Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9478348dce232b0241b58c4950b4f00N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
a9478348dce232b0241b58c4950b4f00N.exe
-
Size
235KB
-
MD5
a9478348dce232b0241b58c4950b4f00
-
SHA1
86fdc37b9cb82c063c95cb617e118d6b4d311c36
-
SHA256
be47ab4df2488b814a89cbc04dd02fd32820831a3895f2fdd05ce8020d345c73
-
SHA512
a197da7904169439b8ea9d85f23417b61460cf29c8f9d9083386c2a264402c0820ed40caca3e26412d721b3dbe45a3003cc9844f9f260b5f96951c49903b1825
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjRVZEW:n3C9BRo7MlrWKo+lxtvGtVZEW
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1956-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/392-286-0x0000000077730000-0x000000007784F000-memory.dmp family_blackmoon behavioral1/memory/2360-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 7btnnn.exe 2664 5djjj.exe 2676 bthnnn.exe 2252 thnnbh.exe 2540 lxrrxrf.exe 2520 nhhbbb.exe 3052 3jvpp.exe 2756 fllxrrr.exe 2708 bbbbtn.exe 2764 7jvvd.exe 2888 lflxfxf.exe 1308 rlrxxfl.exe 1948 ntbtbb.exe 2412 9pddd.exe 1892 rlxxfxx.exe 344 1tbhbb.exe 2196 dddjd.exe 2288 vjjdd.exe 2356 bhbhhn.exe 444 9pdvd.exe 940 rllrrll.exe 2216 bnbbhb.exe 2076 vjvdj.exe 1772 vjdpj.exe 1984 rlxrxlr.exe 2064 nbntbn.exe 772 jvjjp.exe 872 fxfffff.exe 392 nnbbnt.exe 1704 rxxrlxl.exe 2736 9bbntn.exe 2648 dpjdd.exe 2636 3flrxfl.exe 2844 bthnbb.exe 2684 tbntbh.exe 1668 vjvdp.exe 2596 lffxlrl.exe 3056 xxxrxfx.exe 1264 hnnttn.exe 2060 jddjj.exe 2868 lxlffxf.exe 2788 5tnttn.exe 2872 ttnnbb.exe 300 pvjpd.exe 324 1xrxxxr.exe 3024 lfrlxff.exe 1948 btbbht.exe 2500 pjpvd.exe 2188 rrrxrfx.exe 2696 lfxxxxx.exe 2100 ttbhnb.exe 2240 vvpdj.exe 2912 7ddpv.exe 2136 3xllrxf.exe 2908 hbnthb.exe 1608 nnbbnt.exe 940 vvjvd.exe 2180 ppvdp.exe 2128 xxrxxlx.exe 1536 5lrxxfl.exe 2468 nhbbhn.exe 1548 ppdvd.exe 748 xfrlrrx.exe 2028 fxrrxxf.exe -
resource yara_rule behavioral1/memory/1956-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/392-286-0x0000000077730000-0x000000007784F000-memory.dmp upx behavioral1/memory/2360-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2368 1956 a9478348dce232b0241b58c4950b4f00N.exe 30 PID 1956 wrote to memory of 2368 1956 a9478348dce232b0241b58c4950b4f00N.exe 30 PID 1956 wrote to memory of 2368 1956 a9478348dce232b0241b58c4950b4f00N.exe 30 PID 1956 wrote to memory of 2368 1956 a9478348dce232b0241b58c4950b4f00N.exe 30 PID 2368 wrote to memory of 2664 2368 7btnnn.exe 31 PID 2368 wrote to memory of 2664 2368 7btnnn.exe 31 PID 2368 wrote to memory of 2664 2368 7btnnn.exe 31 PID 2368 wrote to memory of 2664 2368 7btnnn.exe 31 PID 2664 wrote to memory of 2676 2664 5djjj.exe 32 PID 2664 wrote to memory of 2676 2664 5djjj.exe 32 PID 2664 wrote to memory of 2676 2664 5djjj.exe 32 PID 2664 wrote to memory of 2676 2664 5djjj.exe 32 PID 2676 wrote to memory of 2252 2676 bthnnn.exe 33 PID 2676 wrote to memory of 2252 2676 bthnnn.exe 33 PID 2676 wrote to memory of 2252 2676 bthnnn.exe 33 PID 2676 wrote to memory of 2252 2676 bthnnn.exe 33 PID 2252 wrote to memory of 2540 2252 thnnbh.exe 34 PID 2252 wrote to memory of 2540 2252 thnnbh.exe 34 PID 2252 wrote to memory of 2540 2252 thnnbh.exe 34 PID 2252 wrote to memory of 2540 2252 thnnbh.exe 34 PID 2540 wrote to memory of 2520 2540 lxrrxrf.exe 35 PID 2540 wrote to memory of 2520 2540 lxrrxrf.exe 35 PID 2540 wrote to memory of 2520 2540 lxrrxrf.exe 35 PID 2540 wrote to memory of 2520 2540 lxrrxrf.exe 35 PID 2520 wrote to memory of 3052 2520 nhhbbb.exe 36 PID 2520 wrote to memory of 3052 2520 nhhbbb.exe 36 PID 2520 wrote to memory of 3052 2520 nhhbbb.exe 36 PID 2520 wrote to memory of 3052 2520 nhhbbb.exe 36 PID 3052 wrote to memory of 2756 3052 3jvpp.exe 37 PID 3052 wrote to memory of 2756 3052 3jvpp.exe 37 PID 3052 wrote to memory of 2756 3052 3jvpp.exe 37 PID 3052 wrote to memory of 2756 3052 3jvpp.exe 37 PID 2756 wrote to memory of 2708 2756 fllxrrr.exe 38 PID 2756 wrote to memory of 2708 2756 fllxrrr.exe 38 PID 2756 wrote to memory of 2708 2756 fllxrrr.exe 38 PID 2756 wrote to memory of 2708 2756 fllxrrr.exe 38 PID 2708 wrote to memory of 2764 2708 bbbbtn.exe 39 PID 2708 wrote to memory of 2764 2708 bbbbtn.exe 39 PID 2708 wrote to memory of 2764 2708 bbbbtn.exe 39 PID 2708 wrote to memory of 2764 2708 bbbbtn.exe 39 PID 2764 wrote to memory of 2888 2764 7jvvd.exe 40 PID 2764 wrote to memory of 2888 2764 7jvvd.exe 40 PID 2764 wrote to memory of 2888 2764 7jvvd.exe 40 PID 2764 wrote to memory of 2888 2764 7jvvd.exe 40 PID 2888 wrote to memory of 1308 2888 lflxfxf.exe 41 PID 2888 wrote to memory of 1308 2888 lflxfxf.exe 41 PID 2888 wrote to memory of 1308 2888 lflxfxf.exe 41 PID 2888 wrote to memory of 1308 2888 lflxfxf.exe 41 PID 1308 wrote to memory of 1948 1308 rlrxxfl.exe 42 PID 1308 wrote to memory of 1948 1308 rlrxxfl.exe 42 PID 1308 wrote to memory of 1948 1308 rlrxxfl.exe 42 PID 1308 wrote to memory of 1948 1308 rlrxxfl.exe 42 PID 1948 wrote to memory of 2412 1948 ntbtbb.exe 43 PID 1948 wrote to memory of 2412 1948 ntbtbb.exe 43 PID 1948 wrote to memory of 2412 1948 ntbtbb.exe 43 PID 1948 wrote to memory of 2412 1948 ntbtbb.exe 43 PID 2412 wrote to memory of 1892 2412 9pddd.exe 44 PID 2412 wrote to memory of 1892 2412 9pddd.exe 44 PID 2412 wrote to memory of 1892 2412 9pddd.exe 44 PID 2412 wrote to memory of 1892 2412 9pddd.exe 44 PID 1892 wrote to memory of 344 1892 rlxxfxx.exe 45 PID 1892 wrote to memory of 344 1892 rlxxfxx.exe 45 PID 1892 wrote to memory of 344 1892 rlxxfxx.exe 45 PID 1892 wrote to memory of 344 1892 rlxxfxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9478348dce232b0241b58c4950b4f00N.exe"C:\Users\Admin\AppData\Local\Temp\a9478348dce232b0241b58c4950b4f00N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\7btnnn.exec:\7btnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\5djjj.exec:\5djjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bthnnn.exec:\bthnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\thnnbh.exec:\thnnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\lxrrxrf.exec:\lxrrxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhhbbb.exec:\nhhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3jvpp.exec:\3jvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\fllxrrr.exec:\fllxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bbbbtn.exec:\bbbbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7jvvd.exec:\7jvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lflxfxf.exec:\lflxfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rlrxxfl.exec:\rlrxxfl.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\ntbtbb.exec:\ntbtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\9pddd.exec:\9pddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\1tbhbb.exec:\1tbhbb.exe17⤵
- Executes dropped EXE
PID:344 -
\??\c:\dddjd.exec:\dddjd.exe18⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vjjdd.exec:\vjjdd.exe19⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bhbhhn.exec:\bhbhhn.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9pdvd.exec:\9pdvd.exe21⤵
- Executes dropped EXE
PID:444 -
\??\c:\rllrrll.exec:\rllrrll.exe22⤵
- Executes dropped EXE
PID:940 -
\??\c:\bnbbhb.exec:\bnbbhb.exe23⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vjvdj.exec:\vjvdj.exe24⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vjdpj.exec:\vjdpj.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rlxrxlr.exec:\rlxrxlr.exe26⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nbntbn.exec:\nbntbn.exe27⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jvjjp.exec:\jvjjp.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\fxfffff.exec:\fxfffff.exe29⤵
- Executes dropped EXE
PID:872 -
\??\c:\nnbbnt.exec:\nnbbnt.exe30⤵
- Executes dropped EXE
PID:392 -
\??\c:\vpppv.exec:\vpppv.exe31⤵PID:2360
-
\??\c:\rxxrlxl.exec:\rxxrlxl.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\9bbntn.exec:\9bbntn.exe33⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dpjdd.exec:\dpjdd.exe34⤵
- Executes dropped EXE
PID:2648 -
\??\c:\3flrxfl.exec:\3flrxfl.exe35⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bthnbb.exec:\bthnbb.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\tbntbh.exec:\tbntbh.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vjvdp.exec:\vjvdp.exe38⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lffxlrl.exec:\lffxlrl.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xxxrxfx.exec:\xxxrxfx.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hnnttn.exec:\hnnttn.exe41⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jddjj.exec:\jddjj.exe42⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lxlffxf.exec:\lxlffxf.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5tnttn.exec:\5tnttn.exe44⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ttnnbb.exec:\ttnnbb.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pvjpd.exec:\pvjpd.exe46⤵
- Executes dropped EXE
PID:300 -
\??\c:\1xrxxxr.exec:\1xrxxxr.exe47⤵
- Executes dropped EXE
PID:324 -
\??\c:\lfrlxff.exec:\lfrlxff.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\btbbht.exec:\btbbht.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pjpvd.exec:\pjpvd.exe50⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rrrxrfx.exec:\rrrxrfx.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe52⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ttbhnb.exec:\ttbhnb.exe53⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vvpdj.exec:\vvpdj.exe54⤵
- Executes dropped EXE
PID:2240 -
\??\c:\7ddpv.exec:\7ddpv.exe55⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3xllrxf.exec:\3xllrxf.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbnthb.exec:\hbnthb.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nnbbnt.exec:\nnbbnt.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vvjvd.exec:\vvjvd.exe59⤵
- Executes dropped EXE
PID:940 -
\??\c:\ppvdp.exec:\ppvdp.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxrxxlx.exec:\xxrxxlx.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5lrxxfl.exec:\5lrxxfl.exe62⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nhbbhn.exec:\nhbbhn.exe63⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ppdvd.exec:\ppdvd.exe64⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xfrlrrx.exec:\xfrlrrx.exe65⤵
- Executes dropped EXE
PID:748 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe66⤵
- Executes dropped EXE
PID:2028 -
\??\c:\thtttt.exec:\thtttt.exe67⤵PID:2704
-
\??\c:\jpjvj.exec:\jpjvj.exe68⤵PID:1640
-
\??\c:\9vpvd.exec:\9vpvd.exe69⤵PID:1596
-
\??\c:\9frrxrx.exec:\9frrxrx.exe70⤵PID:2368
-
\??\c:\llrrffr.exec:\llrrffr.exe71⤵PID:1704
-
\??\c:\3hnthh.exec:\3hnthh.exe72⤵PID:2840
-
\??\c:\5jddj.exec:\5jddj.exe73⤵PID:2648
-
\??\c:\vdvdj.exec:\vdvdj.exe74⤵PID:2544
-
\??\c:\xllrflr.exec:\xllrflr.exe75⤵PID:2904
-
\??\c:\lflrflr.exec:\lflrflr.exe76⤵PID:2528
-
\??\c:\1thhnt.exec:\1thhnt.exe77⤵PID:2640
-
\??\c:\pjddd.exec:\pjddd.exe78⤵PID:2144
-
\??\c:\lfxflrf.exec:\lfxflrf.exe79⤵PID:2348
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe80⤵PID:1968
-
\??\c:\bbthnb.exec:\bbthnb.exe81⤵PID:664
-
\??\c:\tnbbnn.exec:\tnbbnn.exe82⤵PID:2712
-
\??\c:\ppjdv.exec:\ppjdv.exe83⤵PID:2608
-
\??\c:\pdjdd.exec:\pdjdd.exe84⤵PID:348
-
\??\c:\rrfrffl.exec:\rrfrffl.exe85⤵PID:1192
-
\??\c:\rlxxflx.exec:\rlxxflx.exe86⤵PID:1756
-
\??\c:\nhnbhh.exec:\nhnbhh.exe87⤵PID:1672
-
\??\c:\hhttnt.exec:\hhttnt.exe88⤵PID:1724
-
\??\c:\vppdj.exec:\vppdj.exe89⤵PID:1644
-
\??\c:\xrffrfl.exec:\xrffrfl.exe90⤵PID:2988
-
\??\c:\ntbtnh.exec:\ntbtnh.exe91⤵PID:2156
-
\??\c:\bthhnt.exec:\bthhnt.exe92⤵PID:2196
-
\??\c:\jpddj.exec:\jpddj.exe93⤵PID:2248
-
\??\c:\ffflxxl.exec:\ffflxxl.exe94⤵PID:2356
-
\??\c:\lxlfffr.exec:\lxlfffr.exe95⤵PID:2148
-
\??\c:\hbntbh.exec:\hbntbh.exe96⤵PID:2488
-
\??\c:\djvdp.exec:\djvdp.exe97⤵PID:1608
-
\??\c:\fxxffrx.exec:\fxxffrx.exe98⤵PID:1840
-
\??\c:\1lfrfrf.exec:\1lfrfrf.exe99⤵PID:2124
-
\??\c:\hnbttn.exec:\hnbttn.exe100⤵PID:2220
-
\??\c:\pdjpp.exec:\pdjpp.exe101⤵PID:2204
-
\??\c:\dpdvv.exec:\dpdvv.exe102⤵PID:1088
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe103⤵PID:1548
-
\??\c:\rflxflr.exec:\rflxflr.exe104⤵PID:2308
-
\??\c:\nhbhnt.exec:\nhbhnt.exe105⤵PID:1236
-
\??\c:\thntbh.exec:\thntbh.exe106⤵PID:2460
-
\??\c:\pjpdj.exec:\pjpdj.exe107⤵PID:1640
-
\??\c:\1dvpp.exec:\1dvpp.exe108⤵PID:2380
-
\??\c:\frfffxf.exec:\frfffxf.exe109⤵PID:1576
-
\??\c:\bbnnhh.exec:\bbnnhh.exe110⤵PID:2644
-
\??\c:\3ttntn.exec:\3ttntn.exe111⤵PID:2840
-
\??\c:\vpdjp.exec:\vpdjp.exe112⤵PID:2828
-
\??\c:\dddvd.exec:\dddvd.exe113⤵PID:2544
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe114⤵PID:2844
-
\??\c:\tnttbb.exec:\tnttbb.exe115⤵PID:2528
-
\??\c:\thtbbb.exec:\thtbbb.exe116⤵PID:2540
-
\??\c:\ppjpv.exec:\ppjpv.exe117⤵PID:2144
-
\??\c:\pdjjd.exec:\pdjjd.exe118⤵PID:3056
-
\??\c:\9llxxlf.exec:\9llxxlf.exe119⤵PID:1968
-
\??\c:\1nhnbn.exec:\1nhnbn.exe120⤵PID:2760
-
\??\c:\hhhbht.exec:\hhhbht.exe121⤵PID:2712
-
\??\c:\jvdjv.exec:\jvdjv.exe122⤵PID:2504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-