Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe
Resource
win7-20240729-en
General
-
Target
5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe
-
Size
230KB
-
MD5
d36ab0bd58ada2d5fb9f6560c8d8bf30
-
SHA1
4a5bba862c57082a57dbc212d5ea77bc8052e2c3
-
SHA256
5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed
-
SHA512
7bfa5722700e4d1b02c93d19efdf9b5e7aaa8ca26c89e177fa2bf6dcfe66c5446e584087bd83ae7b5349c7af8d047b702a34dd4a8a5c7fff734529825cbb6d9b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1f7:n3C9BRo7MlrWKo+lxKk1f7
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2524-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/396-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/740-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 940 hhhbnb.exe 2188 ddvvd.exe 2820 pppjv.exe 2712 lfffxfr.exe 2624 nttnht.exe 2724 7frxlrr.exe 2604 bbbbtb.exe 2856 pjdjv.exe 1128 llfrfxr.exe 2436 3bntht.exe 1316 jjddv.exe 1340 xrlxllf.exe 1652 nnnhth.exe 1088 1vppj.exe 2912 tttnbt.exe 396 bbhhnt.exe 1704 llxlxfr.exe 868 7bnthn.exe 988 djjvv.exe 2176 frfrlxf.exe 2164 tthnht.exe 2044 ppdpj.exe 680 3xllrfl.exe 2964 bbntht.exe 2540 xrlxrxr.exe 3000 llxlflx.exe 1232 ppjjd.exe 1456 9rxrrfx.exe 2204 tnbntt.exe 1780 vdvjj.exe 740 rrrffxl.exe 2328 bbbnbh.exe 2944 3xxlxfr.exe 2736 rrfrfxx.exe 2740 9hthth.exe 2848 vpppd.exe 2828 3jjpv.exe 2616 3frrffr.exe 2644 5lllrxl.exe 2592 7hnntb.exe 3052 vppdv.exe 1124 xrxxrff.exe 3056 1rllxxl.exe 2536 7btbbn.exe 2456 7tnntb.exe 1388 1jjpp.exe 1320 fxrxflx.exe 1632 7bhtbn.exe 2796 hhnbht.exe 2900 7pvpv.exe 1824 dvpjv.exe 2136 xrrxlfl.exe 2360 7ttbhn.exe 1208 jpjvd.exe 1460 pjjpj.exe 1512 rxffrrx.exe 2068 rlxxlll.exe 2252 9thntb.exe 1888 5vjpj.exe 2544 ddjjp.exe 1100 xxrrffr.exe 264 9fxfffr.exe 824 hbbtht.exe 2280 ppdjv.exe -
resource yara_rule behavioral1/memory/2524-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/396-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/740-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 940 2524 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 29 PID 2524 wrote to memory of 940 2524 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 29 PID 2524 wrote to memory of 940 2524 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 29 PID 2524 wrote to memory of 940 2524 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 29 PID 940 wrote to memory of 2188 940 hhhbnb.exe 30 PID 940 wrote to memory of 2188 940 hhhbnb.exe 30 PID 940 wrote to memory of 2188 940 hhhbnb.exe 30 PID 940 wrote to memory of 2188 940 hhhbnb.exe 30 PID 2188 wrote to memory of 2820 2188 ddvvd.exe 31 PID 2188 wrote to memory of 2820 2188 ddvvd.exe 31 PID 2188 wrote to memory of 2820 2188 ddvvd.exe 31 PID 2188 wrote to memory of 2820 2188 ddvvd.exe 31 PID 2820 wrote to memory of 2712 2820 pppjv.exe 32 PID 2820 wrote to memory of 2712 2820 pppjv.exe 32 PID 2820 wrote to memory of 2712 2820 pppjv.exe 32 PID 2820 wrote to memory of 2712 2820 pppjv.exe 32 PID 2712 wrote to memory of 2624 2712 lfffxfr.exe 33 PID 2712 wrote to memory of 2624 2712 lfffxfr.exe 33 PID 2712 wrote to memory of 2624 2712 lfffxfr.exe 33 PID 2712 wrote to memory of 2624 2712 lfffxfr.exe 33 PID 2624 wrote to memory of 2724 2624 nttnht.exe 34 PID 2624 wrote to memory of 2724 2624 nttnht.exe 34 PID 2624 wrote to memory of 2724 2624 nttnht.exe 34 PID 2624 wrote to memory of 2724 2624 nttnht.exe 34 PID 2724 wrote to memory of 2604 2724 7frxlrr.exe 35 PID 2724 wrote to memory of 2604 2724 7frxlrr.exe 35 PID 2724 wrote to memory of 2604 2724 7frxlrr.exe 35 PID 2724 wrote to memory of 2604 2724 7frxlrr.exe 35 PID 2604 wrote to memory of 2856 2604 bbbbtb.exe 36 PID 2604 wrote to memory of 2856 2604 bbbbtb.exe 36 PID 2604 wrote to memory of 2856 2604 bbbbtb.exe 36 PID 2604 wrote to memory of 2856 2604 bbbbtb.exe 36 PID 2856 wrote to memory of 1128 2856 pjdjv.exe 37 PID 2856 wrote to memory of 1128 2856 pjdjv.exe 37 PID 2856 wrote to memory of 1128 2856 pjdjv.exe 37 PID 2856 wrote to memory of 1128 2856 pjdjv.exe 37 PID 1128 wrote to memory of 2436 1128 llfrfxr.exe 38 PID 1128 wrote to memory of 2436 1128 llfrfxr.exe 38 PID 1128 wrote to memory of 2436 1128 llfrfxr.exe 38 PID 1128 wrote to memory of 2436 1128 llfrfxr.exe 38 PID 2436 wrote to memory of 1316 2436 3bntht.exe 39 PID 2436 wrote to memory of 1316 2436 3bntht.exe 39 PID 2436 wrote to memory of 1316 2436 3bntht.exe 39 PID 2436 wrote to memory of 1316 2436 3bntht.exe 39 PID 1316 wrote to memory of 1340 1316 jjddv.exe 40 PID 1316 wrote to memory of 1340 1316 jjddv.exe 40 PID 1316 wrote to memory of 1340 1316 jjddv.exe 40 PID 1316 wrote to memory of 1340 1316 jjddv.exe 40 PID 1340 wrote to memory of 1652 1340 xrlxllf.exe 41 PID 1340 wrote to memory of 1652 1340 xrlxllf.exe 41 PID 1340 wrote to memory of 1652 1340 xrlxllf.exe 41 PID 1340 wrote to memory of 1652 1340 xrlxllf.exe 41 PID 1652 wrote to memory of 1088 1652 nnnhth.exe 42 PID 1652 wrote to memory of 1088 1652 nnnhth.exe 42 PID 1652 wrote to memory of 1088 1652 nnnhth.exe 42 PID 1652 wrote to memory of 1088 1652 nnnhth.exe 42 PID 1088 wrote to memory of 2912 1088 1vppj.exe 43 PID 1088 wrote to memory of 2912 1088 1vppj.exe 43 PID 1088 wrote to memory of 2912 1088 1vppj.exe 43 PID 1088 wrote to memory of 2912 1088 1vppj.exe 43 PID 2912 wrote to memory of 396 2912 tttnbt.exe 44 PID 2912 wrote to memory of 396 2912 tttnbt.exe 44 PID 2912 wrote to memory of 396 2912 tttnbt.exe 44 PID 2912 wrote to memory of 396 2912 tttnbt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe"C:\Users\Admin\AppData\Local\Temp\5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hhhbnb.exec:\hhhbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\ddvvd.exec:\ddvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pppjv.exec:\pppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lfffxfr.exec:\lfffxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nttnht.exec:\nttnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\7frxlrr.exec:\7frxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bbbbtb.exec:\bbbbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pjdjv.exec:\pjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\llfrfxr.exec:\llfrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\3bntht.exec:\3bntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jjddv.exec:\jjddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\xrlxllf.exec:\xrlxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\nnnhth.exec:\nnnhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\1vppj.exec:\1vppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\tttnbt.exec:\tttnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\bbhhnt.exec:\bbhhnt.exe17⤵
- Executes dropped EXE
PID:396 -
\??\c:\llxlxfr.exec:\llxlxfr.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7bnthn.exec:\7bnthn.exe19⤵
- Executes dropped EXE
PID:868 -
\??\c:\djjvv.exec:\djjvv.exe20⤵
- Executes dropped EXE
PID:988 -
\??\c:\frfrlxf.exec:\frfrlxf.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\tthnht.exec:\tthnht.exe22⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ppdpj.exec:\ppdpj.exe23⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3xllrfl.exec:\3xllrfl.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\bbntht.exec:\bbntht.exe25⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe26⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llxlflx.exec:\llxlflx.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ppjjd.exec:\ppjjd.exe28⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9rxrrfx.exec:\9rxrrfx.exe29⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnbntt.exec:\tnbntt.exe30⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vdvjj.exec:\vdvjj.exe31⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rrrffxl.exec:\rrrffxl.exe32⤵
- Executes dropped EXE
PID:740 -
\??\c:\bbbnbh.exec:\bbbnbh.exe33⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3xxlxfr.exec:\3xxlxfr.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\rrfrfxx.exec:\rrfrfxx.exe35⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9hthth.exec:\9hthth.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vpppd.exec:\vpppd.exe37⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3jjpv.exec:\3jjpv.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3frrffr.exec:\3frrffr.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5lllrxl.exec:\5lllrxl.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7hnntb.exec:\7hnntb.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vppdv.exec:\vppdv.exe42⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xrxxrff.exec:\xrxxrff.exe43⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1rllxxl.exec:\1rllxxl.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7btbbn.exec:\7btbbn.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7tnntb.exec:\7tnntb.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1jjpp.exec:\1jjpp.exe47⤵
- Executes dropped EXE
PID:1388 -
\??\c:\fxrxflx.exec:\fxrxflx.exe48⤵
- Executes dropped EXE
PID:1320 -
\??\c:\7bhtbn.exec:\7bhtbn.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hhnbht.exec:\hhnbht.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7pvpv.exec:\7pvpv.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dvpjv.exec:\dvpjv.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xrrxlfl.exec:\xrrxlfl.exe53⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7ttbhn.exec:\7ttbhn.exe54⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jpjvd.exec:\jpjvd.exe55⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pjjpj.exec:\pjjpj.exe56⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rxffrrx.exec:\rxffrrx.exe57⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlxxlll.exec:\rlxxlll.exe58⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9thntb.exec:\9thntb.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5vjpj.exec:\5vjpj.exe60⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ddjjp.exec:\ddjjp.exe61⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xxrrffr.exec:\xxrrffr.exe62⤵
- Executes dropped EXE
PID:1100 -
\??\c:\9fxfffr.exec:\9fxfffr.exe63⤵
- Executes dropped EXE
PID:264 -
\??\c:\hbbtht.exec:\hbbtht.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\ppdjv.exec:\ppdjv.exe65⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jjddv.exec:\jjddv.exe66⤵PID:1984
-
\??\c:\lfflxxl.exec:\lfflxxl.exe67⤵PID:2324
-
\??\c:\bthhnt.exec:\bthhnt.exe68⤵PID:3008
-
\??\c:\jdvvd.exec:\jdvvd.exe69⤵PID:1752
-
\??\c:\jjjpd.exec:\jjjpd.exe70⤵PID:2120
-
\??\c:\lllxfrx.exec:\lllxfrx.exe71⤵PID:664
-
\??\c:\xlxlrxf.exec:\xlxlrxf.exe72⤵PID:2512
-
\??\c:\nhttbb.exec:\nhttbb.exe73⤵PID:2412
-
\??\c:\vvpdp.exec:\vvpdp.exe74⤵PID:2316
-
\??\c:\ddvdd.exec:\ddvdd.exe75⤵PID:2844
-
\??\c:\lllxlrf.exec:\lllxlrf.exe76⤵PID:2596
-
\??\c:\btnthh.exec:\btnthh.exe77⤵PID:2744
-
\??\c:\3btbtn.exec:\3btbtn.exe78⤵PID:2836
-
\??\c:\5vpdj.exec:\5vpdj.exe79⤵PID:2756
-
\??\c:\xffrlrl.exec:\xffrlrl.exe80⤵PID:2600
-
\??\c:\xxlxxfr.exec:\xxlxxfr.exe81⤵PID:2584
-
\??\c:\bhhnbh.exec:\bhhnbh.exe82⤵PID:2752
-
\??\c:\1vjpj.exec:\1vjpj.exe83⤵PID:3068
-
\??\c:\vpjdd.exec:\vpjdd.exe84⤵PID:1792
-
\??\c:\xrflrxr.exec:\xrflrxr.exe85⤵PID:2104
-
\??\c:\9hntbh.exec:\9hntbh.exe86⤵PID:2452
-
\??\c:\9nnthn.exec:\9nnthn.exe87⤵PID:880
-
\??\c:\vvvvj.exec:\vvvvj.exe88⤵PID:1072
-
\??\c:\jdjjd.exec:\jdjjd.exe89⤵PID:1740
-
\??\c:\9fxflrl.exec:\9fxflrl.exe90⤵PID:2656
-
\??\c:\htthbt.exec:\htthbt.exe91⤵PID:2916
-
\??\c:\ddvdp.exec:\ddvdp.exe92⤵PID:3016
-
\??\c:\ppvjj.exec:\ppvjj.exe93⤵PID:396
-
\??\c:\fxflflr.exec:\fxflflr.exe94⤵PID:1852
-
\??\c:\xrffrrf.exec:\xrffrrf.exe95⤵PID:2056
-
\??\c:\tnbhtb.exec:\tnbhtb.exe96⤵PID:2432
-
\??\c:\pdvvv.exec:\pdvvv.exe97⤵PID:2220
-
\??\c:\jdjvd.exec:\jdjvd.exe98⤵PID:2152
-
\??\c:\xxfrlrf.exec:\xxfrlrf.exe99⤵PID:1776
-
\??\c:\hbtbhb.exec:\hbtbhb.exe100⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\nhbntb.exec:\nhbntb.exe101⤵PID:596
-
\??\c:\dvppv.exec:\dvppv.exe102⤵PID:2200
-
\??\c:\llrxrxx.exec:\llrxrxx.exe103⤵PID:2272
-
\??\c:\rlfflll.exec:\rlfflll.exe104⤵PID:2284
-
\??\c:\bttbtt.exec:\bttbtt.exe105⤵PID:1872
-
\??\c:\hnbbbt.exec:\hnbbbt.exe106⤵PID:2364
-
\??\c:\jppjj.exec:\jppjj.exe107⤵PID:492
-
\??\c:\lflllxl.exec:\lflllxl.exe108⤵PID:1456
-
\??\c:\rlxfllx.exec:\rlxfllx.exe109⤵PID:860
-
\??\c:\3nhnhn.exec:\3nhnhn.exe110⤵PID:1476
-
\??\c:\vvpjv.exec:\vvpjv.exe111⤵PID:2312
-
\??\c:\jdjjj.exec:\jdjjj.exe112⤵PID:1712
-
\??\c:\1xrfrlf.exec:\1xrfrlf.exe113⤵PID:2328
-
\??\c:\bbhbbn.exec:\bbhbbn.exe114⤵PID:2944
-
\??\c:\btntth.exec:\btntth.exe115⤵PID:2812
-
\??\c:\1vvdp.exec:\1vvdp.exe116⤵PID:2808
-
\??\c:\pdddj.exec:\pdddj.exe117⤵PID:2864
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe118⤵PID:2612
-
\??\c:\hnbhnt.exec:\hnbhnt.exe119⤵PID:2084
-
\??\c:\nhbhbb.exec:\nhbhbb.exe120⤵PID:2644
-
\??\c:\vvdjv.exec:\vvdjv.exe121⤵PID:2604
-
\??\c:\5pjpp.exec:\5pjpp.exe122⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-