Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 07:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8909118b94826c1f1950bc522142bca0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
8909118b94826c1f1950bc522142bca0N.exe
-
Size
72KB
-
MD5
8909118b94826c1f1950bc522142bca0
-
SHA1
8debb3db493793d567055da751c77922c32cbc6b
-
SHA256
3337be7ed44a48a7c6391bfdb96e50258a5ef6d262cf179b7b63013b0b9cbc8b
-
SHA512
c943e0b1b1fe2d9b24dd3cd9e811d649d96203538c355db13bcc81018f816d49cfddddb358881b880d901848644ba23babb28ae31ea6c3accce9fa81979eb050
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJUn:ymb3NkkiQ3mdBjFI3eF4
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2680-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2112 rlxlxfr.exe 2552 hbhbhh.exe 2888 hbhhnn.exe 2292 1vjpv.exe 2820 frlrrlr.exe 3068 3nnhbt.exe 2700 1tbhht.exe 2416 dppjj.exe 2676 xrxffxr.exe 2772 bhhbhh.exe 1712 tbhhnh.exe 760 dpjjp.exe 2508 vpvdj.exe 1784 5xlllrx.exe 1480 rfffrrl.exe 2572 7hthbh.exe 1720 dvjpp.exe 1988 dpvpp.exe 2892 frflrxx.exe 2312 nnbbbt.exe 3036 3nhhnt.exe 1084 vjpjj.exe 780 vpddv.exe 1660 5xrffff.exe 2452 fxlrxfl.exe 1772 bnbhnt.exe 1244 thhhhh.exe 2068 pdjdj.exe 2908 5lrlxxx.exe 2096 5lxxxxx.exe 2204 nbnnth.exe 2072 hthttb.exe 336 pdppv.exe 2704 frxrxrr.exe 2816 frflrrx.exe 2916 1hthbb.exe 2824 7hbhtt.exe 2688 5httnt.exe 2836 7dvvv.exe 2600 jdvdp.exe 2416 ffxflff.exe 2664 lflrxxx.exe 2996 3frrrxf.exe 568 bthttn.exe 1908 nnbbnn.exe 2344 dpdvv.exe 1644 vvjdv.exe 1236 lxxxfll.exe 1692 rlrxrrr.exe 1096 hbnthn.exe 2572 9nbtbb.exe 1012 pjpdp.exe 1880 1jdjv.exe 2460 vvjpv.exe 2168 lrfxxll.exe 2444 rffxlfl.exe 404 bntnnt.exe 2588 thtbbt.exe 2024 nhtthb.exe 1104 vvjjj.exe 2264 vjdjj.exe 2932 9rfrrrx.exe 2504 rfxlfll.exe 2304 hthnth.exe -
resource yara_rule behavioral1/memory/2680-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2112 2680 8909118b94826c1f1950bc522142bca0N.exe 30 PID 2680 wrote to memory of 2112 2680 8909118b94826c1f1950bc522142bca0N.exe 30 PID 2680 wrote to memory of 2112 2680 8909118b94826c1f1950bc522142bca0N.exe 30 PID 2680 wrote to memory of 2112 2680 8909118b94826c1f1950bc522142bca0N.exe 30 PID 2112 wrote to memory of 2552 2112 rlxlxfr.exe 31 PID 2112 wrote to memory of 2552 2112 rlxlxfr.exe 31 PID 2112 wrote to memory of 2552 2112 rlxlxfr.exe 31 PID 2112 wrote to memory of 2552 2112 rlxlxfr.exe 31 PID 2552 wrote to memory of 2888 2552 hbhbhh.exe 32 PID 2552 wrote to memory of 2888 2552 hbhbhh.exe 32 PID 2552 wrote to memory of 2888 2552 hbhbhh.exe 32 PID 2552 wrote to memory of 2888 2552 hbhbhh.exe 32 PID 2888 wrote to memory of 2292 2888 hbhhnn.exe 33 PID 2888 wrote to memory of 2292 2888 hbhhnn.exe 33 PID 2888 wrote to memory of 2292 2888 hbhhnn.exe 33 PID 2888 wrote to memory of 2292 2888 hbhhnn.exe 33 PID 2292 wrote to memory of 2820 2292 1vjpv.exe 34 PID 2292 wrote to memory of 2820 2292 1vjpv.exe 34 PID 2292 wrote to memory of 2820 2292 1vjpv.exe 34 PID 2292 wrote to memory of 2820 2292 1vjpv.exe 34 PID 2820 wrote to memory of 3068 2820 frlrrlr.exe 35 PID 2820 wrote to memory of 3068 2820 frlrrlr.exe 35 PID 2820 wrote to memory of 3068 2820 frlrrlr.exe 35 PID 2820 wrote to memory of 3068 2820 frlrrlr.exe 35 PID 3068 wrote to memory of 2700 3068 3nnhbt.exe 36 PID 3068 wrote to memory of 2700 3068 3nnhbt.exe 36 PID 3068 wrote to memory of 2700 3068 3nnhbt.exe 36 PID 3068 wrote to memory of 2700 3068 3nnhbt.exe 36 PID 2700 wrote to memory of 2416 2700 1tbhht.exe 37 PID 2700 wrote to memory of 2416 2700 1tbhht.exe 37 PID 2700 wrote to memory of 2416 2700 1tbhht.exe 37 PID 2700 wrote to memory of 2416 2700 1tbhht.exe 37 PID 2416 wrote to memory of 2676 2416 dppjj.exe 38 PID 2416 wrote to memory of 2676 2416 dppjj.exe 38 PID 2416 wrote to memory of 2676 2416 dppjj.exe 38 PID 2416 wrote to memory of 2676 2416 dppjj.exe 38 PID 2676 wrote to memory of 2772 2676 xrxffxr.exe 39 PID 2676 wrote to memory of 2772 2676 xrxffxr.exe 39 PID 2676 wrote to memory of 2772 2676 xrxffxr.exe 39 PID 2676 wrote to memory of 2772 2676 xrxffxr.exe 39 PID 2772 wrote to memory of 1712 2772 bhhbhh.exe 40 PID 2772 wrote to memory of 1712 2772 bhhbhh.exe 40 PID 2772 wrote to memory of 1712 2772 bhhbhh.exe 40 PID 2772 wrote to memory of 1712 2772 bhhbhh.exe 40 PID 1712 wrote to memory of 760 1712 tbhhnh.exe 41 PID 1712 wrote to memory of 760 1712 tbhhnh.exe 41 PID 1712 wrote to memory of 760 1712 tbhhnh.exe 41 PID 1712 wrote to memory of 760 1712 tbhhnh.exe 41 PID 760 wrote to memory of 2508 760 dpjjp.exe 42 PID 760 wrote to memory of 2508 760 dpjjp.exe 42 PID 760 wrote to memory of 2508 760 dpjjp.exe 42 PID 760 wrote to memory of 2508 760 dpjjp.exe 42 PID 2508 wrote to memory of 1784 2508 vpvdj.exe 43 PID 2508 wrote to memory of 1784 2508 vpvdj.exe 43 PID 2508 wrote to memory of 1784 2508 vpvdj.exe 43 PID 2508 wrote to memory of 1784 2508 vpvdj.exe 43 PID 1784 wrote to memory of 1480 1784 5xlllrx.exe 44 PID 1784 wrote to memory of 1480 1784 5xlllrx.exe 44 PID 1784 wrote to memory of 1480 1784 5xlllrx.exe 44 PID 1784 wrote to memory of 1480 1784 5xlllrx.exe 44 PID 1480 wrote to memory of 2572 1480 rfffrrl.exe 45 PID 1480 wrote to memory of 2572 1480 rfffrrl.exe 45 PID 1480 wrote to memory of 2572 1480 rfffrrl.exe 45 PID 1480 wrote to memory of 2572 1480 rfffrrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8909118b94826c1f1950bc522142bca0N.exe"C:\Users\Admin\AppData\Local\Temp\8909118b94826c1f1950bc522142bca0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\hbhbhh.exec:\hbhbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hbhhnn.exec:\hbhhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1vjpv.exec:\1vjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\frlrrlr.exec:\frlrrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3nnhbt.exec:\3nnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\1tbhht.exec:\1tbhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dppjj.exec:\dppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xrxffxr.exec:\xrxffxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bhhbhh.exec:\bhhbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tbhhnh.exec:\tbhhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\dpjjp.exec:\dpjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\vpvdj.exec:\vpvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\5xlllrx.exec:\5xlllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\rfffrrl.exec:\rfffrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\7hthbh.exec:\7hthbh.exe17⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvjpp.exec:\dvjpp.exe18⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dpvpp.exec:\dpvpp.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\frflrxx.exec:\frflrxx.exe20⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nnbbbt.exec:\nnbbbt.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3nhhnt.exec:\3nhhnt.exe22⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vjpjj.exec:\vjpjj.exe23⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vpddv.exec:\vpddv.exe24⤵
- Executes dropped EXE
PID:780 -
\??\c:\5xrffff.exec:\5xrffff.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bnbhnt.exec:\bnbhnt.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\thhhhh.exec:\thhhhh.exe28⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pdjdj.exec:\pdjdj.exe29⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5lrlxxx.exec:\5lrlxxx.exe30⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5lxxxxx.exec:\5lxxxxx.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nbnnth.exec:\nbnnth.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hthttb.exec:\hthttb.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pdppv.exec:\pdppv.exe34⤵
- Executes dropped EXE
PID:336 -
\??\c:\frxrxrr.exec:\frxrxrr.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\frflrrx.exec:\frflrrx.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1hthbb.exec:\1hthbb.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7hbhtt.exec:\7hbhtt.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5httnt.exec:\5httnt.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7dvvv.exec:\7dvvv.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jdvdp.exec:\jdvdp.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ffxflff.exec:\ffxflff.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lflrxxx.exec:\lflrxxx.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3frrrxf.exec:\3frrrxf.exe44⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bthttn.exec:\bthttn.exe45⤵
- Executes dropped EXE
PID:568 -
\??\c:\nnbbnn.exec:\nnbbnn.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dpdvv.exec:\dpdvv.exe47⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vvjdv.exec:\vvjdv.exe48⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lxxxfll.exec:\lxxxfll.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe50⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbnthn.exec:\hbnthn.exe51⤵
- Executes dropped EXE
PID:1096 -
\??\c:\9nbtbb.exec:\9nbtbb.exe52⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pjpdp.exec:\pjpdp.exe53⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1jdjv.exec:\1jdjv.exe54⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vvjpv.exec:\vvjpv.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lrfxxll.exec:\lrfxxll.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rffxlfl.exec:\rffxlfl.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bntnnt.exec:\bntnnt.exe58⤵
- Executes dropped EXE
PID:404 -
\??\c:\thtbbt.exec:\thtbbt.exe59⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhtthb.exec:\nhtthb.exe60⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vvjjj.exec:\vvjjj.exe61⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vjdjj.exec:\vjdjj.exe62⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9rfrrrx.exec:\9rfrrrx.exe63⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rfxlfll.exec:\rfxlfll.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hthnth.exec:\hthnth.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnttnt.exec:\bnttnt.exe66⤵PID:1664
-
\??\c:\hbnhhb.exec:\hbnhhb.exe67⤵PID:2068
-
\??\c:\jjpvv.exec:\jjpvv.exe68⤵
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\pdppp.exec:\pdppp.exe69⤵PID:2904
-
\??\c:\rlffxxf.exec:\rlffxxf.exe70⤵PID:2104
-
\??\c:\1ffrflx.exec:\1ffrflx.exe71⤵PID:2220
-
\??\c:\3rxfllx.exec:\3rxfllx.exe72⤵PID:2072
-
\??\c:\tnttbb.exec:\tnttbb.exe73⤵PID:2748
-
\??\c:\jjpdp.exec:\jjpdp.exe74⤵PID:2704
-
\??\c:\jvvpj.exec:\jvvpj.exe75⤵PID:2816
-
\??\c:\1frrlfx.exec:\1frrlfx.exe76⤵PID:2476
-
\??\c:\1rfxrrr.exec:\1rfxrrr.exe77⤵PID:2824
-
\??\c:\nthhnn.exec:\nthhnn.exe78⤵PID:2624
-
\??\c:\thhbnh.exec:\thhbnh.exe79⤵PID:2836
-
\??\c:\xlrxflr.exec:\xlrxflr.exe80⤵PID:2604
-
\??\c:\lxxxffl.exec:\lxxxffl.exe81⤵PID:660
-
\??\c:\nbhnnn.exec:\nbhnnn.exe82⤵PID:2032
-
\??\c:\nttnnn.exec:\nttnnn.exe83⤵PID:744
-
\??\c:\jvppd.exec:\jvppd.exe84⤵PID:1448
-
\??\c:\1jvvv.exec:\1jvvv.exe85⤵PID:1908
-
\??\c:\1fxffxf.exec:\1fxffxf.exe86⤵PID:1432
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe87⤵PID:1644
-
\??\c:\3xrlrxx.exec:\3xrlrxx.exe88⤵PID:1616
-
\??\c:\hthbbb.exec:\hthbbb.exe89⤵PID:2512
-
\??\c:\vpvdv.exec:\vpvdv.exe90⤵PID:1480
-
\??\c:\pdjvv.exec:\pdjvv.exe91⤵PID:2572
-
\??\c:\rrfflrx.exec:\rrfflrx.exe92⤵PID:2356
-
\??\c:\flfxrxf.exec:\flfxrxf.exe93⤵PID:2696
-
\??\c:\1xfxlll.exec:\1xfxlll.exe94⤵PID:1588
-
\??\c:\9tnhhh.exec:\9tnhhh.exe95⤵PID:2168
-
\??\c:\htbbnn.exec:\htbbnn.exe96⤵PID:2312
-
\??\c:\3dddd.exec:\3dddd.exe97⤵PID:440
-
\??\c:\jvdjd.exec:\jvdjd.exe98⤵PID:1780
-
\??\c:\lxxrffl.exec:\lxxrffl.exe99⤵PID:2024
-
\??\c:\1rlffxx.exec:\1rlffxx.exe100⤵PID:780
-
\??\c:\htnnnn.exec:\htnnnn.exe101⤵PID:2264
-
\??\c:\bttntn.exec:\bttntn.exe102⤵PID:2956
-
\??\c:\jvdvv.exec:\jvdvv.exe103⤵PID:2504
-
\??\c:\rffxrxr.exec:\rffxrxr.exe104⤵PID:2960
-
\??\c:\xflrrxf.exec:\xflrrxf.exe105⤵PID:2584
-
\??\c:\htbtbn.exec:\htbtbn.exe106⤵PID:3028
-
\??\c:\hbntbt.exec:\hbntbt.exe107⤵PID:1500
-
\??\c:\pddvv.exec:\pddvv.exe108⤵PID:2496
-
\??\c:\vpjjj.exec:\vpjjj.exe109⤵PID:1204
-
\??\c:\djvvv.exec:\djvvv.exe110⤵PID:2784
-
\??\c:\3flrrrx.exec:\3flrrrx.exe111⤵PID:2076
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe112⤵PID:2744
-
\??\c:\3nnntb.exec:\3nnntb.exe113⤵PID:2740
-
\??\c:\bntntn.exec:\bntntn.exe114⤵PID:2760
-
\??\c:\1pdvv.exec:\1pdvv.exe115⤵PID:3068
-
\??\c:\7pdjd.exec:\7pdjd.exe116⤵PID:2848
-
\??\c:\1frrxrx.exec:\1frrxrx.exe117⤵PID:2656
-
\??\c:\frrrrrx.exec:\frrrrrx.exe118⤵PID:2828
-
\??\c:\lxxxflr.exec:\lxxxflr.exe119⤵PID:2720
-
\??\c:\httbhn.exec:\httbhn.exe120⤵PID:2540
-
\??\c:\tnbbtn.exec:\tnbbtn.exe121⤵PID:1396
-
\??\c:\dpvvv.exec:\dpvvv.exe122⤵PID:1912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-