Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe
Resource
win7-20240708-en
General
-
Target
e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe
-
Size
91KB
-
MD5
b3ef64838721d804843ec6107dcee1b2
-
SHA1
7990eeb539a26ff4a4e5008e2836b0113198bc10
-
SHA256
e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542
-
SHA512
6f28cd20fbdf2c0f42ef283f33e283124803c11a57d28cb6dd63090e0d64d47364f4328da03cf2c00a40b89aae1db371d0f71e1981a7c16f403b62d4291dbf85
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRB2:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBVs
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2852-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3024 xrlfffl.exe 2236 hntttn.exe 2672 dpdjp.exe 2692 rxfxlfl.exe 2096 xfrxffx.exe 756 5tbtnh.exe 1496 jdvjd.exe 2132 pdjpv.exe 2076 7rfxfxf.exe 2984 5bhhbt.exe 2148 jpjjj.exe 2824 pjvdj.exe 2924 5xlffff.exe 1804 bhttnh.exe 668 1ppjp.exe 1328 vjpvp.exe 1772 3lxlrrr.exe 2472 rlrlxxf.exe 2280 hbbnnn.exe 2304 7pjdd.exe 1652 1djpj.exe 1008 5rxrrll.exe 2352 btnthh.exe 324 nttnhb.exe 1872 vvdvj.exe 2428 flllfxx.exe 2532 rflffxf.exe 2496 thhbbb.exe 1756 hbttbt.exe 2756 9pvpp.exe 1704 7flffff.exe 1980 rxllxfx.exe 2752 5bbbbb.exe 2992 dppjj.exe 2040 jdjpp.exe 2972 lxfxxrx.exe 700 frrlrrl.exe 1096 nbbthh.exe 1272 thhtbt.exe 1512 jppdd.exe 1688 1pdvp.exe 2380 9xfxllr.exe 2076 xlrrlff.exe 1332 thhttn.exe 2800 bnbbtt.exe 1056 vjdpp.exe 2704 jvpjp.exe 2944 frrlfxl.exe 1336 lxfxrrr.exe 3048 9flllff.exe 1452 ttnhht.exe 2056 vpdvd.exe 2508 jvppp.exe 2164 fxlrxrx.exe 2280 7rxxrlr.exe 2384 hbhntt.exe 1644 thnnbb.exe 840 jdppv.exe 1008 dpvvp.exe 1380 jvpjv.exe 2484 fxlrxfr.exe 1784 9lflxxl.exe 2092 nbtbhh.exe 2400 jpjdj.exe -
resource yara_rule behavioral1/memory/2852-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 3024 2852 e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe 30 PID 2852 wrote to memory of 3024 2852 e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe 30 PID 2852 wrote to memory of 3024 2852 e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe 30 PID 2852 wrote to memory of 3024 2852 e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe 30 PID 3024 wrote to memory of 2236 3024 xrlfffl.exe 31 PID 3024 wrote to memory of 2236 3024 xrlfffl.exe 31 PID 3024 wrote to memory of 2236 3024 xrlfffl.exe 31 PID 3024 wrote to memory of 2236 3024 xrlfffl.exe 31 PID 2236 wrote to memory of 2672 2236 hntttn.exe 32 PID 2236 wrote to memory of 2672 2236 hntttn.exe 32 PID 2236 wrote to memory of 2672 2236 hntttn.exe 32 PID 2236 wrote to memory of 2672 2236 hntttn.exe 32 PID 2672 wrote to memory of 2692 2672 dpdjp.exe 33 PID 2672 wrote to memory of 2692 2672 dpdjp.exe 33 PID 2672 wrote to memory of 2692 2672 dpdjp.exe 33 PID 2672 wrote to memory of 2692 2672 dpdjp.exe 33 PID 2692 wrote to memory of 2096 2692 rxfxlfl.exe 34 PID 2692 wrote to memory of 2096 2692 rxfxlfl.exe 34 PID 2692 wrote to memory of 2096 2692 rxfxlfl.exe 34 PID 2692 wrote to memory of 2096 2692 rxfxlfl.exe 34 PID 2096 wrote to memory of 756 2096 xfrxffx.exe 35 PID 2096 wrote to memory of 756 2096 xfrxffx.exe 35 PID 2096 wrote to memory of 756 2096 xfrxffx.exe 35 PID 2096 wrote to memory of 756 2096 xfrxffx.exe 35 PID 756 wrote to memory of 1496 756 5tbtnh.exe 36 PID 756 wrote to memory of 1496 756 5tbtnh.exe 36 PID 756 wrote to memory of 1496 756 5tbtnh.exe 36 PID 756 wrote to memory of 1496 756 5tbtnh.exe 36 PID 1496 wrote to memory of 2132 1496 jdvjd.exe 37 PID 1496 wrote to memory of 2132 1496 jdvjd.exe 37 PID 1496 wrote to memory of 2132 1496 jdvjd.exe 37 PID 1496 wrote to memory of 2132 1496 jdvjd.exe 37 PID 2132 wrote to memory of 2076 2132 pdjpv.exe 38 PID 2132 wrote to memory of 2076 2132 pdjpv.exe 38 PID 2132 wrote to memory of 2076 2132 pdjpv.exe 38 PID 2132 wrote to memory of 2076 2132 pdjpv.exe 38 PID 2076 wrote to memory of 2984 2076 7rfxfxf.exe 39 PID 2076 wrote to memory of 2984 2076 7rfxfxf.exe 39 PID 2076 wrote to memory of 2984 2076 7rfxfxf.exe 39 PID 2076 wrote to memory of 2984 2076 7rfxfxf.exe 39 PID 2984 wrote to memory of 2148 2984 5bhhbt.exe 40 PID 2984 wrote to memory of 2148 2984 5bhhbt.exe 40 PID 2984 wrote to memory of 2148 2984 5bhhbt.exe 40 PID 2984 wrote to memory of 2148 2984 5bhhbt.exe 40 PID 2148 wrote to memory of 2824 2148 jpjjj.exe 41 PID 2148 wrote to memory of 2824 2148 jpjjj.exe 41 PID 2148 wrote to memory of 2824 2148 jpjjj.exe 41 PID 2148 wrote to memory of 2824 2148 jpjjj.exe 41 PID 2824 wrote to memory of 2924 2824 pjvdj.exe 42 PID 2824 wrote to memory of 2924 2824 pjvdj.exe 42 PID 2824 wrote to memory of 2924 2824 pjvdj.exe 42 PID 2824 wrote to memory of 2924 2824 pjvdj.exe 42 PID 2924 wrote to memory of 1804 2924 5xlffff.exe 43 PID 2924 wrote to memory of 1804 2924 5xlffff.exe 43 PID 2924 wrote to memory of 1804 2924 5xlffff.exe 43 PID 2924 wrote to memory of 1804 2924 5xlffff.exe 43 PID 1804 wrote to memory of 668 1804 bhttnh.exe 44 PID 1804 wrote to memory of 668 1804 bhttnh.exe 44 PID 1804 wrote to memory of 668 1804 bhttnh.exe 44 PID 1804 wrote to memory of 668 1804 bhttnh.exe 44 PID 668 wrote to memory of 1328 668 1ppjp.exe 45 PID 668 wrote to memory of 1328 668 1ppjp.exe 45 PID 668 wrote to memory of 1328 668 1ppjp.exe 45 PID 668 wrote to memory of 1328 668 1ppjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe"C:\Users\Admin\AppData\Local\Temp\e40fc81863ad391aa95f92e5ce3690fa2a9c7aeeb6120bc47fa5865d78217542.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xrlfffl.exec:\xrlfffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\hntttn.exec:\hntttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\dpdjp.exec:\dpdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rxfxlfl.exec:\rxfxlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xfrxffx.exec:\xfrxffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\5tbtnh.exec:\5tbtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jdvjd.exec:\jdvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\pdjpv.exec:\pdjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\7rfxfxf.exec:\7rfxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\5bhhbt.exec:\5bhhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\jpjjj.exec:\jpjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pjvdj.exec:\pjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\5xlffff.exec:\5xlffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\bhttnh.exec:\bhttnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\1ppjp.exec:\1ppjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\vjpvp.exec:\vjpvp.exe17⤵
- Executes dropped EXE
PID:1328 -
\??\c:\3lxlrrr.exec:\3lxlrrr.exe18⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rlrlxxf.exec:\rlrlxxf.exe19⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbbnnn.exec:\hbbnnn.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7pjdd.exec:\7pjdd.exe21⤵
- Executes dropped EXE
PID:2304 -
\??\c:\1djpj.exec:\1djpj.exe22⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5rxrrll.exec:\5rxrrll.exe23⤵
- Executes dropped EXE
PID:1008 -
\??\c:\btnthh.exec:\btnthh.exe24⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nttnhb.exec:\nttnhb.exe25⤵
- Executes dropped EXE
PID:324 -
\??\c:\vvdvj.exec:\vvdvj.exe26⤵
- Executes dropped EXE
PID:1872 -
\??\c:\flllfxx.exec:\flllfxx.exe27⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rflffxf.exec:\rflffxf.exe28⤵
- Executes dropped EXE
PID:2532 -
\??\c:\thhbbb.exec:\thhbbb.exe29⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbttbt.exec:\hbttbt.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9pvpp.exec:\9pvpp.exe31⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7flffff.exec:\7flffff.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rxllxfx.exec:\rxllxfx.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5bbbbb.exec:\5bbbbb.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dppjj.exec:\dppjj.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jdjpp.exec:\jdjpp.exe36⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lxfxxrx.exec:\lxfxxrx.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\frrlrrl.exec:\frrlrrl.exe38⤵
- Executes dropped EXE
PID:700 -
\??\c:\nbbthh.exec:\nbbthh.exe39⤵
- Executes dropped EXE
PID:1096 -
\??\c:\thhtbt.exec:\thhtbt.exe40⤵
- Executes dropped EXE
PID:1272 -
\??\c:\jppdd.exec:\jppdd.exe41⤵
- Executes dropped EXE
PID:1512 -
\??\c:\1pdvp.exec:\1pdvp.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688 -
\??\c:\9xfxllr.exec:\9xfxllr.exe43⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xlrrlff.exec:\xlrrlff.exe44⤵
- Executes dropped EXE
PID:2076 -
\??\c:\thhttn.exec:\thhttn.exe45⤵
- Executes dropped EXE
PID:1332 -
\??\c:\bnbbtt.exec:\bnbbtt.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vjdpp.exec:\vjdpp.exe47⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jvpjp.exec:\jvpjp.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\frrlfxl.exec:\frrlfxl.exe49⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe50⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9flllff.exec:\9flllff.exe51⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ttnhht.exec:\ttnhht.exe52⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vpdvd.exec:\vpdvd.exe53⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jvppp.exec:\jvppp.exe54⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe55⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7rxxrlr.exec:\7rxxrlr.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hbhntt.exec:\hbhntt.exe57⤵
- Executes dropped EXE
PID:2384 -
\??\c:\thnnbb.exec:\thnnbb.exe58⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jdppv.exec:\jdppv.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\dpvvp.exec:\dpvvp.exe60⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jvpjv.exec:\jvpjv.exe61⤵
- Executes dropped EXE
PID:1380 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe62⤵
- Executes dropped EXE
PID:2484 -
\??\c:\9lflxxl.exec:\9lflxxl.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nbtbhh.exec:\nbtbhh.exe64⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jpjdj.exec:\jpjdj.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jdpjv.exec:\jdpjv.exe66⤵PID:2528
-
\??\c:\5rlffll.exec:\5rlffll.exe67⤵PID:1840
-
\??\c:\9rlllff.exec:\9rlllff.exe68⤵PID:2396
-
\??\c:\3lfrffx.exec:\3lfrffx.exe69⤵PID:2852
-
\??\c:\9hbhnh.exec:\9hbhnh.exe70⤵PID:2892
-
\??\c:\hbthnn.exec:\hbthnn.exe71⤵PID:1700
-
\??\c:\pdppj.exec:\pdppj.exe72⤵PID:1808
-
\??\c:\pdpdd.exec:\pdpdd.exe73⤵PID:2616
-
\??\c:\7rxxfff.exec:\7rxxfff.exe74⤵PID:2668
-
\??\c:\lxffffl.exec:\lxffffl.exe75⤵PID:2344
-
\??\c:\hbhhtb.exec:\hbhhtb.exe76⤵PID:380
-
\??\c:\3ntbtt.exec:\3ntbtt.exe77⤵PID:2084
-
\??\c:\vjvvd.exec:\vjvvd.exe78⤵PID:1632
-
\??\c:\3vpvd.exec:\3vpvd.exe79⤵PID:1408
-
\??\c:\frlfrrx.exec:\frlfrrx.exe80⤵PID:2088
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe81⤵PID:2360
-
\??\c:\bhtnbb.exec:\bhtnbb.exe82⤵PID:2388
-
\??\c:\1bnnhn.exec:\1bnnhn.exe83⤵PID:2960
-
\??\c:\hhtbhh.exec:\hhtbhh.exe84⤵PID:2604
-
\??\c:\jjvpj.exec:\jjvpj.exe85⤵PID:1952
-
\??\c:\7xrrxxf.exec:\7xrrxxf.exe86⤵PID:2824
-
\??\c:\7fxlxlr.exec:\7fxlxlr.exe87⤵PID:3052
-
\??\c:\frlrflr.exec:\frlrflr.exe88⤵PID:2044
-
\??\c:\btbtnn.exec:\btbtnn.exe89⤵PID:3056
-
\??\c:\hnhhnb.exec:\hnhhnb.exe90⤵PID:1648
-
\??\c:\vvjdd.exec:\vvjdd.exe91⤵PID:1328
-
\??\c:\dpvpv.exec:\dpvpv.exe92⤵PID:1772
-
\??\c:\lfrxxll.exec:\lfrxxll.exe93⤵PID:2436
-
\??\c:\9rxflfr.exec:\9rxflfr.exe94⤵PID:1912
-
\??\c:\lxfrlrx.exec:\lxfrlrx.exe95⤵PID:2500
-
\??\c:\btbbtt.exec:\btbbtt.exe96⤵PID:2292
-
\??\c:\bhbntb.exec:\bhbntb.exe97⤵PID:1652
-
\??\c:\jdddp.exec:\jdddp.exe98⤵PID:3036
-
\??\c:\7djdj.exec:\7djdj.exe99⤵PID:684
-
\??\c:\lxllxxf.exec:\lxllxxf.exe100⤵PID:912
-
\??\c:\7lxxllr.exec:\7lxxllr.exe101⤵PID:1540
-
\??\c:\1btbnn.exec:\1btbnn.exe102⤵PID:1680
-
\??\c:\nnnhnh.exec:\nnnhnh.exe103⤵PID:2032
-
\??\c:\jvdjd.exec:\jvdjd.exe104⤵PID:1040
-
\??\c:\9jvpv.exec:\9jvpv.exe105⤵PID:468
-
\??\c:\pjddv.exec:\pjddv.exe106⤵PID:1708
-
\??\c:\lflflll.exec:\lflflll.exe107⤵PID:2624
-
\??\c:\xxllrrr.exec:\xxllrrr.exe108⤵PID:1600
-
\??\c:\bntbnn.exec:\bntbnn.exe109⤵PID:2880
-
\??\c:\ttnbnt.exec:\ttnbnt.exe110⤵PID:2772
-
\??\c:\hbtbhh.exec:\hbtbhh.exe111⤵PID:2784
-
\??\c:\dvjjj.exec:\dvjjj.exe112⤵PID:2660
-
\??\c:\vpjvp.exec:\vpjvp.exe113⤵PID:2176
-
\??\c:\ffrxxfr.exec:\ffrxxfr.exe114⤵PID:2692
-
\??\c:\frfrflr.exec:\frfrflr.exe115⤵PID:1156
-
\??\c:\bthhnt.exec:\bthhnt.exe116⤵PID:1504
-
\??\c:\nbhbnh.exec:\nbhbnh.exe117⤵
- System Location Discovery: System Language Discovery
PID:2684 -
\??\c:\thntbb.exec:\thntbb.exe118⤵PID:2184
-
\??\c:\3jjjp.exec:\3jjjp.exe119⤵PID:2052
-
\??\c:\vjpjv.exec:\vjpjv.exe120⤵PID:2564
-
\??\c:\rfffllr.exec:\rfffllr.exe121⤵PID:1100
-
\??\c:\xrxlfll.exec:\xrxlfll.exe122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-