Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83011b160c7bfc88d03921004e96b5e0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
83011b160c7bfc88d03921004e96b5e0N.exe
-
Size
106KB
-
MD5
83011b160c7bfc88d03921004e96b5e0
-
SHA1
5340b8052aa012ad54bd62f106179e0763e00c63
-
SHA256
3b50f23b35aab14e233330180f740f7664cb8a5d85fd5df8ac0cb4b71162b2b8
-
SHA512
b4d0d55024151cc48ba9a88b3bce12041ffd1c226dd5034844a1db708b221e3bd1e6077c5a9edf0db7cfda324af6dfdb39972a816b87ff78c2048ff55fa7506b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3Cm5:n3C9BRo7MlrWKVT+buBGu3PH5
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/1144-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1988 frfffxf.exe 2352 7lfxfxf.exe 2460 3nnnnh.exe 2804 5jvdj.exe 2260 vpvjd.exe 2884 xxxlflf.exe 2904 lflrrrx.exe 2720 htbbhn.exe 2732 jvppv.exe 2636 llrflfl.exe 2328 5fxfrxx.exe 316 ttntnh.exe 2964 pvpvp.exe 2952 5rfllrx.exe 1296 frflrrx.exe 2980 hbnbhh.exe 1468 bbthbt.exe 2348 9dppv.exe 2336 7fxxfll.exe 2124 frflllr.exe 2188 btnhth.exe 2144 jvjjp.exe 1156 jppvp.exe 1948 1rllxrf.exe 2584 nbhhhb.exe 2552 jdvdj.exe 1040 dvddd.exe 1664 lrffllx.exe 328 rlrflll.exe 876 tnhhbb.exe 2240 jdjjp.exe 532 jdppv.exe 1812 rflrlfx.exe 2500 lxxxxxx.exe 568 thhhhh.exe 1592 1thnnn.exe 2252 pjddj.exe 2724 dpdjp.exe 2840 9lfflrx.exe 2888 lxlrlfl.exe 2644 hbbtnh.exe 2656 9bthtb.exe 2720 pjpdj.exe 2692 pdjdd.exe 2788 lxlxlll.exe 2660 rrlxrxr.exe 3020 btbttn.exe 2036 1bnntt.exe 2948 7thtnn.exe 880 jpvjd.exe 1196 vvpdv.exe 1656 lxffffx.exe 1612 7lfrflr.exe 1648 hbnnnt.exe 2348 7pdjp.exe 1792 1pjvd.exe 2080 llxfrxr.exe 1524 xxrlffx.exe 1764 3hhhhn.exe 2540 btntbb.exe 544 jdpjp.exe 1608 jvjvv.exe 1548 dpdvd.exe 1808 xrlfllr.exe -
resource yara_rule behavioral1/memory/1144-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-242-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1988 1144 83011b160c7bfc88d03921004e96b5e0N.exe 30 PID 1144 wrote to memory of 1988 1144 83011b160c7bfc88d03921004e96b5e0N.exe 30 PID 1144 wrote to memory of 1988 1144 83011b160c7bfc88d03921004e96b5e0N.exe 30 PID 1144 wrote to memory of 1988 1144 83011b160c7bfc88d03921004e96b5e0N.exe 30 PID 1988 wrote to memory of 2352 1988 frfffxf.exe 31 PID 1988 wrote to memory of 2352 1988 frfffxf.exe 31 PID 1988 wrote to memory of 2352 1988 frfffxf.exe 31 PID 1988 wrote to memory of 2352 1988 frfffxf.exe 31 PID 2352 wrote to memory of 2460 2352 7lfxfxf.exe 32 PID 2352 wrote to memory of 2460 2352 7lfxfxf.exe 32 PID 2352 wrote to memory of 2460 2352 7lfxfxf.exe 32 PID 2352 wrote to memory of 2460 2352 7lfxfxf.exe 32 PID 2460 wrote to memory of 2804 2460 3nnnnh.exe 33 PID 2460 wrote to memory of 2804 2460 3nnnnh.exe 33 PID 2460 wrote to memory of 2804 2460 3nnnnh.exe 33 PID 2460 wrote to memory of 2804 2460 3nnnnh.exe 33 PID 2804 wrote to memory of 2260 2804 5jvdj.exe 34 PID 2804 wrote to memory of 2260 2804 5jvdj.exe 34 PID 2804 wrote to memory of 2260 2804 5jvdj.exe 34 PID 2804 wrote to memory of 2260 2804 5jvdj.exe 34 PID 2260 wrote to memory of 2884 2260 vpvjd.exe 35 PID 2260 wrote to memory of 2884 2260 vpvjd.exe 35 PID 2260 wrote to memory of 2884 2260 vpvjd.exe 35 PID 2260 wrote to memory of 2884 2260 vpvjd.exe 35 PID 2884 wrote to memory of 2904 2884 xxxlflf.exe 36 PID 2884 wrote to memory of 2904 2884 xxxlflf.exe 36 PID 2884 wrote to memory of 2904 2884 xxxlflf.exe 36 PID 2884 wrote to memory of 2904 2884 xxxlflf.exe 36 PID 2904 wrote to memory of 2720 2904 lflrrrx.exe 37 PID 2904 wrote to memory of 2720 2904 lflrrrx.exe 37 PID 2904 wrote to memory of 2720 2904 lflrrrx.exe 37 PID 2904 wrote to memory of 2720 2904 lflrrrx.exe 37 PID 2720 wrote to memory of 2732 2720 htbbhn.exe 38 PID 2720 wrote to memory of 2732 2720 htbbhn.exe 38 PID 2720 wrote to memory of 2732 2720 htbbhn.exe 38 PID 2720 wrote to memory of 2732 2720 htbbhn.exe 38 PID 2732 wrote to memory of 2636 2732 jvppv.exe 39 PID 2732 wrote to memory of 2636 2732 jvppv.exe 39 PID 2732 wrote to memory of 2636 2732 jvppv.exe 39 PID 2732 wrote to memory of 2636 2732 jvppv.exe 39 PID 2636 wrote to memory of 2328 2636 llrflfl.exe 40 PID 2636 wrote to memory of 2328 2636 llrflfl.exe 40 PID 2636 wrote to memory of 2328 2636 llrflfl.exe 40 PID 2636 wrote to memory of 2328 2636 llrflfl.exe 40 PID 2328 wrote to memory of 316 2328 5fxfrxx.exe 41 PID 2328 wrote to memory of 316 2328 5fxfrxx.exe 41 PID 2328 wrote to memory of 316 2328 5fxfrxx.exe 41 PID 2328 wrote to memory of 316 2328 5fxfrxx.exe 41 PID 316 wrote to memory of 2964 316 ttntnh.exe 42 PID 316 wrote to memory of 2964 316 ttntnh.exe 42 PID 316 wrote to memory of 2964 316 ttntnh.exe 42 PID 316 wrote to memory of 2964 316 ttntnh.exe 42 PID 2964 wrote to memory of 2952 2964 pvpvp.exe 43 PID 2964 wrote to memory of 2952 2964 pvpvp.exe 43 PID 2964 wrote to memory of 2952 2964 pvpvp.exe 43 PID 2964 wrote to memory of 2952 2964 pvpvp.exe 43 PID 2952 wrote to memory of 1296 2952 5rfllrx.exe 44 PID 2952 wrote to memory of 1296 2952 5rfllrx.exe 44 PID 2952 wrote to memory of 1296 2952 5rfllrx.exe 44 PID 2952 wrote to memory of 1296 2952 5rfllrx.exe 44 PID 1296 wrote to memory of 2980 1296 frflrrx.exe 45 PID 1296 wrote to memory of 2980 1296 frflrrx.exe 45 PID 1296 wrote to memory of 2980 1296 frflrrx.exe 45 PID 1296 wrote to memory of 2980 1296 frflrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\83011b160c7bfc88d03921004e96b5e0N.exe"C:\Users\Admin\AppData\Local\Temp\83011b160c7bfc88d03921004e96b5e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\frfffxf.exec:\frfffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\7lfxfxf.exec:\7lfxfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\3nnnnh.exec:\3nnnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\5jvdj.exec:\5jvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vpvjd.exec:\vpvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\xxxlflf.exec:\xxxlflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\lflrrrx.exec:\lflrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\htbbhn.exec:\htbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jvppv.exec:\jvppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\llrflfl.exec:\llrflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5fxfrxx.exec:\5fxfrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\ttntnh.exec:\ttntnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\pvpvp.exec:\pvpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\5rfllrx.exec:\5rfllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\frflrrx.exec:\frflrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\hbnbhh.exec:\hbnbhh.exe17⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bbthbt.exec:\bbthbt.exe18⤵
- Executes dropped EXE
PID:1468 -
\??\c:\9dppv.exec:\9dppv.exe19⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7fxxfll.exec:\7fxxfll.exe20⤵
- Executes dropped EXE
PID:2336 -
\??\c:\frflllr.exec:\frflllr.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\btnhth.exec:\btnhth.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jvjjp.exec:\jvjjp.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jppvp.exec:\jppvp.exe24⤵
- Executes dropped EXE
PID:1156 -
\??\c:\1rllxrf.exec:\1rllxrf.exe25⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nbhhhb.exec:\nbhhhb.exe26⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdvdj.exec:\jdvdj.exe27⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvddd.exec:\dvddd.exe28⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lrffllx.exec:\lrffllx.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rlrflll.exec:\rlrflll.exe30⤵
- Executes dropped EXE
PID:328 -
\??\c:\tnhhbb.exec:\tnhhbb.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\jdjjp.exec:\jdjjp.exe32⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jdppv.exec:\jdppv.exe33⤵
- Executes dropped EXE
PID:532 -
\??\c:\rflrlfx.exec:\rflrlfx.exe34⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe35⤵
- Executes dropped EXE
PID:2500 -
\??\c:\thhhhh.exec:\thhhhh.exe36⤵
- Executes dropped EXE
PID:568 -
\??\c:\1thnnn.exec:\1thnnn.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pjddj.exec:\pjddj.exe38⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dpdjp.exec:\dpdjp.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9lfflrx.exec:\9lfflrx.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lxlrlfl.exec:\lxlrlfl.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hbbtnh.exec:\hbbtnh.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9bthtb.exec:\9bthtb.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjpdj.exec:\pjpdj.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pdjdd.exec:\pdjdd.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxlxlll.exec:\lxlxlll.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrlxrxr.exec:\rrlxrxr.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\btbttn.exec:\btbttn.exe48⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1bnntt.exec:\1bnntt.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7thtnn.exec:\7thtnn.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jpvjd.exec:\jpvjd.exe51⤵
- Executes dropped EXE
PID:880 -
\??\c:\vvpdv.exec:\vvpdv.exe52⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lxffffx.exec:\lxffffx.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7lfrflr.exec:\7lfrflr.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\hbnnnt.exec:\hbnnnt.exe55⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7pdjp.exec:\7pdjp.exe56⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1pjvd.exec:\1pjvd.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llxfrxr.exec:\llxfrxr.exe58⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xxrlffx.exec:\xxrlffx.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3hhhhn.exec:\3hhhhn.exe60⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btntbb.exec:\btntbb.exe61⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jdpjp.exec:\jdpjp.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\jvjvv.exec:\jvjvv.exe63⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dpdvd.exec:\dpdvd.exe64⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xrlfllr.exec:\xrlfllr.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hththt.exec:\hththt.exe66⤵PID:2116
-
\??\c:\hbnbbb.exec:\hbnbbb.exe67⤵PID:1040
-
\??\c:\htbbhn.exec:\htbbhn.exe68⤵PID:1664
-
\??\c:\1jpjp.exec:\1jpjp.exe69⤵PID:1760
-
\??\c:\jpdpv.exec:\jpdpv.exe70⤵PID:1436
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe71⤵PID:340
-
\??\c:\lxrlrlx.exec:\lxrlrlx.exe72⤵PID:2240
-
\??\c:\3btttn.exec:\3btttn.exe73⤵PID:1484
-
\??\c:\tthhnb.exec:\tthhnb.exe74⤵PID:2496
-
\??\c:\ppppd.exec:\ppppd.exe75⤵PID:2460
-
\??\c:\dvppd.exec:\dvppd.exe76⤵PID:2052
-
\??\c:\5lxflfl.exec:\5lxflfl.exe77⤵PID:1688
-
\??\c:\5rffrlf.exec:\5rffrlf.exe78⤵PID:2280
-
\??\c:\5fxlrxf.exec:\5fxlrxf.exe79⤵PID:2528
-
\??\c:\btbntb.exec:\btbntb.exe80⤵PID:2624
-
\??\c:\9nntnt.exec:\9nntnt.exe81⤵PID:2640
-
\??\c:\7vpvj.exec:\7vpvj.exe82⤵PID:2848
-
\??\c:\pjppd.exec:\pjppd.exe83⤵PID:2792
-
\??\c:\dpvpp.exec:\dpvpp.exe84⤵PID:2680
-
\??\c:\1lffxxf.exec:\1lffxxf.exe85⤵PID:704
-
\??\c:\1rxfrrf.exec:\1rxfrrf.exe86⤵PID:2332
-
\??\c:\nhttbb.exec:\nhttbb.exe87⤵PID:1300
-
\??\c:\bnnttb.exec:\bnnttb.exe88⤵PID:2684
-
\??\c:\hbttbh.exec:\hbttbh.exe89⤵PID:2940
-
\??\c:\vjvjv.exec:\vjvjv.exe90⤵PID:3012
-
\??\c:\1jvpj.exec:\1jvpj.exe91⤵PID:1376
-
\??\c:\9frfrxf.exec:\9frfrxf.exe92⤵PID:3024
-
\??\c:\lflfrll.exec:\lflfrll.exe93⤵PID:2360
-
\??\c:\htbhhh.exec:\htbhhh.exe94⤵PID:1468
-
\??\c:\7thhnt.exec:\7thhnt.exe95⤵PID:1768
-
\??\c:\jdppd.exec:\jdppd.exe96⤵PID:2336
-
\??\c:\5vppv.exec:\5vppv.exe97⤵PID:2712
-
\??\c:\jjvdv.exec:\jjvdv.exe98⤵PID:1584
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe99⤵PID:2188
-
\??\c:\5llflrl.exec:\5llflrl.exe100⤵PID:2144
-
\??\c:\tnbhnn.exec:\tnbhnn.exe101⤵PID:1084
-
\??\c:\hbnbnt.exec:\hbnbnt.exe102⤵PID:1948
-
\??\c:\vpdjv.exec:\vpdjv.exe103⤵PID:1540
-
\??\c:\ppjpp.exec:\ppjpp.exe104⤵PID:1260
-
\??\c:\xlffxxf.exec:\xlffxxf.exe105⤵PID:788
-
\??\c:\llxllxr.exec:\llxllxr.exe106⤵PID:2544
-
\??\c:\bbbnbh.exec:\bbbnbh.exe107⤵PID:2392
-
\??\c:\tttbnt.exec:\tttbnt.exe108⤵PID:772
-
\??\c:\pvppp.exec:\pvppp.exe109⤵PID:2168
-
\??\c:\jjpjv.exec:\jjpjv.exe110⤵PID:2304
-
\??\c:\xfrlrlr.exec:\xfrlrlr.exe111⤵PID:2220
-
\??\c:\fflrllx.exec:\fflrllx.exe112⤵PID:588
-
\??\c:\5bbbnt.exec:\5bbbnt.exe113⤵PID:2452
-
\??\c:\9bbhbn.exec:\9bbhbn.exe114⤵PID:1816
-
\??\c:\dvvvv.exec:\dvvvv.exe115⤵PID:1600
-
\??\c:\5jvjp.exec:\5jvjp.exe116⤵PID:1476
-
\??\c:\rrrxxlr.exec:\rrrxxlr.exe117⤵PID:2728
-
\??\c:\3rrfxfl.exec:\3rrfxfl.exe118⤵PID:2744
-
\??\c:\7htnhn.exec:\7htnhn.exe119⤵PID:2828
-
\??\c:\1bbthn.exec:\1bbthn.exe120⤵PID:3040
-
\??\c:\jjdjv.exec:\jjdjv.exe121⤵PID:2652
-
\??\c:\3dpvp.exec:\3dpvp.exe122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-