Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe
Resource
win7-20240903-en
General
-
Target
7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe
-
Size
82KB
-
MD5
0321db85b2e98db7f8c799fc1da15fce
-
SHA1
4df5c51ead9f140bbf826a83a07d09686b136110
-
SHA256
7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac
-
SHA512
e3ff7a9356f87faf78aa6910d7230829036a212ab9189c6cfb6119443425fd41ba52a5d39326140f845716731b89be4f3d824fe808c9c22ed4b3c894abde49bc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QP:ymb3NkkiQ3mdBjFIIp9L9QrrA8Y
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 1bnttb.exe 2720 hbhtnb.exe 2796 jvjpj.exe 2600 ffrfxlx.exe 2560 nnhhbt.exe 532 ddvpv.exe 2236 3frxflf.exe 1816 5pdvd.exe 2288 pjpdj.exe 1580 frffflr.exe 2856 3xlxxlf.exe 1040 tnbhnn.exe 2756 ddppd.exe 2960 ffxrlrl.exe 1096 rxlrlxr.exe 2372 1jvvj.exe 2148 djjdj.exe 1876 xfxlfxx.exe 632 7tthth.exe 2928 hnhtnt.exe 1228 djddv.exe 352 1fxfrxf.exe 2100 rrxxlrr.exe 560 tbhhbb.exe 1844 1pppj.exe 2324 jdjjj.exe 752 lfrflxl.exe 2644 nnhnnn.exe 348 ddvvp.exe 2016 vvpvj.exe 2780 fflxfll.exe 2696 tnhhnt.exe 1588 9hnbnh.exe 2872 7jdjj.exe 2760 xrlrlrf.exe 2708 rlxlfrf.exe 2576 nnbttt.exe 2628 7nhtbh.exe 2160 tnnhth.exe 2364 jjvjj.exe 376 dvppd.exe 2304 xlxfrrf.exe 2852 rrrfrrl.exe 2632 tnhhtt.exe 556 ddpdp.exe 2272 ddvdd.exe 1812 rrxrfrl.exe 2088 fffllrl.exe 936 bthbth.exe 1160 5nnbnt.exe 2028 jjjdp.exe 1956 ppddp.exe 2196 xxlrflf.exe 2148 9rlfrrl.exe 1876 btbtnb.exe 444 bbhhnh.exe 272 jjpdj.exe 3052 ppjpd.exe 2948 ffxllxr.exe 888 bbnnnh.exe 2652 1ttnnb.exe 3036 dddpj.exe 2108 3jpdp.exe 1752 7lxrxlf.exe -
resource yara_rule behavioral1/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2724 1448 7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe 30 PID 1448 wrote to memory of 2724 1448 7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe 30 PID 1448 wrote to memory of 2724 1448 7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe 30 PID 1448 wrote to memory of 2724 1448 7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe 30 PID 2724 wrote to memory of 2720 2724 1bnttb.exe 31 PID 2724 wrote to memory of 2720 2724 1bnttb.exe 31 PID 2724 wrote to memory of 2720 2724 1bnttb.exe 31 PID 2724 wrote to memory of 2720 2724 1bnttb.exe 31 PID 2720 wrote to memory of 2796 2720 hbhtnb.exe 32 PID 2720 wrote to memory of 2796 2720 hbhtnb.exe 32 PID 2720 wrote to memory of 2796 2720 hbhtnb.exe 32 PID 2720 wrote to memory of 2796 2720 hbhtnb.exe 32 PID 2796 wrote to memory of 2600 2796 jvjpj.exe 33 PID 2796 wrote to memory of 2600 2796 jvjpj.exe 33 PID 2796 wrote to memory of 2600 2796 jvjpj.exe 33 PID 2796 wrote to memory of 2600 2796 jvjpj.exe 33 PID 2600 wrote to memory of 2560 2600 ffrfxlx.exe 34 PID 2600 wrote to memory of 2560 2600 ffrfxlx.exe 34 PID 2600 wrote to memory of 2560 2600 ffrfxlx.exe 34 PID 2600 wrote to memory of 2560 2600 ffrfxlx.exe 34 PID 2560 wrote to memory of 532 2560 nnhhbt.exe 35 PID 2560 wrote to memory of 532 2560 nnhhbt.exe 35 PID 2560 wrote to memory of 532 2560 nnhhbt.exe 35 PID 2560 wrote to memory of 532 2560 nnhhbt.exe 35 PID 532 wrote to memory of 2236 532 ddvpv.exe 36 PID 532 wrote to memory of 2236 532 ddvpv.exe 36 PID 532 wrote to memory of 2236 532 ddvpv.exe 36 PID 532 wrote to memory of 2236 532 ddvpv.exe 36 PID 2236 wrote to memory of 1816 2236 3frxflf.exe 37 PID 2236 wrote to memory of 1816 2236 3frxflf.exe 37 PID 2236 wrote to memory of 1816 2236 3frxflf.exe 37 PID 2236 wrote to memory of 1816 2236 3frxflf.exe 37 PID 1816 wrote to memory of 2288 1816 5pdvd.exe 38 PID 1816 wrote to memory of 2288 1816 5pdvd.exe 38 PID 1816 wrote to memory of 2288 1816 5pdvd.exe 38 PID 1816 wrote to memory of 2288 1816 5pdvd.exe 38 PID 2288 wrote to memory of 1580 2288 pjpdj.exe 39 PID 2288 wrote to memory of 1580 2288 pjpdj.exe 39 PID 2288 wrote to memory of 1580 2288 pjpdj.exe 39 PID 2288 wrote to memory of 1580 2288 pjpdj.exe 39 PID 1580 wrote to memory of 2856 1580 frffflr.exe 40 PID 1580 wrote to memory of 2856 1580 frffflr.exe 40 PID 1580 wrote to memory of 2856 1580 frffflr.exe 40 PID 1580 wrote to memory of 2856 1580 frffflr.exe 40 PID 2856 wrote to memory of 1040 2856 3xlxxlf.exe 41 PID 2856 wrote to memory of 1040 2856 3xlxxlf.exe 41 PID 2856 wrote to memory of 1040 2856 3xlxxlf.exe 41 PID 2856 wrote to memory of 1040 2856 3xlxxlf.exe 41 PID 1040 wrote to memory of 2756 1040 tnbhnn.exe 42 PID 1040 wrote to memory of 2756 1040 tnbhnn.exe 42 PID 1040 wrote to memory of 2756 1040 tnbhnn.exe 42 PID 1040 wrote to memory of 2756 1040 tnbhnn.exe 42 PID 2756 wrote to memory of 2960 2756 ddppd.exe 43 PID 2756 wrote to memory of 2960 2756 ddppd.exe 43 PID 2756 wrote to memory of 2960 2756 ddppd.exe 43 PID 2756 wrote to memory of 2960 2756 ddppd.exe 43 PID 2960 wrote to memory of 1096 2960 ffxrlrl.exe 44 PID 2960 wrote to memory of 1096 2960 ffxrlrl.exe 44 PID 2960 wrote to memory of 1096 2960 ffxrlrl.exe 44 PID 2960 wrote to memory of 1096 2960 ffxrlrl.exe 44 PID 1096 wrote to memory of 2372 1096 rxlrlxr.exe 45 PID 1096 wrote to memory of 2372 1096 rxlrlxr.exe 45 PID 1096 wrote to memory of 2372 1096 rxlrlxr.exe 45 PID 1096 wrote to memory of 2372 1096 rxlrlxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe"C:\Users\Admin\AppData\Local\Temp\7007ac6de02096b69a75fa2255f0e0f00d3b70c9d0c4122da2a3f81737cc9bac.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\1bnttb.exec:\1bnttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hbhtnb.exec:\hbhtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jvjpj.exec:\jvjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ffrfxlx.exec:\ffrfxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nnhhbt.exec:\nnhhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ddvpv.exec:\ddvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\3frxflf.exec:\3frxflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\5pdvd.exec:\5pdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\pjpdj.exec:\pjpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\frffflr.exec:\frffflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\3xlxxlf.exec:\3xlxxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tnbhnn.exec:\tnbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\ddppd.exec:\ddppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ffxrlrl.exec:\ffxrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rxlrlxr.exec:\rxlrlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\1jvvj.exec:\1jvvj.exe17⤵
- Executes dropped EXE
PID:2372 -
\??\c:\djjdj.exec:\djjdj.exe18⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xfxlfxx.exec:\xfxlfxx.exe19⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7tthth.exec:\7tthth.exe20⤵
- Executes dropped EXE
PID:632 -
\??\c:\hnhtnt.exec:\hnhtnt.exe21⤵
- Executes dropped EXE
PID:2928 -
\??\c:\djddv.exec:\djddv.exe22⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1fxfrxf.exec:\1fxfrxf.exe23⤵
- Executes dropped EXE
PID:352 -
\??\c:\rrxxlrr.exec:\rrxxlrr.exe24⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tbhhbb.exec:\tbhhbb.exe25⤵
- Executes dropped EXE
PID:560 -
\??\c:\1pppj.exec:\1pppj.exe26⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jdjjj.exec:\jdjjj.exe27⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lfrflxl.exec:\lfrflxl.exe28⤵
- Executes dropped EXE
PID:752 -
\??\c:\nnhnnn.exec:\nnhnnn.exe29⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ddvvp.exec:\ddvvp.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
PID:2016 -
\??\c:\fflxfll.exec:\fflxfll.exe32⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnhhnt.exec:\tnhhnt.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9hnbnh.exec:\9hnbnh.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7jdjj.exec:\7jdjj.exe35⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rlxlfrf.exec:\rlxlfrf.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nnbttt.exec:\nnbttt.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\7nhtbh.exec:\7nhtbh.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnnhth.exec:\tnnhth.exe40⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jjvjj.exec:\jjvjj.exe41⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dvppd.exec:\dvppd.exe42⤵
- Executes dropped EXE
PID:376 -
\??\c:\xlxfrrf.exec:\xlxfrrf.exe43⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rrrfrrl.exec:\rrrfrrl.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnhhtt.exec:\tnhhtt.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ddpdp.exec:\ddpdp.exe46⤵
- Executes dropped EXE
PID:556 -
\??\c:\ddvdd.exec:\ddvdd.exe47⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rrxrfrl.exec:\rrxrfrl.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\fffllrl.exec:\fffllrl.exe49⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bthbth.exec:\bthbth.exe50⤵
- Executes dropped EXE
PID:936 -
\??\c:\5nnbnt.exec:\5nnbnt.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jjjdp.exec:\jjjdp.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppddp.exec:\ppddp.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xxlrflf.exec:\xxlrflf.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9rlfrrl.exec:\9rlfrrl.exe55⤵
- Executes dropped EXE
PID:2148 -
\??\c:\btbtnb.exec:\btbtnb.exe56⤵
- Executes dropped EXE
PID:1876 -
\??\c:\bbhhnh.exec:\bbhhnh.exe57⤵
- Executes dropped EXE
PID:444 -
\??\c:\jjpdj.exec:\jjpdj.exe58⤵
- Executes dropped EXE
PID:272 -
\??\c:\ppjpd.exec:\ppjpd.exe59⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ffxllxr.exec:\ffxllxr.exe60⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbnnnh.exec:\bbnnnh.exe61⤵
- Executes dropped EXE
PID:888 -
\??\c:\1ttnnb.exec:\1ttnnb.exe62⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dddpj.exec:\dddpj.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3jpdp.exec:\3jpdp.exe64⤵
- Executes dropped EXE
PID:2108 -
\??\c:\7lxrxlf.exec:\7lxrxlf.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xxrxflx.exec:\xxrxflx.exe66⤵PID:2456
-
\??\c:\tttnbn.exec:\tttnbn.exe67⤵PID:1072
-
\??\c:\bbtnbn.exec:\bbtnbn.exe68⤵PID:1084
-
\??\c:\5jvdp.exec:\5jvdp.exe69⤵PID:2700
-
\??\c:\djdvp.exec:\djdvp.exe70⤵PID:1860
-
\??\c:\ppjpd.exec:\ppjpd.exe71⤵PID:2724
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe72⤵PID:2876
-
\??\c:\rrfxrfr.exec:\rrfxrfr.exe73⤵PID:2668
-
\??\c:\bbttnt.exec:\bbttnt.exe74⤵PID:2800
-
\??\c:\1hhtnt.exec:\1hhtnt.exe75⤵PID:2892
-
\??\c:\djjvp.exec:\djjvp.exe76⤵PID:2612
-
\??\c:\dvvvv.exec:\dvvvv.exe77⤵PID:2584
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe78⤵PID:2636
-
\??\c:\xrlxflr.exec:\xrlxflr.exe79⤵PID:2408
-
\??\c:\1bhbbb.exec:\1bhbbb.exe80⤵PID:392
-
\??\c:\9nhbht.exec:\9nhbht.exe81⤵PID:1664
-
\??\c:\ppdpd.exec:\ppdpd.exe82⤵PID:2284
-
\??\c:\vdpvp.exec:\vdpvp.exe83⤵PID:2828
-
\??\c:\lllxrxf.exec:\lllxrxf.exe84⤵PID:1452
-
\??\c:\xrrlflf.exec:\xrrlflf.exe85⤵PID:2920
-
\??\c:\3hhnnt.exec:\3hhnnt.exe86⤵PID:2296
-
\??\c:\tttbnt.exec:\tttbnt.exe87⤵PID:2856
-
\??\c:\pjdpd.exec:\pjdpd.exe88⤵PID:2924
-
\??\c:\3pjvj.exec:\3pjvj.exe89⤵PID:1316
-
\??\c:\rllrfrf.exec:\rllrfrf.exe90⤵PID:2256
-
\??\c:\rxxfxxl.exec:\rxxfxxl.exe91⤵PID:536
-
\??\c:\tnbhbb.exec:\tnbhbb.exe92⤵PID:2204
-
\??\c:\5bbnbh.exec:\5bbnbh.exe93⤵PID:1956
-
\??\c:\dvvjp.exec:\dvvjp.exe94⤵PID:1864
-
\??\c:\vpvvp.exec:\vpvvp.exe95⤵PID:824
-
\??\c:\9rflrxf.exec:\9rflrxf.exe96⤵PID:2404
-
\??\c:\5lxfllx.exec:\5lxfllx.exe97⤵PID:1644
-
\??\c:\frrxlxr.exec:\frrxlxr.exe98⤵PID:1488
-
\??\c:\bthnth.exec:\bthnth.exe99⤵PID:1604
-
\??\c:\1nbbhh.exec:\1nbbhh.exe100⤵PID:820
-
\??\c:\pjpvv.exec:\pjpvv.exe101⤵PID:960
-
\??\c:\7dvvj.exec:\7dvvj.exe102⤵PID:2212
-
\??\c:\rlxfffx.exec:\rlxfffx.exe103⤵PID:3056
-
\??\c:\lllxlrf.exec:\lllxlrf.exe104⤵PID:2332
-
\??\c:\9htbnn.exec:\9htbnn.exe105⤵PID:2400
-
\??\c:\7tbnnb.exec:\7tbnnb.exe106⤵PID:1192
-
\??\c:\7dddd.exec:\7dddd.exe107⤵
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\ppjvp.exec:\ppjvp.exe108⤵PID:1636
-
\??\c:\ffxxflf.exec:\ffxxflf.exe109⤵PID:576
-
\??\c:\3lfrrff.exec:\3lfrrff.exe110⤵PID:1688
-
\??\c:\1btbnn.exec:\1btbnn.exe111⤵PID:1364
-
\??\c:\5nhtnt.exec:\5nhtnt.exe112⤵PID:2728
-
\??\c:\bbbnht.exec:\bbbnht.exe113⤵PID:1592
-
\??\c:\9vjvj.exec:\9vjvj.exe114⤵PID:1704
-
\??\c:\djvdd.exec:\djvdd.exe115⤵
- System Location Discovery: System Language Discovery
PID:2872 -
\??\c:\rxrxlrl.exec:\rxrxlrl.exe116⤵PID:2944
-
\??\c:\9xxlxfr.exec:\9xxlxfr.exe117⤵PID:2884
-
\??\c:\hnthbh.exec:\hnthbh.exe118⤵PID:2560
-
\??\c:\ttnttb.exec:\ttnttb.exe119⤵PID:2316
-
\??\c:\jvppd.exec:\jvppd.exe120⤵PID:1732
-
\??\c:\vpvdj.exec:\vpvdj.exe121⤵PID:1152
-
\??\c:\xxrxlfr.exec:\xxrxlfr.exe122⤵PID:2228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-