Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f43f5d72e2322d16d457edb072823c0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
7f43f5d72e2322d16d457edb072823c0N.exe
-
Size
366KB
-
MD5
7f43f5d72e2322d16d457edb072823c0
-
SHA1
830e208c3004fe63e5ffae1bf7f3181c3f260474
-
SHA256
da10c5b6c363461a8373dbe38c2d8313917533d4ad6da5573627894573caa3b4
-
SHA512
672c9fbaf0e26ddc0e8d99290cc15957c9f3a2b4acafd6db7ac72a0ebf863fe90329f39d95d74aefaf9b49fc56555cf46b4962dd2d388a4d9347b94e8434ae76
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjD8296gnzeZhBul:n3C9ytvngQj429nnzeZhBq
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2524-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 pjpvv.exe 1268 btnbnn.exe 2700 xrrrrrx.exe 2076 1ttbnt.exe 2844 9frxfll.exe 2624 lfrlxff.exe 2848 vjpvd.exe 2780 xrxxxxf.exe 2648 vpddj.exe 3028 9ppvj.exe 1848 5tbbhh.exe 2052 3djpp.exe 1444 3xrxflf.exe 1884 nhttnn.exe 2376 xrflrrf.exe 2164 1lrlxxx.exe 1620 3vdjd.exe 3064 5xxrrrf.exe 2208 httntt.exe 2288 5vjvp.exe 2712 3fflxxf.exe 448 3hbhhh.exe 1156 rlxxxfl.exe 1892 7hbtbb.exe 2476 ddpvd.exe 1876 lxllxxf.exe 2224 3ntbbh.exe 1512 dvddp.exe 2272 dvjpd.exe 1708 hbhnbh.exe 2104 5pdvv.exe 2384 fxrfflr.exe 804 1bnbbt.exe 2944 pjvpv.exe 2804 7xxxrxx.exe 2856 lfxrfff.exe 2772 thtbbb.exe 2748 3jvpj.exe 2800 lfrrxxf.exe 2848 rlrxrxf.exe 2784 5nhhtt.exe 2560 tnhttn.exe 2056 9dvpp.exe 324 xrffrxf.exe 1376 btbtbh.exe 2052 3btbnh.exe 2904 3dpjp.exe 2368 xlxfxxx.exe 2684 3lflffl.exe 652 nnhhtb.exe 1676 bhnhht.exe 1716 vpddj.exe 2216 fxllxrx.exe 2024 lxxxxxr.exe 2072 tnbbnt.exe 2464 btnhhh.exe 1136 jdppp.exe 1944 rflflll.exe 1336 xxrxrrf.exe 1364 nhttbh.exe 2448 tnhhnt.exe 560 vdpdd.exe 1876 fxlfllx.exe 2504 3flxflf.exe -
resource yara_rule behavioral1/memory/2524-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2396 2524 7f43f5d72e2322d16d457edb072823c0N.exe 30 PID 2524 wrote to memory of 2396 2524 7f43f5d72e2322d16d457edb072823c0N.exe 30 PID 2524 wrote to memory of 2396 2524 7f43f5d72e2322d16d457edb072823c0N.exe 30 PID 2524 wrote to memory of 2396 2524 7f43f5d72e2322d16d457edb072823c0N.exe 30 PID 2396 wrote to memory of 1268 2396 pjpvv.exe 31 PID 2396 wrote to memory of 1268 2396 pjpvv.exe 31 PID 2396 wrote to memory of 1268 2396 pjpvv.exe 31 PID 2396 wrote to memory of 1268 2396 pjpvv.exe 31 PID 1268 wrote to memory of 2700 1268 btnbnn.exe 32 PID 1268 wrote to memory of 2700 1268 btnbnn.exe 32 PID 1268 wrote to memory of 2700 1268 btnbnn.exe 32 PID 1268 wrote to memory of 2700 1268 btnbnn.exe 32 PID 2700 wrote to memory of 2076 2700 xrrrrrx.exe 33 PID 2700 wrote to memory of 2076 2700 xrrrrrx.exe 33 PID 2700 wrote to memory of 2076 2700 xrrrrrx.exe 33 PID 2700 wrote to memory of 2076 2700 xrrrrrx.exe 33 PID 2076 wrote to memory of 2844 2076 1ttbnt.exe 34 PID 2076 wrote to memory of 2844 2076 1ttbnt.exe 34 PID 2076 wrote to memory of 2844 2076 1ttbnt.exe 34 PID 2076 wrote to memory of 2844 2076 1ttbnt.exe 34 PID 2844 wrote to memory of 2624 2844 9frxfll.exe 35 PID 2844 wrote to memory of 2624 2844 9frxfll.exe 35 PID 2844 wrote to memory of 2624 2844 9frxfll.exe 35 PID 2844 wrote to memory of 2624 2844 9frxfll.exe 35 PID 2624 wrote to memory of 2848 2624 lfrlxff.exe 36 PID 2624 wrote to memory of 2848 2624 lfrlxff.exe 36 PID 2624 wrote to memory of 2848 2624 lfrlxff.exe 36 PID 2624 wrote to memory of 2848 2624 lfrlxff.exe 36 PID 2848 wrote to memory of 2780 2848 vjpvd.exe 37 PID 2848 wrote to memory of 2780 2848 vjpvd.exe 37 PID 2848 wrote to memory of 2780 2848 vjpvd.exe 37 PID 2848 wrote to memory of 2780 2848 vjpvd.exe 37 PID 2780 wrote to memory of 2648 2780 xrxxxxf.exe 38 PID 2780 wrote to memory of 2648 2780 xrxxxxf.exe 38 PID 2780 wrote to memory of 2648 2780 xrxxxxf.exe 38 PID 2780 wrote to memory of 2648 2780 xrxxxxf.exe 38 PID 2648 wrote to memory of 3028 2648 vpddj.exe 39 PID 2648 wrote to memory of 3028 2648 vpddj.exe 39 PID 2648 wrote to memory of 3028 2648 vpddj.exe 39 PID 2648 wrote to memory of 3028 2648 vpddj.exe 39 PID 3028 wrote to memory of 1848 3028 9ppvj.exe 40 PID 3028 wrote to memory of 1848 3028 9ppvj.exe 40 PID 3028 wrote to memory of 1848 3028 9ppvj.exe 40 PID 3028 wrote to memory of 1848 3028 9ppvj.exe 40 PID 1848 wrote to memory of 2052 1848 5tbbhh.exe 41 PID 1848 wrote to memory of 2052 1848 5tbbhh.exe 41 PID 1848 wrote to memory of 2052 1848 5tbbhh.exe 41 PID 1848 wrote to memory of 2052 1848 5tbbhh.exe 41 PID 2052 wrote to memory of 1444 2052 3djpp.exe 42 PID 2052 wrote to memory of 1444 2052 3djpp.exe 42 PID 2052 wrote to memory of 1444 2052 3djpp.exe 42 PID 2052 wrote to memory of 1444 2052 3djpp.exe 42 PID 1444 wrote to memory of 1884 1444 3xrxflf.exe 43 PID 1444 wrote to memory of 1884 1444 3xrxflf.exe 43 PID 1444 wrote to memory of 1884 1444 3xrxflf.exe 43 PID 1444 wrote to memory of 1884 1444 3xrxflf.exe 43 PID 1884 wrote to memory of 2376 1884 nhttnn.exe 44 PID 1884 wrote to memory of 2376 1884 nhttnn.exe 44 PID 1884 wrote to memory of 2376 1884 nhttnn.exe 44 PID 1884 wrote to memory of 2376 1884 nhttnn.exe 44 PID 2376 wrote to memory of 2164 2376 xrflrrf.exe 45 PID 2376 wrote to memory of 2164 2376 xrflrrf.exe 45 PID 2376 wrote to memory of 2164 2376 xrflrrf.exe 45 PID 2376 wrote to memory of 2164 2376 xrflrrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f43f5d72e2322d16d457edb072823c0N.exe"C:\Users\Admin\AppData\Local\Temp\7f43f5d72e2322d16d457edb072823c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pjpvv.exec:\pjpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\btnbnn.exec:\btnbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\xrrrrrx.exec:\xrrrrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1ttbnt.exec:\1ttbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\9frxfll.exec:\9frxfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lfrlxff.exec:\lfrlxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vjpvd.exec:\vjpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vpddj.exec:\vpddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9ppvj.exec:\9ppvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\5tbbhh.exec:\5tbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\3djpp.exec:\3djpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\3xrxflf.exec:\3xrxflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\nhttnn.exec:\nhttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\xrflrrf.exec:\xrflrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\1lrlxxx.exec:\1lrlxxx.exe17⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3vdjd.exec:\3vdjd.exe18⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5xxrrrf.exec:\5xxrrrf.exe19⤵
- Executes dropped EXE
PID:3064 -
\??\c:\httntt.exec:\httntt.exe20⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5vjvp.exec:\5vjvp.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3fflxxf.exec:\3fflxxf.exe22⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3hbhhh.exec:\3hbhhh.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe24⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7hbtbb.exec:\7hbtbb.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ddpvd.exec:\ddpvd.exe26⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lxllxxf.exec:\lxllxxf.exe27⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3ntbbh.exec:\3ntbbh.exe28⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dvddp.exec:\dvddp.exe29⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dvjpd.exec:\dvjpd.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hbhnbh.exec:\hbhnbh.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5pdvv.exec:\5pdvv.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fxrfflr.exec:\fxrfflr.exe33⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1bnbbt.exec:\1bnbbt.exe34⤵
- Executes dropped EXE
PID:804 -
\??\c:\pjvpv.exec:\pjvpv.exe35⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7xxxrxx.exec:\7xxxrxx.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\lfxrfff.exec:\lfxrfff.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\thtbbb.exec:\thtbbb.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3jvpj.exec:\3jvpj.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rlrxrxf.exec:\rlrxrxf.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5nhhtt.exec:\5nhhtt.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tnhttn.exec:\tnhttn.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9dvpp.exec:\9dvpp.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xrffrxf.exec:\xrffrxf.exe45⤵
- Executes dropped EXE
PID:324 -
\??\c:\btbtbh.exec:\btbtbh.exe46⤵
- Executes dropped EXE
PID:1376 -
\??\c:\3btbnh.exec:\3btbnh.exe47⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3dpjp.exec:\3dpjp.exe48⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xlxfxxx.exec:\xlxfxxx.exe49⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3lflffl.exec:\3lflffl.exe50⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nnhhtb.exec:\nnhhtb.exe51⤵
- Executes dropped EXE
PID:652 -
\??\c:\bhnhht.exec:\bhnhht.exe52⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vpddj.exec:\vpddj.exe53⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fxllxrx.exec:\fxllxrx.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lxxxxxr.exec:\lxxxxxr.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnbbnt.exec:\tnbbnt.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\btnhhh.exec:\btnhhh.exe57⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jdppp.exec:\jdppp.exe58⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rflflll.exec:\rflflll.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xxrxrrf.exec:\xxrxrrf.exe60⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nhttbh.exec:\nhttbh.exe61⤵
- Executes dropped EXE
PID:1364 -
\??\c:\tnhhnt.exec:\tnhhnt.exe62⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vdpdd.exec:\vdpdd.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\fxlfllx.exec:\fxlfllx.exe64⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3flxflf.exec:\3flxflf.exe65⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nnhhnn.exec:\nnhhnn.exe66⤵PID:1908
-
\??\c:\jdvjd.exec:\jdvjd.exe67⤵PID:2400
-
\??\c:\pjdjp.exec:\pjdjp.exe68⤵PID:2308
-
\??\c:\xlffffl.exec:\xlffffl.exe69⤵PID:1712
-
\??\c:\xlflrlx.exec:\xlflrlx.exe70⤵PID:2104
-
\??\c:\hhhbtt.exec:\hhhbtt.exe71⤵PID:1312
-
\??\c:\jvppv.exec:\jvppv.exe72⤵PID:2876
-
\??\c:\vpjdp.exec:\vpjdp.exe73⤵PID:2344
-
\??\c:\rfllflx.exec:\rfllflx.exe74⤵PID:1784
-
\??\c:\xrfflfr.exec:\xrfflfr.exe75⤵
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\bnbbbb.exec:\bnbbbb.exe76⤵PID:2860
-
\??\c:\vjpdd.exec:\vjpdd.exe77⤵PID:2776
-
\??\c:\vpvjd.exec:\vpvjd.exe78⤵PID:2760
-
\??\c:\3xllfxx.exec:\3xllfxx.exe79⤵PID:2728
-
\??\c:\nnbntb.exec:\nnbntb.exe80⤵PID:2628
-
\??\c:\nbtntt.exec:\nbtntt.exe81⤵PID:2648
-
\??\c:\dvppv.exec:\dvppv.exe82⤵PID:3028
-
\??\c:\dpddj.exec:\dpddj.exe83⤵PID:2372
-
\??\c:\rxxlxfx.exec:\rxxlxfx.exe84⤵PID:580
-
\??\c:\bttbnn.exec:\bttbnn.exe85⤵PID:2136
-
\??\c:\7nbbnn.exec:\7nbbnn.exe86⤵PID:1096
-
\??\c:\jjjdv.exec:\jjjdv.exe87⤵PID:1916
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe88⤵PID:956
-
\??\c:\lxrxxfl.exec:\lxrxxfl.exe89⤵PID:1732
-
\??\c:\5thntn.exec:\5thntn.exe90⤵PID:2920
-
\??\c:\dddjv.exec:\dddjv.exe91⤵PID:3048
-
\??\c:\jdvdd.exec:\jdvdd.exe92⤵PID:2204
-
\??\c:\rfffxrx.exec:\rfffxrx.exe93⤵PID:2236
-
\??\c:\tthttb.exec:\tthttb.exe94⤵PID:2480
-
\??\c:\1nhnhh.exec:\1nhnhh.exe95⤵PID:1148
-
\??\c:\3pdvv.exec:\3pdvv.exe96⤵PID:1036
-
\??\c:\vjvpp.exec:\vjvpp.exe97⤵PID:344
-
\??\c:\rlxfffl.exec:\rlxfffl.exe98⤵PID:2044
-
\??\c:\1nthnt.exec:\1nthnt.exe99⤵PID:352
-
\??\c:\5nbhhn.exec:\5nbhhn.exe100⤵PID:2456
-
\??\c:\vjjjj.exec:\vjjjj.exe101⤵PID:2444
-
\??\c:\1rxrfff.exec:\1rxrfff.exe102⤵PID:1056
-
\??\c:\frxlrxx.exec:\frxlrxx.exe103⤵PID:1852
-
\??\c:\5htntb.exec:\5htntb.exe104⤵PID:2504
-
\??\c:\hbntbb.exec:\hbntbb.exe105⤵PID:2272
-
\??\c:\ppdjj.exec:\ppdjj.exe106⤵PID:2548
-
\??\c:\rflxfxf.exec:\rflxfxf.exe107⤵PID:1128
-
\??\c:\fxrxrfl.exec:\fxrxrfl.exe108⤵PID:2412
-
\??\c:\btbbhn.exec:\btbbhn.exe109⤵PID:1268
-
\??\c:\5pddj.exec:\5pddj.exe110⤵PID:2008
-
\??\c:\pdppd.exec:\pdppd.exe111⤵PID:2764
-
\??\c:\xrrrfxl.exec:\xrrrfxl.exe112⤵PID:2708
-
\??\c:\lxfrfrl.exec:\lxfrfrl.exe113⤵PID:2348
-
\??\c:\9bnntn.exec:\9bnntn.exe114⤵PID:2852
-
\??\c:\dvpvd.exec:\dvpvd.exe115⤵PID:2652
-
\??\c:\9pdjj.exec:\9pdjj.exe116⤵PID:2912
-
\??\c:\3fxfxrl.exec:\3fxfxrl.exe117⤵PID:2848
-
\??\c:\5tbhhh.exec:\5tbhhh.exe118⤵PID:1484
-
\??\c:\hbtntt.exec:\hbtntt.exe119⤵PID:2560
-
\??\c:\9jppv.exec:\9jppv.exe120⤵PID:2004
-
\??\c:\xrlrflr.exec:\xrlrflr.exe121⤵PID:2892
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe122⤵PID:1828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-