Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 01:50
Static task
static1
Behavioral task
behavioral1
Sample
a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe
Resource
win7-20240708-en
General
-
Target
a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe
-
Size
371KB
-
MD5
a4c4de95a1866f36fc52d17e342a3348
-
SHA1
fc4764d039be85124990823c6bbe7a4a7453a867
-
SHA256
a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91
-
SHA512
11f658d90a44e1dbdb3389efbd0f06401a3f53f968680b2eab0671ad95a92f6d5670629987c56b57b145d83f420028adae44404eb75a35200d09dc6a4cd45e35
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVw8:n3C9uYA7okVqdKwaO5CV5
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/964-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/680-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/968-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 9rxrffl.exe 2756 7lrfxlx.exe 2888 vvpdj.exe 2816 frffllx.exe 2824 bnbbbt.exe 2688 jvddv.exe 2660 3rlrlfr.exe 2832 ddppd.exe 1916 xxfrlxr.exe 2068 hbnnbn.exe 2620 dvjpd.exe 2568 xrrrxxl.exe 2204 tnttnt.exe 2996 vjddd.exe 3004 1hbhtt.exe 2980 nnnbnn.exe 448 xrflxfl.exe 680 5httth.exe 2088 5pjvj.exe 2368 rrxllxx.exe 2328 dvjdp.exe 580 9lxflrx.exe 1528 tnbbnn.exe 1920 rrxlxrx.exe 2080 tnbbhh.exe 1888 btthnb.exe 2496 1frrffr.exe 968 nnhnbh.exe 1312 dvjjv.exe 1984 7lxlllr.exe 2248 dvpdp.exe 2544 lfxlxrx.exe 1668 hhbbnn.exe 2000 jddpv.exe 2804 rrrrxrf.exe 2968 5nbnhh.exe 2788 bnbbtt.exe 764 dpddv.exe 2700 3lxxllx.exe 2708 1nnntn.exe 2672 djpjv.exe 1536 vvdpv.exe 280 xrfrxxl.exe 2936 ttntbn.exe 2516 5vdjj.exe 1744 xrfrxfr.exe 2572 tntbht.exe 476 9jddp.exe 2648 vpjpv.exe 1924 1flxflr.exe 2996 nhnttt.exe 2384 3hthtb.exe 2308 vpdjp.exe 820 rflxfrx.exe 308 bthntb.exe 680 7bhhhh.exe 2380 pdvdj.exe 532 rffxfxf.exe 736 lrrfxlf.exe 892 btbnnt.exe 580 dpddj.exe 1784 9lfrflx.exe 2264 rlrllff.exe 2072 nhbhtb.exe -
resource yara_rule behavioral1/memory/964-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/680-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/968-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxlrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 1996 964 a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe 30 PID 964 wrote to memory of 1996 964 a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe 30 PID 964 wrote to memory of 1996 964 a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe 30 PID 964 wrote to memory of 1996 964 a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe 30 PID 1996 wrote to memory of 2756 1996 9rxrffl.exe 31 PID 1996 wrote to memory of 2756 1996 9rxrffl.exe 31 PID 1996 wrote to memory of 2756 1996 9rxrffl.exe 31 PID 1996 wrote to memory of 2756 1996 9rxrffl.exe 31 PID 2756 wrote to memory of 2888 2756 7lrfxlx.exe 32 PID 2756 wrote to memory of 2888 2756 7lrfxlx.exe 32 PID 2756 wrote to memory of 2888 2756 7lrfxlx.exe 32 PID 2756 wrote to memory of 2888 2756 7lrfxlx.exe 32 PID 2888 wrote to memory of 2816 2888 vvpdj.exe 33 PID 2888 wrote to memory of 2816 2888 vvpdj.exe 33 PID 2888 wrote to memory of 2816 2888 vvpdj.exe 33 PID 2888 wrote to memory of 2816 2888 vvpdj.exe 33 PID 2816 wrote to memory of 2824 2816 frffllx.exe 34 PID 2816 wrote to memory of 2824 2816 frffllx.exe 34 PID 2816 wrote to memory of 2824 2816 frffllx.exe 34 PID 2816 wrote to memory of 2824 2816 frffllx.exe 34 PID 2824 wrote to memory of 2688 2824 bnbbbt.exe 35 PID 2824 wrote to memory of 2688 2824 bnbbbt.exe 35 PID 2824 wrote to memory of 2688 2824 bnbbbt.exe 35 PID 2824 wrote to memory of 2688 2824 bnbbbt.exe 35 PID 2688 wrote to memory of 2660 2688 jvddv.exe 36 PID 2688 wrote to memory of 2660 2688 jvddv.exe 36 PID 2688 wrote to memory of 2660 2688 jvddv.exe 36 PID 2688 wrote to memory of 2660 2688 jvddv.exe 36 PID 2660 wrote to memory of 2832 2660 3rlrlfr.exe 37 PID 2660 wrote to memory of 2832 2660 3rlrlfr.exe 37 PID 2660 wrote to memory of 2832 2660 3rlrlfr.exe 37 PID 2660 wrote to memory of 2832 2660 3rlrlfr.exe 37 PID 2832 wrote to memory of 1916 2832 ddppd.exe 38 PID 2832 wrote to memory of 1916 2832 ddppd.exe 38 PID 2832 wrote to memory of 1916 2832 ddppd.exe 38 PID 2832 wrote to memory of 1916 2832 ddppd.exe 38 PID 1916 wrote to memory of 2068 1916 xxfrlxr.exe 39 PID 1916 wrote to memory of 2068 1916 xxfrlxr.exe 39 PID 1916 wrote to memory of 2068 1916 xxfrlxr.exe 39 PID 1916 wrote to memory of 2068 1916 xxfrlxr.exe 39 PID 2068 wrote to memory of 2620 2068 hbnnbn.exe 40 PID 2068 wrote to memory of 2620 2068 hbnnbn.exe 40 PID 2068 wrote to memory of 2620 2068 hbnnbn.exe 40 PID 2068 wrote to memory of 2620 2068 hbnnbn.exe 40 PID 2620 wrote to memory of 2568 2620 dvjpd.exe 41 PID 2620 wrote to memory of 2568 2620 dvjpd.exe 41 PID 2620 wrote to memory of 2568 2620 dvjpd.exe 41 PID 2620 wrote to memory of 2568 2620 dvjpd.exe 41 PID 2568 wrote to memory of 2204 2568 xrrrxxl.exe 42 PID 2568 wrote to memory of 2204 2568 xrrrxxl.exe 42 PID 2568 wrote to memory of 2204 2568 xrrrxxl.exe 42 PID 2568 wrote to memory of 2204 2568 xrrrxxl.exe 42 PID 2204 wrote to memory of 2996 2204 tnttnt.exe 43 PID 2204 wrote to memory of 2996 2204 tnttnt.exe 43 PID 2204 wrote to memory of 2996 2204 tnttnt.exe 43 PID 2204 wrote to memory of 2996 2204 tnttnt.exe 43 PID 2996 wrote to memory of 3004 2996 vjddd.exe 44 PID 2996 wrote to memory of 3004 2996 vjddd.exe 44 PID 2996 wrote to memory of 3004 2996 vjddd.exe 44 PID 2996 wrote to memory of 3004 2996 vjddd.exe 44 PID 3004 wrote to memory of 2980 3004 1hbhtt.exe 45 PID 3004 wrote to memory of 2980 3004 1hbhtt.exe 45 PID 3004 wrote to memory of 2980 3004 1hbhtt.exe 45 PID 3004 wrote to memory of 2980 3004 1hbhtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe"C:\Users\Admin\AppData\Local\Temp\a96070bb942b77a847c3857a91a77d934f311b8e924423a3d0cedda3fae34a91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\9rxrffl.exec:\9rxrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\7lrfxlx.exec:\7lrfxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vvpdj.exec:\vvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\frffllx.exec:\frffllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bnbbbt.exec:\bnbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jvddv.exec:\jvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\3rlrlfr.exec:\3rlrlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ddppd.exec:\ddppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xxfrlxr.exec:\xxfrlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbnnbn.exec:\hbnnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\dvjpd.exec:\dvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tnttnt.exec:\tnttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vjddd.exec:\vjddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\1hbhtt.exec:\1hbhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\nnnbnn.exec:\nnnbnn.exe17⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrflxfl.exec:\xrflxfl.exe18⤵
- Executes dropped EXE
PID:448 -
\??\c:\5httth.exec:\5httth.exe19⤵
- Executes dropped EXE
PID:680 -
\??\c:\5pjvj.exec:\5pjvj.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rrxllxx.exec:\rrxllxx.exe21⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dvjdp.exec:\dvjdp.exe22⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9lxflrx.exec:\9lxflrx.exe23⤵
- Executes dropped EXE
PID:580 -
\??\c:\tnbbnn.exec:\tnbbnn.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rrxlxrx.exec:\rrxlxrx.exe25⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tnbbhh.exec:\tnbbhh.exe26⤵
- Executes dropped EXE
PID:2080 -
\??\c:\btthnb.exec:\btthnb.exe27⤵
- Executes dropped EXE
PID:1888 -
\??\c:\1frrffr.exec:\1frrffr.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nnhnbh.exec:\nnhnbh.exe29⤵
- Executes dropped EXE
PID:968 -
\??\c:\dvjjv.exec:\dvjjv.exe30⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7lxlllr.exec:\7lxlllr.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvpdp.exec:\dvpdp.exe32⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfxlxrx.exec:\lfxlxrx.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hhbbnn.exec:\hhbbnn.exe34⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jddpv.exec:\jddpv.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrrrxrf.exec:\rrrrxrf.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\5nbnhh.exec:\5nbnhh.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\bnbbtt.exec:\bnbbtt.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dpddv.exec:\dpddv.exe39⤵
- Executes dropped EXE
PID:764 -
\??\c:\3lxxllx.exec:\3lxxllx.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1nnntn.exec:\1nnntn.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\djpjv.exec:\djpjv.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vvdpv.exec:\vvdpv.exe43⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe44⤵
- Executes dropped EXE
PID:280 -
\??\c:\ttntbn.exec:\ttntbn.exe45⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5vdjj.exec:\5vdjj.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe47⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tntbht.exec:\tntbht.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9jddp.exec:\9jddp.exe49⤵
- Executes dropped EXE
PID:476 -
\??\c:\vpjpv.exec:\vpjpv.exe50⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1flxflr.exec:\1flxflr.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nhnttt.exec:\nhnttt.exe52⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3hthtb.exec:\3hthtb.exe53⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vpdjp.exec:\vpdjp.exe54⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rflxfrx.exec:\rflxfrx.exe55⤵
- Executes dropped EXE
PID:820 -
\??\c:\bthntb.exec:\bthntb.exe56⤵
- Executes dropped EXE
PID:308 -
\??\c:\7bhhhh.exec:\7bhhhh.exe57⤵
- Executes dropped EXE
PID:680 -
\??\c:\pdvdj.exec:\pdvdj.exe58⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rffxfxf.exec:\rffxfxf.exe59⤵
- Executes dropped EXE
PID:532 -
\??\c:\lrrfxlf.exec:\lrrfxlf.exe60⤵
- Executes dropped EXE
PID:736 -
\??\c:\btbnnt.exec:\btbnnt.exe61⤵
- Executes dropped EXE
PID:892 -
\??\c:\dpddj.exec:\dpddj.exe62⤵
- Executes dropped EXE
PID:580 -
\??\c:\9lfrflx.exec:\9lfrflx.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rlrllff.exec:\rlrllff.exe64⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nhbhtb.exec:\nhbhtb.exe65⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjpvv.exec:\pjpvv.exe66⤵PID:1880
-
\??\c:\xflffff.exec:\xflffff.exe67⤵PID:2448
-
\??\c:\fxxfrrf.exec:\fxxfrrf.exe68⤵PID:2496
-
\??\c:\nhbhth.exec:\nhbhth.exe69⤵PID:1740
-
\??\c:\pjddd.exec:\pjddd.exe70⤵PID:1600
-
\??\c:\dvvvj.exec:\dvvvj.exe71⤵PID:856
-
\??\c:\3rxfflr.exec:\3rxfflr.exe72⤵PID:304
-
\??\c:\5tbbhh.exec:\5tbbhh.exe73⤵PID:688
-
\??\c:\htthtn.exec:\htthtn.exe74⤵PID:2268
-
\??\c:\ppjdp.exec:\ppjdp.exe75⤵PID:1996
-
\??\c:\fffrrrr.exec:\fffrrrr.exe76⤵PID:2812
-
\??\c:\bhbhbb.exec:\bhbhbb.exe77⤵PID:2916
-
\??\c:\hbbhtt.exec:\hbbhtt.exe78⤵PID:2668
-
\??\c:\5dvvv.exec:\5dvvv.exe79⤵PID:2816
-
\??\c:\xxrxrxf.exec:\xxrxrxf.exe80⤵PID:2800
-
\??\c:\1lxffll.exec:\1lxffll.exe81⤵PID:2564
-
\??\c:\ttnthn.exec:\ttnthn.exe82⤵PID:2692
-
\??\c:\pjdjv.exec:\pjdjv.exe83⤵PID:2680
-
\??\c:\7jdpv.exec:\7jdpv.exe84⤵PID:1696
-
\??\c:\fflrrlr.exec:\fflrrlr.exe85⤵PID:3008
-
\??\c:\5hnbbn.exec:\5hnbbn.exe86⤵PID:2504
-
\??\c:\1dddj.exec:\1dddj.exe87⤵PID:2068
-
\??\c:\jdvdp.exec:\jdvdp.exe88⤵PID:1640
-
\??\c:\xrxfllr.exec:\xrxfllr.exe89⤵PID:1976
-
\??\c:\btnbnt.exec:\btnbnt.exe90⤵PID:2752
-
\??\c:\hhbhnb.exec:\hhbhnb.exe91⤵PID:2732
-
\??\c:\3djpd.exec:\3djpd.exe92⤵PID:2932
-
\??\c:\frxffxx.exec:\frxffxx.exe93⤵
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\btbtbb.exec:\btbtbb.exe94⤵PID:2524
-
\??\c:\nbnhtt.exec:\nbnhtt.exe95⤵PID:1840
-
\??\c:\1pjpd.exec:\1pjpd.exe96⤵PID:1764
-
\??\c:\xrffflr.exec:\xrffflr.exe97⤵PID:940
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe98⤵PID:1896
-
\??\c:\hbbntb.exec:\hbbntb.exe99⤵PID:264
-
\??\c:\hhbbnt.exec:\hhbbnt.exe100⤵PID:1956
-
\??\c:\jdjvj.exec:\jdjvj.exe101⤵PID:2552
-
\??\c:\3xrflxf.exec:\3xrflxf.exe102⤵PID:492
-
\??\c:\bttbnn.exec:\bttbnn.exe103⤵PID:1528
-
\??\c:\hhhnnb.exec:\hhhnnb.exe104⤵PID:2244
-
\??\c:\pjvdv.exec:\pjvdv.exe105⤵PID:2748
-
\??\c:\xrflrfr.exec:\xrflrfr.exe106⤵PID:1884
-
\??\c:\tnhthh.exec:\tnhthh.exe107⤵PID:1880
-
\??\c:\tnhtbn.exec:\tnhtbn.exe108⤵PID:2492
-
\??\c:\pdppv.exec:\pdppv.exe109⤵PID:2020
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe110⤵PID:2408
-
\??\c:\frfffxl.exec:\frfffxl.exe111⤵PID:1600
-
\??\c:\lrlxxlr.exec:\lrlxxlr.exe112⤵PID:1488
-
\??\c:\3httnh.exec:\3httnh.exe113⤵PID:1720
-
\??\c:\3dpvp.exec:\3dpvp.exe114⤵PID:2860
-
\??\c:\rfrrflr.exec:\rfrrflr.exe115⤵PID:1652
-
\??\c:\bhnntb.exec:\bhnntb.exe116⤵PID:1996
-
\??\c:\3djjd.exec:\3djjd.exe117⤵PID:2892
-
\??\c:\5frfrlx.exec:\5frfrlx.exe118⤵PID:2968
-
\??\c:\ttnbtn.exec:\ttnbtn.exe119⤵PID:1112
-
\??\c:\jdjvd.exec:\jdjvd.exe120⤵PID:2796
-
\??\c:\fxllxrf.exec:\fxllxrf.exe121⤵PID:2820
-
\??\c:\frflrrf.exec:\frflrrf.exe122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-