 2280 3xrlrrf.exe 1220 bhhttn.exe 884 vjppv.exe 2356 vvdpv.exe 2544 ffrxlxx.exe 2688 5tntbh.exe 2800 hnhbhn.exe 3000 jvdjp.exe 1700 jdpvv.exe 2864 1xxlxfx.exe 2860 ffrlxxl.exe 2932 tnnbbh.exe 2920 nnhnnt.exe 2840 vpjdj.exe 2640 xrrxllr.exe 2780 fxllrrl.exe 2660 1nbbhh.exe 2600 bbbbnt.exe 2272 pjvjv.exe 1604 dpdpj.exe 1500 lxrlrrf.exe 1204 rrrflxf.exe 1448 hbnthn.exe 1724 hhttnh.exe 2000 jdvpp.exe 300 5jdjd.exe 1328 5fflrfl.exe 2804 frfxxrr.exe 2796 bhhbhb.exe 2432 nhttbb.exe 2448 5vpvd.exe 2964 vpjjj.exe 568 3lxrrfx.exe 2936 3rflxfl.exe 1288 1lrrxlx.exe 632 htnbht.exe 396 9dvvp.exe -
resource yara_rule behavioral1/memory/2076-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 1980 2076 f2e5b9f12497d50407f5581dc4e9d4e0N.exe 30 PID 2076 wrote to memory of 1980 2076 f2e5b9f12497d50407f5581dc4e9d4e0N.exe 30 PID 2076 wrote to memory of 1980 2076 f2e5b9f12497d50407f5581dc4e9d4e0N.exe 30 PID 2076 wrote to memory of 1980 2076 f2e5b9f12497d50407f5581dc4e9d4e0N.exe 30 PID 1980 wrote to memory of 2548 1980 9bhhtb.exe 31 PID 1980 wrote to memory of 2548 1980 9bhhtb.exe 31 PID 1980 wrote to memory of 2548 1980 9bhhtb.exe 31 PID 1980 wrote to memory of 2548 1980 9bhhtb.exe 31 PID 2548 wrote to memory of 2924 2548 jdpvv.exe 32 PID 2548 wrote to memory of 2924 2548 jdpvv.exe 32 PID 2548 wrote to memory of 2924 2548 jdpvv.exe 32 PID 2548 wrote to memory of 2924 2548 jdpvv.exe 32 PID 2924 wrote to memory of 592 2924 xxlrxxf.exe 33 PID 2924 wrote to memory of 592 2924 xxlrxxf.exe 33 PID 2924 wrote to memory of 592 2924 xxlrxxf.exe 33 PID 2924 wrote to memory of 592 2924 xxlrxxf.exe 33 PID 592 wrote to memory of 2884 592 rlxxffr.exe 34 PID 592 wrote to memory of 2884 592 rlxxffr.exe 34 PID 592 wrote to memory of 2884 592 rlxxffr.exe 34 PID 592 wrote to memory of 2884 592 rlxxffr.exe 34 PID 2884 wrote to memory of 2740 2884 tnhtbh.exe 35 PID 2884 wrote to memory of 2740 2884 tnhtbh.exe 35 PID 2884 wrote to memory of 2740 2884 tnhtbh.exe 35 PID 2884 wrote to memory of 2740 2884 tnhtbh.exe 35 PID 2740 wrote to memory of 2640 2740 jpjpp.exe 36 PID 2740 wrote to memory of 2640 2740 jpjpp.exe 36 PID 2740 wrote to memory of 2640 2740 jpjpp.exe 36 PID 2740 wrote to memory of 2640 2740 jpjpp.exe 36 PID 2640 wrote to memory of 2780 2640 rrrrrxx.exe 37 PID 2640 wrote to memory of 2780 2640 rrrrrxx.exe 37 PID 2640 wrote to memory of 2780 2640 rrrrrxx.exe 37 PID 2640 wrote to memory of 2780 2640 rrrrrxx.exe 37 PID 2780 wrote to memory of 2600 2780 tnbtbh.exe 38 PID 2780 wrote to memory of 2600 2780 tnbtbh.exe 38 PID 2780 wrote to memory of 2600 2780 tnbtbh.exe 38 PID 2780 wrote to memory of 2600 2780 tnbtbh.exe 38 PID 2600 wrote to memory of 2232 2600 vvjdp.exe 39 PID 2600 wrote to memory of 2232 2600 vvjdp.exe 39 PID 2600 wrote to memory of 2232 2600 vvjdp.exe 39 PID 2600 wrote to memory of 2232 2600 vvjdp.exe 39 PID 2232 wrote to memory of 1604 2232 3dvpd.exe 40 PID 2232 wrote to memory of 1604 2232 3dvpd.exe 40 PID 2232 wrote to memory of 1604 2232 3dvpd.exe 40 PID 2232 wrote to memory of 1604 2232 3dvpd.exe 40 PID 1604 wrote to memory of 1092 1604 5rrrfrf.exe 41 PID 1604 wrote to memory of 1092 1604 5rrrfrf.exe 41 PID 1604 wrote to memory of 1092 1604 5rrrfrf.exe 41 PID 1604 wrote to memory of 1092 1604 5rrrfrf.exe 41 PID 1092 wrote to memory of 1392 1092 bnbtth.exe 42 PID 1092 wrote to memory of 1392 1092 bnbtth.exe 42 PID 1092 wrote to memory of 1392 1092 bnbtth.exe 42 PID 1092 wrote to memory of 1392 1092 bnbtth.exe 42 PID 1392 wrote to memory of 1440 1392 nhthnh.exe 43 PID 1392 wrote to memory of 1440 1392 nhthnh.exe 43 PID 1392 wrote to memory of 1440 1392 nhthnh.exe 43 PID 1392 wrote to memory of 1440 1392 nhthnh.exe 43 PID 1440 wrote to memory of 356 1440 pjvdj.exe 44 PID 1440 wrote to memory of 356 1440 pjvdj.exe 44 PID 1440 wrote to memory of 356 1440 pjvdj.exe 44 PID 1440 wrote to memory of 356 1440 pjvdj.exe 44 PID 356 wrote to memory of 856 356 1xrxrfl.exe 45 PID 356 wrote to memory of 856 356 1xrxrfl.exe 45 PID 356 wrote to memory of 856 356 1xrxrfl.exe 45 PID 356 wrote to memory of 856 356 1xrxrfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2e5b9f12497d50407f5581dc4e9d4e0N.exe"C:\Users\Admin\AppData\Local\Temp\f2e5b9f12497d50407f5581dc4e9d4e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\9bhhtb.exec:\9bhhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jdpvv.exec:\jdpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rlxxffr.exec:\rlxxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\tnhtbh.exec:\tnhtbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\jpjpp.exec:\jpjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tnbtbh.exec:\tnbtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vvjdp.exec:\vvjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\3dvpd.exec:\3dvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\5rrrfrf.exec:\5rrrfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\bnbtth.exec:\bnbtth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\nhthnh.exec:\nhthnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\pjvdj.exec:\pjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\1xrxrfl.exec:\1xrxrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
\??\c:\3nhhbb.exec:\3nhhbb.exe17⤵
- Executes dropped EXE
PID:856 -
\??\c:\nnbnnt.exec:\nnbnnt.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\ppvdp.exec:\ppvdp.exe19⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlxfrfl.exec:\rlxfrfl.exe20⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xrlxllr.exec:\xrlxllr.exe21⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ttbhbh.exec:\ttbhbh.exe22⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jjdjv.exec:\jjdjv.exe23⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ppjvj.exec:\ppjvj.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1lflrxr.exec:\1lflrxr.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\nbttbh.exec:\nbttbh.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\hhnbnn.exec:\hhnbnn.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\pdppd.exec:\pdppd.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3xrlrrf.exec:\3xrlrrf.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bhhttn.exec:\bhhttn.exe30⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vjppv.exec:\vjppv.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\vvdpv.exec:\vvdpv.exe32⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ffrxlxx.exec:\ffrxlxx.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5tntbh.exec:\5tntbh.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hnhbhn.exec:\hnhbhn.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jvdjp.exec:\jvdjp.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jdpvv.exec:\jdpvv.exe37⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1xxlxfx.exec:\1xxlxfx.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tnnbbh.exec:\tnnbbh.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nnhnnt.exec:\nnhnnt.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vpjdj.exec:\vpjdj.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xrrxllr.exec:\xrrxllr.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fxllrrl.exec:\fxllrrl.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1nbbhh.exec:\1nbbhh.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bbbbnt.exec:\bbbbnt.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pjvjv.exec:\pjvjv.exe47⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dpdpj.exec:\dpdpj.exe48⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxrlrrf.exec:\lxrlrrf.exe49⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rrrflxf.exec:\rrrflxf.exe50⤵
- Executes dropped EXE
PID:1204 -
\??\c:\hbnthn.exec:\hbnthn.exe51⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hhttnh.exec:\hhttnh.exe52⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jdvpp.exec:\jdvpp.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\5jdjd.exec:\5jdjd.exe54⤵
- Executes dropped EXE
PID:300 -
\??\c:\5fflrfl.exec:\5fflrfl.exe55⤵
- Executes dropped EXE
PID:1328 -
\??\c:\frfxxrr.exec:\frfxxrr.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bhhbhb.exec:\bhhbhb.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nhttbb.exec:\nhttbb.exe58⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5vpvd.exec:\5vpvd.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpjjj.exec:\vpjjj.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3lxrrfx.exec:\3lxrrfx.exe61⤵
- Executes dropped EXE
PID:568 -
\??\c:\3rflxfl.exec:\3rflxfl.exe62⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1lrrxlx.exec:\1lrrxlx.exe63⤵
- Executes dropped EXE
PID:1288 -
\??\c:\htnbht.exec:\htnbht.exe64⤵
- Executes dropped EXE
PID:632 -
\??\c:\9dvvp.exec:\9dvvp.exe65⤵
- Executes dropped EXE
PID:396 -
\??\c:\jjddj.exec:\jjddj.exe66⤵PID:808
-
\??\c:\7lrlrxr.exec:\7lrlrxr.exe67⤵PID:2444
-
\??\c:\llfrlrr.exec:\llfrlrr.exe68⤵PID:2300
-
\??\c:\rlxflrf.exec:\rlxflrf.exe69⤵PID:1068
-
\??\c:\5httbb.exec:\5httbb.exe70⤵PID:2408
-
\??\c:\5djpd.exec:\5djpd.exe71⤵PID:884
-
\??\c:\3vpdj.exec:\3vpdj.exe72⤵PID:1756
-
\??\c:\7lfrffr.exec:\7lfrffr.exe73⤵PID:1256
-
\??\c:\lfffrrf.exec:\lfffrrf.exe74⤵PID:2324
-
\??\c:\7tthth.exec:\7tthth.exe75⤵PID:2688
-
\??\c:\3ntntn.exec:\3ntntn.exe76⤵PID:2384
-
\??\c:\pdvdv.exec:\pdvdv.exe77⤵PID:3000
-
\??\c:\3ppdj.exec:\3ppdj.exe78⤵PID:2700
-
\??\c:\1lrxrfl.exec:\1lrxrfl.exe79⤵PID:2864
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe80⤵PID:2792
-
\??\c:\9nnhbn.exec:\9nnhbn.exe81⤵PID:2932
-
\??\c:\hhhtbn.exec:\hhhtbn.exe82⤵PID:2360
-
\??\c:\dddjd.exec:\dddjd.exe83⤵PID:2652
-
\??\c:\9pdjd.exec:\9pdjd.exe84⤵PID:2636
-
\??\c:\3xfrrfx.exec:\3xfrrfx.exe85⤵PID:2780
-
\??\c:\5xrfrff.exec:\5xrfrff.exe86⤵PID:2160
-
\??\c:\nnntbb.exec:\nnntbb.exe87⤵PID:2600
-
\??\c:\hbhnnn.exec:\hbhnnn.exe88⤵PID:1520
-
\??\c:\3pvdj.exec:\3pvdj.exe89⤵PID:1604
-
\??\c:\vvpvj.exec:\vvpvj.exe90⤵PID:1932
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe91⤵PID:1204
-
\??\c:\rlrllfx.exec:\rlrllfx.exe92⤵PID:1448
-
\??\c:\tnbhnt.exec:\tnbhnt.exe93⤵PID:1984
-
\??\c:\dpjvv.exec:\dpjvv.exe94⤵PID:308
-
\??\c:\vpvdp.exec:\vpvdp.exe95⤵PID:300
-
\??\c:\lxlflll.exec:\lxlflll.exe96⤵PID:1328
-
\??\c:\lllfrxl.exec:\lllfrxl.exe97⤵PID:2804
-
\??\c:\nhbntn.exec:\nhbntn.exe98⤵PID:2184
-
\??\c:\5hthtb.exec:\5hthtb.exe99⤵PID:2432
-
\??\c:\vvjpd.exec:\vvjpd.exe100⤵PID:2984
-
\??\c:\1pdpv.exec:\1pdpv.exe101⤵PID:2816
-
\??\c:\3fffrxl.exec:\3fffrxl.exe102⤵PID:2852
-
\??\c:\lfrxlrr.exec:\lfrxlrr.exe103⤵PID:2936
-
\??\c:\ttbhnb.exec:\ttbhnb.exe104⤵PID:764
-
\??\c:\1hhntb.exec:\1hhntb.exe105⤵PID:632
-
\??\c:\ddvdj.exec:\ddvdj.exe106⤵PID:396
-
\??\c:\vvjdj.exec:\vvjdj.exe107⤵PID:808
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe108⤵PID:1484
-
\??\c:\1fxxxxr.exec:\1fxxxxr.exe109⤵PID:2300
-
\??\c:\hbhnbb.exec:\hbhnbb.exe110⤵PID:1068
-
\??\c:\1htbhn.exec:\1htbhn.exe111⤵PID:2408
-
\??\c:\1jjpd.exec:\1jjpd.exe112⤵PID:800
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe113⤵PID:1756
-
\??\c:\rfrxflr.exec:\rfrxflr.exe114⤵PID:2516
-
\??\c:\tnbhnt.exec:\tnbhnt.exe115⤵PID:2324
-
\??\c:\nhtbbb.exec:\nhtbbb.exe116⤵PID:1552
-
\??\c:\5dvdv.exec:\5dvdv.exe117⤵PID:1568
-
\??\c:\vjdjj.exec:\vjdjj.exe118⤵PID:592
-
\??\c:\xxrxfxf.exec:\xxrxfxf.exe119⤵PID:2700
-
\??\c:\xxlfxlr.exec:\xxlfxlr.exe120⤵PID:2900
-
\??\c:\rlrrffl.exec:\rlrrffl.exe121⤵PID:2792
-
\??\c:\thbhbn.exec:\thbhbn.exe122⤵PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-