Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe
Resource
win7-20240708-en
General
-
Target
a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe
-
Size
69KB
-
MD5
3e88103cdf4469b3fa09048c08308c3c
-
SHA1
bad18ebcf2fe06408593aac905cfa9a6b9c85166
-
SHA256
a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72
-
SHA512
3f1e0db1b9d9b7e4202ee3940169abf760d45e7b5f0d1a1021c8d6a4b9133f9b40860d95b63205707d3d0d1e875632ede52cd7dbb62a2121530a141864e7655e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdv:ymb3NkkiQ3mdBjF0yMliv
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/348-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-2820-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 9nntbn.exe 2844 jvdjv.exe 2824 xlrxxfl.exe 2816 nhbhnn.exe 2664 9xfxlfl.exe 1888 tnbbhn.exe 1100 dvjpd.exe 2304 vvjvj.exe 2072 3rlllrl.exe 2792 tthnth.exe 1956 hbtttn.exe 2856 ppjpd.exe 3008 xrfffxl.exe 480 btnthn.exe 2132 9djdv.exe 2040 dvvjj.exe 604 frffffl.exe 2240 xrxflrr.exe 2280 nbbbhb.exe 2028 vdpjv.exe 1980 llfxffl.exe 1312 3rrlrlx.exe 2204 btbhtb.exe 1012 1btthn.exe 1040 jvvjp.exe 2396 rrlrfll.exe 2388 xrrlrrx.exe 2504 7nnbnn.exe 860 pjvvj.exe 2336 3fflrxf.exe 2244 htbhnt.exe 1668 tnbhhn.exe 2836 9vvdd.exe 2616 xxxrflr.exe 2740 xrlfrxf.exe 2768 tthhbn.exe 2604 bttbhh.exe 2728 jdppv.exe 2680 jdjpj.exe 1864 rlxllrx.exe 2292 hbnthh.exe 1608 7tbhth.exe 2216 dpvpp.exe 2976 dvdjd.exe 1856 ffrxlfx.exe 1752 lfxxllr.exe 1956 7nthhh.exe 2956 nhtbnh.exe 3004 pjpvj.exe 1968 fxlrxxf.exe 688 xrfrflf.exe 1760 9hhthh.exe 1148 xrfxffl.exe 568 fxflxfl.exe 2468 httbtt.exe 2456 hhnnbn.exe 3044 3pjvd.exe 2028 vpdjj.exe 1980 xlxxxfl.exe 2288 lfrflrf.exe 2020 hbhhnn.exe 1348 hbtttt.exe 1420 vpjpd.exe 1816 pvddj.exe -
resource yara_rule behavioral1/memory/348-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-2820-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 2232 348 a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe 30 PID 348 wrote to memory of 2232 348 a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe 30 PID 348 wrote to memory of 2232 348 a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe 30 PID 348 wrote to memory of 2232 348 a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe 30 PID 2232 wrote to memory of 2844 2232 9nntbn.exe 31 PID 2232 wrote to memory of 2844 2232 9nntbn.exe 31 PID 2232 wrote to memory of 2844 2232 9nntbn.exe 31 PID 2232 wrote to memory of 2844 2232 9nntbn.exe 31 PID 2844 wrote to memory of 2824 2844 jvdjv.exe 32 PID 2844 wrote to memory of 2824 2844 jvdjv.exe 32 PID 2844 wrote to memory of 2824 2844 jvdjv.exe 32 PID 2844 wrote to memory of 2824 2844 jvdjv.exe 32 PID 2824 wrote to memory of 2816 2824 xlrxxfl.exe 33 PID 2824 wrote to memory of 2816 2824 xlrxxfl.exe 33 PID 2824 wrote to memory of 2816 2824 xlrxxfl.exe 33 PID 2824 wrote to memory of 2816 2824 xlrxxfl.exe 33 PID 2816 wrote to memory of 2664 2816 nhbhnn.exe 34 PID 2816 wrote to memory of 2664 2816 nhbhnn.exe 34 PID 2816 wrote to memory of 2664 2816 nhbhnn.exe 34 PID 2816 wrote to memory of 2664 2816 nhbhnn.exe 34 PID 2664 wrote to memory of 1888 2664 9xfxlfl.exe 35 PID 2664 wrote to memory of 1888 2664 9xfxlfl.exe 35 PID 2664 wrote to memory of 1888 2664 9xfxlfl.exe 35 PID 2664 wrote to memory of 1888 2664 9xfxlfl.exe 35 PID 1888 wrote to memory of 1100 1888 tnbbhn.exe 36 PID 1888 wrote to memory of 1100 1888 tnbbhn.exe 36 PID 1888 wrote to memory of 1100 1888 tnbbhn.exe 36 PID 1888 wrote to memory of 1100 1888 tnbbhn.exe 36 PID 1100 wrote to memory of 2304 1100 dvjpd.exe 37 PID 1100 wrote to memory of 2304 1100 dvjpd.exe 37 PID 1100 wrote to memory of 2304 1100 dvjpd.exe 37 PID 1100 wrote to memory of 2304 1100 dvjpd.exe 37 PID 2304 wrote to memory of 2072 2304 vvjvj.exe 38 PID 2304 wrote to memory of 2072 2304 vvjvj.exe 38 PID 2304 wrote to memory of 2072 2304 vvjvj.exe 38 PID 2304 wrote to memory of 2072 2304 vvjvj.exe 38 PID 2072 wrote to memory of 2792 2072 3rlllrl.exe 39 PID 2072 wrote to memory of 2792 2072 3rlllrl.exe 39 PID 2072 wrote to memory of 2792 2072 3rlllrl.exe 39 PID 2072 wrote to memory of 2792 2072 3rlllrl.exe 39 PID 2792 wrote to memory of 1956 2792 tthnth.exe 40 PID 2792 wrote to memory of 1956 2792 tthnth.exe 40 PID 2792 wrote to memory of 1956 2792 tthnth.exe 40 PID 2792 wrote to memory of 1956 2792 tthnth.exe 40 PID 1956 wrote to memory of 2856 1956 hbtttn.exe 41 PID 1956 wrote to memory of 2856 1956 hbtttn.exe 41 PID 1956 wrote to memory of 2856 1956 hbtttn.exe 41 PID 1956 wrote to memory of 2856 1956 hbtttn.exe 41 PID 2856 wrote to memory of 3008 2856 ppjpd.exe 42 PID 2856 wrote to memory of 3008 2856 ppjpd.exe 42 PID 2856 wrote to memory of 3008 2856 ppjpd.exe 42 PID 2856 wrote to memory of 3008 2856 ppjpd.exe 42 PID 3008 wrote to memory of 480 3008 xrfffxl.exe 43 PID 3008 wrote to memory of 480 3008 xrfffxl.exe 43 PID 3008 wrote to memory of 480 3008 xrfffxl.exe 43 PID 3008 wrote to memory of 480 3008 xrfffxl.exe 43 PID 480 wrote to memory of 2132 480 btnthn.exe 44 PID 480 wrote to memory of 2132 480 btnthn.exe 44 PID 480 wrote to memory of 2132 480 btnthn.exe 44 PID 480 wrote to memory of 2132 480 btnthn.exe 44 PID 2132 wrote to memory of 2040 2132 9djdv.exe 45 PID 2132 wrote to memory of 2040 2132 9djdv.exe 45 PID 2132 wrote to memory of 2040 2132 9djdv.exe 45 PID 2132 wrote to memory of 2040 2132 9djdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe"C:\Users\Admin\AppData\Local\Temp\a0224f122f55ac11e57d3c72e256e88f6f575a5bc4757ccd644186ce18b26e72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\9nntbn.exec:\9nntbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\jvdjv.exec:\jvdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xlrxxfl.exec:\xlrxxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nhbhnn.exec:\nhbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\9xfxlfl.exec:\9xfxlfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tnbbhn.exec:\tnbbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\dvjpd.exec:\dvjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\vvjvj.exec:\vvjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\3rlllrl.exec:\3rlllrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\tthnth.exec:\tthnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hbtttn.exec:\hbtttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\ppjpd.exec:\ppjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xrfffxl.exec:\xrfffxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\btnthn.exec:\btnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\9djdv.exec:\9djdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\dvvjj.exec:\dvvjj.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\frffffl.exec:\frffffl.exe18⤵
- Executes dropped EXE
PID:604 -
\??\c:\xrxflrr.exec:\xrxflrr.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nbbbhb.exec:\nbbbhb.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vdpjv.exec:\vdpjv.exe21⤵
- Executes dropped EXE
PID:2028 -
\??\c:\llfxffl.exec:\llfxffl.exe22⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3rrlrlx.exec:\3rrlrlx.exe23⤵
- Executes dropped EXE
PID:1312 -
\??\c:\btbhtb.exec:\btbhtb.exe24⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1btthn.exec:\1btthn.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jvvjp.exec:\jvvjp.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rrlrfll.exec:\rrlrfll.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7nnbnn.exec:\7nnbnn.exe29⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pjvvj.exec:\pjvvj.exe30⤵
- Executes dropped EXE
PID:860 -
\??\c:\3fflrxf.exec:\3fflrxf.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\htbhnt.exec:\htbhnt.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tnbhhn.exec:\tnbhhn.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\9vvdd.exec:\9vvdd.exe34⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xxxrflr.exec:\xxxrflr.exe35⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xrlfrxf.exec:\xrlfrxf.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tthhbn.exec:\tthhbn.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bttbhh.exec:\bttbhh.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdppv.exec:\jdppv.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jdjpj.exec:\jdjpj.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlxllrx.exec:\rlxllrx.exe41⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbnthh.exec:\hbnthh.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7tbhth.exec:\7tbhth.exe43⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dpvpp.exec:\dpvpp.exe44⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dvdjd.exec:\dvdjd.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ffrxlfx.exec:\ffrxlfx.exe46⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfxxllr.exec:\lfxxllr.exe47⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7nthhh.exec:\7nthhh.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhtbnh.exec:\nhtbnh.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pjpvj.exec:\pjpvj.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe51⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xrfrflf.exec:\xrfrflf.exe52⤵
- Executes dropped EXE
PID:688 -
\??\c:\9hhthh.exec:\9hhthh.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrfxffl.exec:\xrfxffl.exe54⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fxflxfl.exec:\fxflxfl.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\httbtt.exec:\httbtt.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468 -
\??\c:\hhnnbn.exec:\hhnnbn.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\3pjvd.exec:\3pjvd.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpdjj.exec:\vpdjj.exe59⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xlxxxfl.exec:\xlxxxfl.exe60⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lfrflrf.exec:\lfrflrf.exe61⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hbhhnn.exec:\hbhhnn.exe62⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hbtttt.exec:\hbtttt.exe63⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pvddj.exec:\pvddj.exe65⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lllxfrr.exec:\lllxfrr.exe66⤵PID:1424
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe67⤵PID:1652
-
\??\c:\thtbtb.exec:\thtbtb.exe68⤵PID:2400
-
\??\c:\3tnhhh.exec:\3tnhhh.exe69⤵PID:2428
-
\??\c:\7ppdp.exec:\7ppdp.exe70⤵PID:348
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe71⤵PID:2872
-
\??\c:\7xlxflr.exec:\7xlxflr.exe72⤵PID:1548
-
\??\c:\nhhnbt.exec:\nhhnbt.exe73⤵PID:2444
-
\??\c:\3ntbbt.exec:\3ntbbt.exe74⤵PID:3036
-
\??\c:\3djdj.exec:\3djdj.exe75⤵PID:2836
-
\??\c:\vjddj.exec:\vjddj.exe76⤵PID:2616
-
\??\c:\9lfllll.exec:\9lfllll.exe77⤵PID:1892
-
\??\c:\lflrxrr.exec:\lflrxrr.exe78⤵PID:2768
-
\??\c:\bnbnbh.exec:\bnbnbh.exe79⤵PID:2664
-
\??\c:\hbhbnn.exec:\hbhbnn.exe80⤵PID:2728
-
\??\c:\tbnhnh.exec:\tbnhnh.exe81⤵PID:2680
-
\??\c:\jjvjj.exec:\jjvjj.exe82⤵PID:1864
-
\??\c:\vpdvv.exec:\vpdvv.exe83⤵PID:2292
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe84⤵PID:1608
-
\??\c:\lxlllfl.exec:\lxlllfl.exe85⤵PID:2216
-
\??\c:\1nnntn.exec:\1nnntn.exe86⤵PID:2976
-
\??\c:\thnbnh.exec:\thnbnh.exe87⤵
- System Location Discovery: System Language Discovery
PID:1856 -
\??\c:\5dpdv.exec:\5dpdv.exe88⤵PID:1752
-
\??\c:\vpvpd.exec:\vpvpd.exe89⤵PID:1956
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe90⤵PID:2956
-
\??\c:\lxlrffl.exec:\lxlrffl.exe91⤵PID:3004
-
\??\c:\bnhhnb.exec:\bnhhnb.exe92⤵PID:1244
-
\??\c:\7tnhnn.exec:\7tnhnn.exe93⤵PID:688
-
\??\c:\7bnntt.exec:\7bnntt.exe94⤵PID:1760
-
\??\c:\dppvp.exec:\dppvp.exe95⤵PID:2564
-
\??\c:\frlrrxf.exec:\frlrrxf.exe96⤵PID:568
-
\??\c:\9lxlrxl.exec:\9lxlrxl.exe97⤵PID:2012
-
\??\c:\7bbtbb.exec:\7bbtbb.exe98⤵PID:2456
-
\??\c:\thnntt.exec:\thnntt.exe99⤵PID:3044
-
\??\c:\vjpjp.exec:\vjpjp.exe100⤵PID:3052
-
\??\c:\5vpjp.exec:\5vpjp.exe101⤵PID:1484
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe102⤵PID:2288
-
\??\c:\xrflxxx.exec:\xrflxxx.exe103⤵PID:948
-
\??\c:\htbhnn.exec:\htbhnn.exe104⤵PID:1564
-
\??\c:\7thhhn.exec:\7thhhn.exe105⤵PID:2324
-
\??\c:\jvddd.exec:\jvddd.exe106⤵PID:1816
-
\??\c:\jvdvv.exec:\jvdvv.exe107⤵PID:1424
-
\??\c:\xfrxllr.exec:\xfrxllr.exe108⤵PID:1744
-
\??\c:\rffrxxl.exec:\rffrxxl.exe109⤵PID:2508
-
\??\c:\hbnntt.exec:\hbnntt.exe110⤵PID:2428
-
\??\c:\thbbhn.exec:\thbbhn.exe111⤵PID:348
-
\??\c:\vpvjv.exec:\vpvjv.exe112⤵PID:2872
-
\??\c:\pjdvj.exec:\pjdvj.exe113⤵PID:2828
-
\??\c:\lflrfxf.exec:\lflrfxf.exe114⤵PID:2444
-
\??\c:\5rxllrx.exec:\5rxllrx.exe115⤵PID:3036
-
\??\c:\bthnbh.exec:\bthnbh.exe116⤵PID:2844
-
\??\c:\tntntn.exec:\tntntn.exe117⤵PID:2616
-
\??\c:\dvpvd.exec:\dvpvd.exe118⤵PID:1892
-
\??\c:\7jvvj.exec:\7jvvj.exe119⤵PID:2656
-
\??\c:\1jpvv.exec:\1jpvv.exe120⤵PID:2664
-
\??\c:\xrlrxrr.exec:\xrlrxrr.exe121⤵PID:2684
-
\??\c:\lflxffl.exec:\lflxffl.exe122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-