Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe
Resource
win7-20240704-en
General
-
Target
e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe
-
Size
93KB
-
MD5
954e07803cfaa102a921e55038b64877
-
SHA1
d8d7d8266afb45b4e3bab980c2e2faaeebe3215b
-
SHA256
e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f
-
SHA512
1a50e3a7e807252b074bf711ab6b731ce6584335953c96e89c85a4a651a001187b8509941f2f3f7f1188317d8937e75a2691b5c6b48ae05a7ee0605fabc1e0cf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIRwnohZkqwKYSpFxL:ymb3NkkiQ3mdBjFo7LAIRUohDwKY+xL
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2312-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-5289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2804 jdvdv.exe 2836 xlrxfxl.exe 2896 tnhnbb.exe 2756 dpddj.exe 2600 fxrrflr.exe 2208 nhtbht.exe 1440 pjdpv.exe 1492 1xlxlrx.exe 2976 3bbhhn.exe 2184 9hbthn.exe 2840 pjvvd.exe 2340 dppvv.exe 2496 9rxxflr.exe 884 3ntbbh.exe 2952 3nbhbn.exe 1720 jdpvv.exe 1880 lfrxflr.exe 1700 3frxffl.exe 2492 1bttbh.exe 2268 jdppv.exe 1644 5vpvd.exe 1348 5rflxxl.exe 1564 7nhtbb.exe 2216 3ttbbh.exe 2036 dvdvv.exe 2292 5rffrlf.exe 1180 thtbbh.exe 1524 bnhbtt.exe 2536 1vdjd.exe 2520 fxllxrf.exe 1580 lxrfrlr.exe 2828 5bnnnt.exe 2776 dpddp.exe 1964 vjjjd.exe 2612 xlxxxrx.exe 2700 lfllxrf.exe 2756 hnbhhb.exe 1708 tnnntn.exe 2664 7dppp.exe 2156 jvjpd.exe 320 rlxllfr.exe 1256 nhbnhh.exe 1436 nhtttt.exe 2684 ddpvj.exe 2420 dpdjp.exe 1324 3rffffr.exe 2876 frxfxff.exe 1452 nhtttt.exe 2856 ttttnh.exe 2912 3vjpp.exe 1884 djpdj.exe 2044 fxlfffr.exe 2004 frlrlrr.exe 2568 tnnnbb.exe 3012 vdpjp.exe 2052 1jddd.exe 1404 pdvvd.exe 1896 lxlrxxl.exe 3024 tthbnh.exe 3056 9thntt.exe 2484 9vddv.exe 2256 9dvjp.exe 1520 lfrrrxx.exe 1184 rlxfrrl.exe -
resource yara_rule behavioral1/memory/2312-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-5289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2804 2312 e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe 30 PID 2312 wrote to memory of 2804 2312 e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe 30 PID 2312 wrote to memory of 2804 2312 e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe 30 PID 2312 wrote to memory of 2804 2312 e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe 30 PID 2804 wrote to memory of 2836 2804 jdvdv.exe 31 PID 2804 wrote to memory of 2836 2804 jdvdv.exe 31 PID 2804 wrote to memory of 2836 2804 jdvdv.exe 31 PID 2804 wrote to memory of 2836 2804 jdvdv.exe 31 PID 2836 wrote to memory of 2896 2836 xlrxfxl.exe 32 PID 2836 wrote to memory of 2896 2836 xlrxfxl.exe 32 PID 2836 wrote to memory of 2896 2836 xlrxfxl.exe 32 PID 2836 wrote to memory of 2896 2836 xlrxfxl.exe 32 PID 2896 wrote to memory of 2756 2896 tnhnbb.exe 33 PID 2896 wrote to memory of 2756 2896 tnhnbb.exe 33 PID 2896 wrote to memory of 2756 2896 tnhnbb.exe 33 PID 2896 wrote to memory of 2756 2896 tnhnbb.exe 33 PID 2756 wrote to memory of 2600 2756 dpddj.exe 34 PID 2756 wrote to memory of 2600 2756 dpddj.exe 34 PID 2756 wrote to memory of 2600 2756 dpddj.exe 34 PID 2756 wrote to memory of 2600 2756 dpddj.exe 34 PID 2600 wrote to memory of 2208 2600 fxrrflr.exe 35 PID 2600 wrote to memory of 2208 2600 fxrrflr.exe 35 PID 2600 wrote to memory of 2208 2600 fxrrflr.exe 35 PID 2600 wrote to memory of 2208 2600 fxrrflr.exe 35 PID 2208 wrote to memory of 1440 2208 nhtbht.exe 36 PID 2208 wrote to memory of 1440 2208 nhtbht.exe 36 PID 2208 wrote to memory of 1440 2208 nhtbht.exe 36 PID 2208 wrote to memory of 1440 2208 nhtbht.exe 36 PID 1440 wrote to memory of 1492 1440 pjdpv.exe 37 PID 1440 wrote to memory of 1492 1440 pjdpv.exe 37 PID 1440 wrote to memory of 1492 1440 pjdpv.exe 37 PID 1440 wrote to memory of 1492 1440 pjdpv.exe 37 PID 1492 wrote to memory of 2976 1492 1xlxlrx.exe 38 PID 1492 wrote to memory of 2976 1492 1xlxlrx.exe 38 PID 1492 wrote to memory of 2976 1492 1xlxlrx.exe 38 PID 1492 wrote to memory of 2976 1492 1xlxlrx.exe 38 PID 2976 wrote to memory of 2184 2976 3bbhhn.exe 39 PID 2976 wrote to memory of 2184 2976 3bbhhn.exe 39 PID 2976 wrote to memory of 2184 2976 3bbhhn.exe 39 PID 2976 wrote to memory of 2184 2976 3bbhhn.exe 39 PID 2184 wrote to memory of 2840 2184 9hbthn.exe 40 PID 2184 wrote to memory of 2840 2184 9hbthn.exe 40 PID 2184 wrote to memory of 2840 2184 9hbthn.exe 40 PID 2184 wrote to memory of 2840 2184 9hbthn.exe 40 PID 2840 wrote to memory of 2340 2840 pjvvd.exe 41 PID 2840 wrote to memory of 2340 2840 pjvvd.exe 41 PID 2840 wrote to memory of 2340 2840 pjvvd.exe 41 PID 2840 wrote to memory of 2340 2840 pjvvd.exe 41 PID 2340 wrote to memory of 2496 2340 dppvv.exe 42 PID 2340 wrote to memory of 2496 2340 dppvv.exe 42 PID 2340 wrote to memory of 2496 2340 dppvv.exe 42 PID 2340 wrote to memory of 2496 2340 dppvv.exe 42 PID 2496 wrote to memory of 884 2496 9rxxflr.exe 43 PID 2496 wrote to memory of 884 2496 9rxxflr.exe 43 PID 2496 wrote to memory of 884 2496 9rxxflr.exe 43 PID 2496 wrote to memory of 884 2496 9rxxflr.exe 43 PID 884 wrote to memory of 2952 884 3ntbbh.exe 44 PID 884 wrote to memory of 2952 884 3ntbbh.exe 44 PID 884 wrote to memory of 2952 884 3ntbbh.exe 44 PID 884 wrote to memory of 2952 884 3ntbbh.exe 44 PID 2952 wrote to memory of 1720 2952 3nbhbn.exe 45 PID 2952 wrote to memory of 1720 2952 3nbhbn.exe 45 PID 2952 wrote to memory of 1720 2952 3nbhbn.exe 45 PID 2952 wrote to memory of 1720 2952 3nbhbn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe"C:\Users\Admin\AppData\Local\Temp\e11395ff46b23e134321b01af40bc2ad678588ccdb94d6ccbaa472e65de3046f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\jdvdv.exec:\jdvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xlrxfxl.exec:\xlrxfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\tnhnbb.exec:\tnhnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dpddj.exec:\dpddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxrrflr.exec:\fxrrflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nhtbht.exec:\nhtbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\pjdpv.exec:\pjdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\1xlxlrx.exec:\1xlxlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\3bbhhn.exec:\3bbhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\9hbthn.exec:\9hbthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pjvvd.exec:\pjvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dppvv.exec:\dppvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\9rxxflr.exec:\9rxxflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\3ntbbh.exec:\3ntbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\3nbhbn.exec:\3nbhbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jdpvv.exec:\jdpvv.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfrxflr.exec:\lfrxflr.exe18⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3frxffl.exec:\3frxffl.exe19⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1bttbh.exec:\1bttbh.exe20⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jdppv.exec:\jdppv.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5vpvd.exec:\5vpvd.exe22⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5rflxxl.exec:\5rflxxl.exe23⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7nhtbb.exec:\7nhtbb.exe24⤵
- Executes dropped EXE
PID:1564 -
\??\c:\3ttbbh.exec:\3ttbbh.exe25⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dvdvv.exec:\dvdvv.exe26⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5rffrlf.exec:\5rffrlf.exe27⤵
- Executes dropped EXE
PID:2292 -
\??\c:\thtbbh.exec:\thtbbh.exe28⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bnhbtt.exec:\bnhbtt.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1524 -
\??\c:\1vdjd.exec:\1vdjd.exe30⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxllxrf.exec:\fxllxrf.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lxrfrlr.exec:\lxrfrlr.exe32⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5bnnnt.exec:\5bnnnt.exe33⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dpddp.exec:\dpddp.exe34⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vjjjd.exec:\vjjjd.exe35⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe36⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfllxrf.exec:\lfllxrf.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hnbhhb.exec:\hnbhhb.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tnnntn.exec:\tnnntn.exe39⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7dppp.exec:\7dppp.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jvjpd.exec:\jvjpd.exe41⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rlxllfr.exec:\rlxllfr.exe42⤵
- Executes dropped EXE
PID:320 -
\??\c:\nhbnhh.exec:\nhbnhh.exe43⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nhtttt.exec:\nhtttt.exe44⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ddpvj.exec:\ddpvj.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dpdjp.exec:\dpdjp.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3rffffr.exec:\3rffffr.exe47⤵
- Executes dropped EXE
PID:1324 -
\??\c:\frxfxff.exec:\frxfxff.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nhtttt.exec:\nhtttt.exe49⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ttttnh.exec:\ttttnh.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3vjpp.exec:\3vjpp.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\djpdj.exec:\djpdj.exe52⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxlfffr.exec:\fxlfffr.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\frlrlrr.exec:\frlrlrr.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnnnbb.exec:\tnnnbb.exe55⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vdpjp.exec:\vdpjp.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1jddd.exec:\1jddd.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pdvvd.exec:\pdvvd.exe58⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lxlrxxl.exec:\lxlrxxl.exe59⤵
- Executes dropped EXE
PID:1896 -
\??\c:\tthbnh.exec:\tthbnh.exe60⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9thntt.exec:\9thntt.exe61⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9vddv.exec:\9vddv.exe62⤵
- Executes dropped EXE
PID:2484 -
\??\c:\9dvjp.exec:\9dvjp.exe63⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe64⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\thtthb.exec:\thtthb.exe66⤵PID:300
-
\??\c:\jvddp.exec:\jvddp.exe67⤵PID:2348
-
\??\c:\3rrrrll.exec:\3rrrrll.exe68⤵PID:2984
-
\??\c:\3lfrffr.exec:\3lfrffr.exe69⤵PID:844
-
\??\c:\btbthb.exec:\btbthb.exe70⤵PID:2232
-
\??\c:\hthntb.exec:\hthntb.exe71⤵PID:1716
-
\??\c:\5dpdj.exec:\5dpdj.exe72⤵PID:1612
-
\??\c:\dvddp.exec:\dvddp.exe73⤵PID:2796
-
\??\c:\5lfffll.exec:\5lfffll.exe74⤵PID:2908
-
\??\c:\xrlxllr.exec:\xrlxllr.exe75⤵PID:2760
-
\??\c:\tnbttn.exec:\tnbttn.exe76⤵PID:2752
-
\??\c:\nhtbbb.exec:\nhtbbb.exe77⤵PID:1944
-
\??\c:\djppj.exec:\djppj.exe78⤵PID:1376
-
\??\c:\pdjdp.exec:\pdjdp.exe79⤵PID:2452
-
\??\c:\frrrxrl.exec:\frrrxrl.exe80⤵PID:2236
-
\??\c:\frxfffl.exec:\frxfffl.exe81⤵PID:2412
-
\??\c:\bnbhbt.exec:\bnbhbt.exe82⤵PID:2932
-
\??\c:\hbtnhn.exec:\hbtnhn.exe83⤵PID:2200
-
\??\c:\9jdpv.exec:\9jdpv.exe84⤵PID:2976
-
\??\c:\1djdd.exec:\1djdd.exe85⤵PID:2160
-
\??\c:\fxrxllf.exec:\fxrxllf.exe86⤵PID:1924
-
\??\c:\lrxflll.exec:\lrxflll.exe87⤵PID:1940
-
\??\c:\hthhtb.exec:\hthhtb.exe88⤵PID:1444
-
\??\c:\5tnnbb.exec:\5tnnbb.exe89⤵PID:2496
-
\??\c:\pvdjj.exec:\pvdjj.exe90⤵PID:2844
-
\??\c:\vjvpd.exec:\vjvpd.exe91⤵PID:984
-
\??\c:\3vjpp.exec:\3vjpp.exe92⤵PID:1660
-
\??\c:\rlrxflx.exec:\rlrxflx.exe93⤵PID:2000
-
\??\c:\rfxrlrf.exec:\rfxrlrf.exe94⤵PID:2540
-
\??\c:\tbhntb.exec:\tbhntb.exe95⤵PID:1124
-
\??\c:\nbnhhb.exec:\nbnhhb.exe96⤵PID:2272
-
\??\c:\pjpvd.exec:\pjpvd.exe97⤵PID:1780
-
\??\c:\9vvvd.exec:\9vvvd.exe98⤵PID:2192
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe99⤵PID:1584
-
\??\c:\frxffff.exec:\frxffff.exe100⤵PID:716
-
\??\c:\htttbb.exec:\htttbb.exe101⤵PID:804
-
\??\c:\httntn.exec:\httntn.exe102⤵PID:1752
-
\??\c:\3pddd.exec:\3pddd.exe103⤵PID:2220
-
\??\c:\9vjjd.exec:\9vjjd.exe104⤵PID:2672
-
\??\c:\1jvpd.exec:\1jvpd.exe105⤵PID:2292
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe106⤵PID:1180
-
\??\c:\xllrrrx.exec:\xllrrrx.exe107⤵PID:2248
-
\??\c:\1hnhtn.exec:\1hnhtn.exe108⤵PID:1692
-
\??\c:\nbhnnn.exec:\nbhnnn.exe109⤵PID:1960
-
\??\c:\jdjdj.exec:\jdjdj.exe110⤵PID:2068
-
\??\c:\1pddd.exec:\1pddd.exe111⤵PID:2740
-
\??\c:\xlrxfxf.exec:\xlrxfxf.exe112⤵PID:2728
-
\??\c:\rlffrlx.exec:\rlffrlx.exe113⤵PID:2892
-
\??\c:\hbhhbn.exec:\hbhhbn.exe114⤵PID:2620
-
\??\c:\hbhnnt.exec:\hbhnnt.exe115⤵PID:2968
-
\??\c:\5dvdd.exec:\5dvdd.exe116⤵PID:2640
-
\??\c:\vjpvv.exec:\vjpvv.exe117⤵PID:2584
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe118⤵PID:2644
-
\??\c:\9lrrrrx.exec:\9lrrrrx.exe119⤵PID:536
-
\??\c:\nbnttt.exec:\nbnttt.exe120⤵PID:1164
-
\??\c:\bthbbb.exec:\bthbbb.exe121⤵PID:588
-
\??\c:\vjppj.exec:\vjppj.exe122⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-