Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe
Resource
win7-20240903-en
General
-
Target
b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe
-
Size
64KB
-
MD5
9a6b6b4f4e785bb958c9f7081c82add4
-
SHA1
edaa8204e0b1bdf788abdbdba554bb45a06630cb
-
SHA256
b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36
-
SHA512
d5ccf6c5f1adb6fc31463e77a10c5dfaf8e8d5dc65d508074e19027629332a834c7cea7356923423dab3eb1cce46e187a46dfddf8c5477b737bef20472cd949a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPt5:ymb3NkkiQ3mdBjFIj+qX
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2512-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2104 xfrllrx.exe 2920 tnbtnt.exe 2204 5vppj.exe 2788 rllxlrl.exe 2936 nthtnn.exe 2816 7bttbt.exe 2692 xrffxxf.exe 2576 flrllll.exe 3016 3ddjd.exe 2756 dvjvd.exe 568 rlxxllr.exe 2376 1rfrxlr.exe 1896 nhbbhn.exe 780 dvjvj.exe 1256 ppddp.exe 2912 rrlxxlx.exe 2184 btnbtb.exe 2408 hththb.exe 1428 jvvpj.exe 668 flfxfxf.exe 2536 rfrxfrf.exe 2528 bthntb.exe 692 3jddp.exe 1948 vjvdd.exe 1216 xxrfrxr.exe 2072 rrffrrf.exe 2740 5bnbnt.exe 1008 9bttbb.exe 2088 dvvvj.exe 2336 pddpp.exe 2076 lxxfrxl.exe 1644 3bhhnt.exe 2664 tththn.exe 2780 5ddjd.exe 2844 vdppv.exe 2788 rlrfffr.exe 2936 1xflfxf.exe 2768 9thntb.exe 2816 nbhhnt.exe 2560 pddpv.exe 2676 jvdjj.exe 2208 vjppp.exe 2084 9xffrxl.exe 2656 fxxxfll.exe 1628 hbbhht.exe 2372 thtthh.exe 1676 vdjdd.exe 1672 xlllxrx.exe 1524 xrxflrx.exe 756 xrflrfx.exe 2908 nhnnhn.exe 2360 jdjpp.exe 2432 pjvpv.exe 2128 jdjpd.exe 1512 lfrrxxf.exe 408 tnbntn.exe 668 3nbthh.exe 960 nnhnhn.exe 2268 dpjpv.exe 1940 jpdpv.exe 1960 fxlrxxf.exe 2140 xlxfffr.exe 564 btbbbh.exe 1640 hbnnbb.exe -
resource yara_rule behavioral1/memory/2512-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2104 2512 b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe 31 PID 2512 wrote to memory of 2104 2512 b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe 31 PID 2512 wrote to memory of 2104 2512 b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe 31 PID 2512 wrote to memory of 2104 2512 b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe 31 PID 2104 wrote to memory of 2920 2104 xfrllrx.exe 32 PID 2104 wrote to memory of 2920 2104 xfrllrx.exe 32 PID 2104 wrote to memory of 2920 2104 xfrllrx.exe 32 PID 2104 wrote to memory of 2920 2104 xfrllrx.exe 32 PID 2920 wrote to memory of 2204 2920 tnbtnt.exe 33 PID 2920 wrote to memory of 2204 2920 tnbtnt.exe 33 PID 2920 wrote to memory of 2204 2920 tnbtnt.exe 33 PID 2920 wrote to memory of 2204 2920 tnbtnt.exe 33 PID 2204 wrote to memory of 2788 2204 5vppj.exe 34 PID 2204 wrote to memory of 2788 2204 5vppj.exe 34 PID 2204 wrote to memory of 2788 2204 5vppj.exe 34 PID 2204 wrote to memory of 2788 2204 5vppj.exe 34 PID 2788 wrote to memory of 2936 2788 rllxlrl.exe 35 PID 2788 wrote to memory of 2936 2788 rllxlrl.exe 35 PID 2788 wrote to memory of 2936 2788 rllxlrl.exe 35 PID 2788 wrote to memory of 2936 2788 rllxlrl.exe 35 PID 2936 wrote to memory of 2816 2936 nthtnn.exe 36 PID 2936 wrote to memory of 2816 2936 nthtnn.exe 36 PID 2936 wrote to memory of 2816 2936 nthtnn.exe 36 PID 2936 wrote to memory of 2816 2936 nthtnn.exe 36 PID 2816 wrote to memory of 2692 2816 7bttbt.exe 37 PID 2816 wrote to memory of 2692 2816 7bttbt.exe 37 PID 2816 wrote to memory of 2692 2816 7bttbt.exe 37 PID 2816 wrote to memory of 2692 2816 7bttbt.exe 37 PID 2692 wrote to memory of 2576 2692 xrffxxf.exe 38 PID 2692 wrote to memory of 2576 2692 xrffxxf.exe 38 PID 2692 wrote to memory of 2576 2692 xrffxxf.exe 38 PID 2692 wrote to memory of 2576 2692 xrffxxf.exe 38 PID 2576 wrote to memory of 3016 2576 flrllll.exe 39 PID 2576 wrote to memory of 3016 2576 flrllll.exe 39 PID 2576 wrote to memory of 3016 2576 flrllll.exe 39 PID 2576 wrote to memory of 3016 2576 flrllll.exe 39 PID 3016 wrote to memory of 2756 3016 3ddjd.exe 40 PID 3016 wrote to memory of 2756 3016 3ddjd.exe 40 PID 3016 wrote to memory of 2756 3016 3ddjd.exe 40 PID 3016 wrote to memory of 2756 3016 3ddjd.exe 40 PID 2756 wrote to memory of 568 2756 dvjvd.exe 41 PID 2756 wrote to memory of 568 2756 dvjvd.exe 41 PID 2756 wrote to memory of 568 2756 dvjvd.exe 41 PID 2756 wrote to memory of 568 2756 dvjvd.exe 41 PID 568 wrote to memory of 2376 568 rlxxllr.exe 42 PID 568 wrote to memory of 2376 568 rlxxllr.exe 42 PID 568 wrote to memory of 2376 568 rlxxllr.exe 42 PID 568 wrote to memory of 2376 568 rlxxllr.exe 42 PID 2376 wrote to memory of 1896 2376 1rfrxlr.exe 43 PID 2376 wrote to memory of 1896 2376 1rfrxlr.exe 43 PID 2376 wrote to memory of 1896 2376 1rfrxlr.exe 43 PID 2376 wrote to memory of 1896 2376 1rfrxlr.exe 43 PID 1896 wrote to memory of 780 1896 nhbbhn.exe 44 PID 1896 wrote to memory of 780 1896 nhbbhn.exe 44 PID 1896 wrote to memory of 780 1896 nhbbhn.exe 44 PID 1896 wrote to memory of 780 1896 nhbbhn.exe 44 PID 780 wrote to memory of 1256 780 dvjvj.exe 45 PID 780 wrote to memory of 1256 780 dvjvj.exe 45 PID 780 wrote to memory of 1256 780 dvjvj.exe 45 PID 780 wrote to memory of 1256 780 dvjvj.exe 45 PID 1256 wrote to memory of 2912 1256 ppddp.exe 46 PID 1256 wrote to memory of 2912 1256 ppddp.exe 46 PID 1256 wrote to memory of 2912 1256 ppddp.exe 46 PID 1256 wrote to memory of 2912 1256 ppddp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe"C:\Users\Admin\AppData\Local\Temp\b0caad2c7f83a89d0cc9a391cf2f871355a1fd63f0f821164035d382b79faf36.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xfrllrx.exec:\xfrllrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\tnbtnt.exec:\tnbtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\5vppj.exec:\5vppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\rllxlrl.exec:\rllxlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\nthtnn.exec:\nthtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\7bttbt.exec:\7bttbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xrffxxf.exec:\xrffxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\flrllll.exec:\flrllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\3ddjd.exec:\3ddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\dvjvd.exec:\dvjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rlxxllr.exec:\rlxxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\1rfrxlr.exec:\1rfrxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\nhbbhn.exec:\nhbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\dvjvj.exec:\dvjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\ppddp.exec:\ppddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\rrlxxlx.exec:\rrlxxlx.exe17⤵
- Executes dropped EXE
PID:2912 -
\??\c:\btnbtb.exec:\btnbtb.exe18⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hththb.exec:\hththb.exe19⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jvvpj.exec:\jvvpj.exe20⤵
- Executes dropped EXE
PID:1428 -
\??\c:\flfxfxf.exec:\flfxfxf.exe21⤵
- Executes dropped EXE
PID:668 -
\??\c:\rfrxfrf.exec:\rfrxfrf.exe22⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bthntb.exec:\bthntb.exe23⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3jddp.exec:\3jddp.exe24⤵
- Executes dropped EXE
PID:692 -
\??\c:\vjvdd.exec:\vjvdd.exe25⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xxrfrxr.exec:\xxrfrxr.exe26⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rrffrrf.exec:\rrffrrf.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5bnbnt.exec:\5bnbnt.exe28⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9bttbb.exec:\9bttbb.exe29⤵
- Executes dropped EXE
PID:1008 -
\??\c:\dvvvj.exec:\dvvvj.exe30⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pddpp.exec:\pddpp.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lxxfrxl.exec:\lxxfrxl.exe32⤵
- Executes dropped EXE
PID:2076 -
\??\c:\3bhhnt.exec:\3bhhnt.exe33⤵
- Executes dropped EXE
PID:1644 -
\??\c:\tththn.exec:\tththn.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5ddjd.exec:\5ddjd.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vdppv.exec:\vdppv.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rlrfffr.exec:\rlrfffr.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1xflfxf.exec:\1xflfxf.exe38⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9thntb.exec:\9thntb.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nbhhnt.exec:\nbhhnt.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pddpv.exec:\pddpv.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jvdjj.exec:\jvdjj.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjppp.exec:\vjppp.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9xffrxl.exec:\9xffrxl.exe44⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fxxxfll.exec:\fxxxfll.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbbhht.exec:\hbbhht.exe46⤵
- Executes dropped EXE
PID:1628 -
\??\c:\thtthh.exec:\thtthh.exe47⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vdjdd.exec:\vdjdd.exe48⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xlllxrx.exec:\xlllxrx.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrxflrx.exec:\xrxflrx.exe50⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xrflrfx.exec:\xrflrfx.exe51⤵
- Executes dropped EXE
PID:756 -
\??\c:\nhnnhn.exec:\nhnnhn.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jdjpp.exec:\jdjpp.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pjvpv.exec:\pjvpv.exe54⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jdjpd.exec:\jdjpd.exe55⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe56⤵
- Executes dropped EXE
PID:1512 -
\??\c:\tnbntn.exec:\tnbntn.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\3nbthh.exec:\3nbthh.exe58⤵
- Executes dropped EXE
PID:668 -
\??\c:\nnhnhn.exec:\nnhnhn.exe59⤵
- Executes dropped EXE
PID:960 -
\??\c:\dpjpv.exec:\dpjpv.exe60⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jpdpv.exec:\jpdpv.exe61⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe62⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xlxfffr.exec:\xlxfffr.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\btbbbh.exec:\btbbbh.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\hbnnbb.exec:\hbnnbb.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jpjpd.exec:\jpjpd.exe66⤵PID:340
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe67⤵PID:1956
-
\??\c:\lffxlll.exec:\lffxlll.exe68⤵PID:1008
-
\??\c:\nbbtbb.exec:\nbbtbb.exe69⤵PID:2088
-
\??\c:\nhhntb.exec:\nhhntb.exe70⤵PID:600
-
\??\c:\hbtttb.exec:\hbtttb.exe71⤵PID:1540
-
\??\c:\ppvjp.exec:\ppvjp.exe72⤵PID:1548
-
\??\c:\5dddj.exec:\5dddj.exe73⤵PID:2700
-
\??\c:\7frxxxf.exec:\7frxxxf.exe74⤵PID:2828
-
\??\c:\xlrxllx.exec:\xlrxllx.exe75⤵PID:2712
-
\??\c:\bbbtth.exec:\bbbtth.exe76⤵PID:2932
-
\??\c:\hbhtth.exec:\hbhtth.exe77⤵PID:2848
-
\??\c:\dvdpj.exec:\dvdpj.exe78⤵PID:2888
-
\??\c:\pjjdv.exec:\pjjdv.exe79⤵PID:2832
-
\??\c:\vjddd.exec:\vjddd.exe80⤵PID:2608
-
\??\c:\5xxffll.exec:\5xxffll.exe81⤵PID:2508
-
\??\c:\7xfxflr.exec:\7xfxflr.exe82⤵PID:2068
-
\??\c:\5thnbb.exec:\5thnbb.exe83⤵PID:1596
-
\??\c:\hthttb.exec:\hthttb.exe84⤵PID:280
-
\??\c:\jjvdp.exec:\jjvdp.exe85⤵PID:2292
-
\??\c:\dvjvj.exec:\dvjvj.exe86⤵PID:2748
-
\??\c:\7jddj.exec:\7jddj.exe87⤵PID:1364
-
\??\c:\xxlfrxf.exec:\xxlfrxf.exe88⤵PID:1456
-
\??\c:\7rrxfrf.exec:\7rrxfrf.exe89⤵PID:1228
-
\??\c:\7hthnt.exec:\7hthnt.exe90⤵PID:1524
-
\??\c:\bbnthn.exec:\bbnthn.exe91⤵PID:2904
-
\??\c:\djpvp.exec:\djpvp.exe92⤵PID:2916
-
\??\c:\jdjjd.exec:\jdjjd.exe93⤵PID:2404
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe94⤵PID:2216
-
\??\c:\3lfrxfx.exec:\3lfrxfx.exe95⤵PID:912
-
\??\c:\9lfflrx.exec:\9lfflrx.exe96⤵PID:2024
-
\??\c:\hbtbbt.exec:\hbtbbt.exe97⤵PID:856
-
\??\c:\vjvdp.exec:\vjvdp.exe98⤵PID:2136
-
\??\c:\vpjpd.exec:\vpjpd.exe99⤵PID:1376
-
\??\c:\vpjjd.exec:\vpjjd.exe100⤵PID:1928
-
\??\c:\3hhhnh.exec:\3hhhnh.exe101⤵PID:788
-
\??\c:\bhnnbb.exec:\bhnnbb.exe102⤵PID:108
-
\??\c:\tbhnbn.exec:\tbhnbn.exe103⤵PID:2256
-
\??\c:\vjppj.exec:\vjppj.exe104⤵PID:1588
-
\??\c:\dpddd.exec:\dpddd.exe105⤵PID:884
-
\??\c:\lfrllrx.exec:\lfrllrx.exe106⤵PID:2968
-
\??\c:\3lxfrxx.exec:\3lxfrxx.exe107⤵PID:1956
-
\??\c:\3tnttt.exec:\3tnttt.exe108⤵PID:2492
-
\??\c:\nbbthb.exec:\nbbthb.exe109⤵PID:2344
-
\??\c:\pjjdd.exec:\pjjdd.exe110⤵PID:1648
-
\??\c:\vpjjd.exec:\vpjjd.exe111⤵PID:2240
-
\??\c:\ffxffrl.exec:\ffxffrl.exe112⤵PID:1548
-
\??\c:\9lxffff.exec:\9lxffff.exe113⤵PID:2700
-
\??\c:\1thhnt.exec:\1thhnt.exe114⤵PID:2680
-
\??\c:\nbnhnn.exec:\nbnhnn.exe115⤵PID:2820
-
\??\c:\pdjjp.exec:\pdjjp.exe116⤵PID:2892
-
\??\c:\dvjjv.exec:\dvjjv.exe117⤵PID:2368
-
\??\c:\7lxfflx.exec:\7lxfflx.exe118⤵PID:2612
-
\??\c:\lflxlxl.exec:\lflxlxl.exe119⤵PID:2728
-
\??\c:\9bthtb.exec:\9bthtb.exe120⤵PID:3008
-
\??\c:\ttttbb.exec:\ttttbb.exe121⤵PID:1636
-
\??\c:\5pdpj.exec:\5pdpj.exe122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-