Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b63e53c280d1763322945a29893bb80N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
7b63e53c280d1763322945a29893bb80N.exe
-
Size
82KB
-
MD5
7b63e53c280d1763322945a29893bb80
-
SHA1
62f5466b0239996e593b8a730470e670703d2825
-
SHA256
de4661141a9a61af2334e3baec54daf76f62b5d4331b4bbc0671dbd4ac609f18
-
SHA512
0a199c3eb6f497f56673d9169594e48476e0d16ab31014196b38eff38e1c800d4314ab25f28937eb3ec910c81c5eaa2b75b2cedb164b2024dcd6fab21ec0c167
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QD:ymb3NkkiQ3mdBjFIIp9L9QrrA8I
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2132-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/672-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/408-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2412 3nhnbb.exe 2376 bhhbtn.exe 2912 xllrxfr.exe 2724 xrrfffr.exe 2888 nhthnn.exe 2700 1vdpd.exe 2488 pddjd.exe 2580 xxxfrxr.exe 1836 bthhtt.exe 672 bbntnt.exe 1464 7ddvp.exe 2924 rfllrfl.exe 2764 lfxfrrx.exe 2040 nbnttt.exe 2800 btnbnn.exe 2968 pjvpv.exe 2016 frxffxf.exe 3020 tnbhth.exe 2088 bnbbhn.exe 1236 nntbbb.exe 860 5dpjv.exe 408 vpddj.exe 2076 frffffr.exe 1108 ffrffxl.exe 1980 nhbbhb.exe 1772 3thbht.exe 2496 7djvv.exe 1036 fxllffx.exe 2104 rlfflrf.exe 1988 7hnttn.exe 2368 nhhnnn.exe 1708 jjdvp.exe 2676 3fxxlfl.exe 1948 5rxflll.exe 2712 ffrxlll.exe 2688 nbhhbh.exe 2868 nhhttt.exe 2744 ddpvv.exe 3028 dvppv.exe 2900 jvppp.exe 2332 9lffrrx.exe 2648 9xlfflx.exe 2652 bhhnnh.exe 1676 htnbbn.exe 2644 pjddj.exe 1464 pvjpj.exe 2832 3xxrffr.exe 2792 xxrxrxl.exe 1896 ttbhtt.exe 656 9htnnh.exe 1508 nbnnnb.exe 1740 dvjdj.exe 2016 jdvdj.exe 3000 frflllr.exe 2068 lffrxxl.exe 1720 bntbbt.exe 1488 nnhtbh.exe 2176 vjvpp.exe 2004 vvvjd.exe 916 rlxxxxf.exe 1544 lfrxfff.exe 2056 tnbthh.exe 2264 bnbbtb.exe 896 vpvvd.exe -
resource yara_rule behavioral1/memory/2132-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/672-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/408-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxlrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2412 2132 7b63e53c280d1763322945a29893bb80N.exe 30 PID 2132 wrote to memory of 2412 2132 7b63e53c280d1763322945a29893bb80N.exe 30 PID 2132 wrote to memory of 2412 2132 7b63e53c280d1763322945a29893bb80N.exe 30 PID 2132 wrote to memory of 2412 2132 7b63e53c280d1763322945a29893bb80N.exe 30 PID 2412 wrote to memory of 2376 2412 3nhnbb.exe 31 PID 2412 wrote to memory of 2376 2412 3nhnbb.exe 31 PID 2412 wrote to memory of 2376 2412 3nhnbb.exe 31 PID 2412 wrote to memory of 2376 2412 3nhnbb.exe 31 PID 2376 wrote to memory of 2912 2376 bhhbtn.exe 32 PID 2376 wrote to memory of 2912 2376 bhhbtn.exe 32 PID 2376 wrote to memory of 2912 2376 bhhbtn.exe 32 PID 2376 wrote to memory of 2912 2376 bhhbtn.exe 32 PID 2912 wrote to memory of 2724 2912 xllrxfr.exe 33 PID 2912 wrote to memory of 2724 2912 xllrxfr.exe 33 PID 2912 wrote to memory of 2724 2912 xllrxfr.exe 33 PID 2912 wrote to memory of 2724 2912 xllrxfr.exe 33 PID 2724 wrote to memory of 2888 2724 xrrfffr.exe 34 PID 2724 wrote to memory of 2888 2724 xrrfffr.exe 34 PID 2724 wrote to memory of 2888 2724 xrrfffr.exe 34 PID 2724 wrote to memory of 2888 2724 xrrfffr.exe 34 PID 2888 wrote to memory of 2700 2888 nhthnn.exe 35 PID 2888 wrote to memory of 2700 2888 nhthnn.exe 35 PID 2888 wrote to memory of 2700 2888 nhthnn.exe 35 PID 2888 wrote to memory of 2700 2888 nhthnn.exe 35 PID 2700 wrote to memory of 2488 2700 1vdpd.exe 36 PID 2700 wrote to memory of 2488 2700 1vdpd.exe 36 PID 2700 wrote to memory of 2488 2700 1vdpd.exe 36 PID 2700 wrote to memory of 2488 2700 1vdpd.exe 36 PID 2488 wrote to memory of 2580 2488 pddjd.exe 37 PID 2488 wrote to memory of 2580 2488 pddjd.exe 37 PID 2488 wrote to memory of 2580 2488 pddjd.exe 37 PID 2488 wrote to memory of 2580 2488 pddjd.exe 37 PID 2580 wrote to memory of 1836 2580 xxxfrxr.exe 38 PID 2580 wrote to memory of 1836 2580 xxxfrxr.exe 38 PID 2580 wrote to memory of 1836 2580 xxxfrxr.exe 38 PID 2580 wrote to memory of 1836 2580 xxxfrxr.exe 38 PID 1836 wrote to memory of 672 1836 bthhtt.exe 39 PID 1836 wrote to memory of 672 1836 bthhtt.exe 39 PID 1836 wrote to memory of 672 1836 bthhtt.exe 39 PID 1836 wrote to memory of 672 1836 bthhtt.exe 39 PID 672 wrote to memory of 1464 672 bbntnt.exe 40 PID 672 wrote to memory of 1464 672 bbntnt.exe 40 PID 672 wrote to memory of 1464 672 bbntnt.exe 40 PID 672 wrote to memory of 1464 672 bbntnt.exe 40 PID 1464 wrote to memory of 2924 1464 7ddvp.exe 41 PID 1464 wrote to memory of 2924 1464 7ddvp.exe 41 PID 1464 wrote to memory of 2924 1464 7ddvp.exe 41 PID 1464 wrote to memory of 2924 1464 7ddvp.exe 41 PID 2924 wrote to memory of 2764 2924 rfllrfl.exe 42 PID 2924 wrote to memory of 2764 2924 rfllrfl.exe 42 PID 2924 wrote to memory of 2764 2924 rfllrfl.exe 42 PID 2924 wrote to memory of 2764 2924 rfllrfl.exe 42 PID 2764 wrote to memory of 2040 2764 lfxfrrx.exe 43 PID 2764 wrote to memory of 2040 2764 lfxfrrx.exe 43 PID 2764 wrote to memory of 2040 2764 lfxfrrx.exe 43 PID 2764 wrote to memory of 2040 2764 lfxfrrx.exe 43 PID 2040 wrote to memory of 2800 2040 nbnttt.exe 44 PID 2040 wrote to memory of 2800 2040 nbnttt.exe 44 PID 2040 wrote to memory of 2800 2040 nbnttt.exe 44 PID 2040 wrote to memory of 2800 2040 nbnttt.exe 44 PID 2800 wrote to memory of 2968 2800 btnbnn.exe 45 PID 2800 wrote to memory of 2968 2800 btnbnn.exe 45 PID 2800 wrote to memory of 2968 2800 btnbnn.exe 45 PID 2800 wrote to memory of 2968 2800 btnbnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b63e53c280d1763322945a29893bb80N.exe"C:\Users\Admin\AppData\Local\Temp\7b63e53c280d1763322945a29893bb80N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\3nhnbb.exec:\3nhnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\bhhbtn.exec:\bhhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\xllrxfr.exec:\xllrxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xrrfffr.exec:\xrrfffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nhthnn.exec:\nhthnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1vdpd.exec:\1vdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pddjd.exec:\pddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bthhtt.exec:\bthhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\bbntnt.exec:\bbntnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\7ddvp.exec:\7ddvp.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\rfllrfl.exec:\rfllrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nbnttt.exec:\nbnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\btnbnn.exec:\btnbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\pjvpv.exec:\pjvpv.exe17⤵
- Executes dropped EXE
PID:2968 -
\??\c:\frxffxf.exec:\frxffxf.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tnbhth.exec:\tnbhth.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\bnbbhn.exec:\bnbbhn.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nntbbb.exec:\nntbbb.exe21⤵
- Executes dropped EXE
PID:1236 -
\??\c:\5dpjv.exec:\5dpjv.exe22⤵
- Executes dropped EXE
PID:860 -
\??\c:\vpddj.exec:\vpddj.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\frffffr.exec:\frffffr.exe24⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ffrffxl.exec:\ffrffxl.exe25⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nhbbhb.exec:\nhbbhb.exe26⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3thbht.exec:\3thbht.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7djvv.exec:\7djvv.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\fxllffx.exec:\fxllffx.exe29⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rlfflrf.exec:\rlfflrf.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7hnttn.exec:\7hnttn.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhhnnn.exec:\nhhnnn.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jjdvp.exec:\jjdvp.exe33⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3fxxlfl.exec:\3fxxlfl.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5rxflll.exec:\5rxflll.exe35⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ffrxlll.exec:\ffrxlll.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nbhhbh.exec:\nbhhbh.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nhhttt.exec:\nhhttt.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ddpvv.exec:\ddpvv.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dvppv.exec:\dvppv.exe40⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jvppp.exec:\jvppp.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9lffrrx.exec:\9lffrrx.exe42⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9xlfflx.exec:\9xlfflx.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bhhnnh.exec:\bhhnnh.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\htnbbn.exec:\htnbbn.exe45⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjddj.exec:\pjddj.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pvjpj.exec:\pvjpj.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\3xxrffr.exec:\3xxrffr.exe48⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe49⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ttbhtt.exec:\ttbhtt.exe50⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9htnnh.exec:\9htnnh.exe51⤵
- Executes dropped EXE
PID:656 -
\??\c:\nbnnnb.exec:\nbnnnb.exe52⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dvjdj.exec:\dvjdj.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jdvdj.exec:\jdvdj.exe54⤵
- Executes dropped EXE
PID:2016 -
\??\c:\frflllr.exec:\frflllr.exe55⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lffrxxl.exec:\lffrxxl.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bntbbt.exec:\bntbbt.exe57⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnhtbh.exec:\nnhtbh.exe58⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vjvpp.exec:\vjvpp.exe59⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vvvjd.exec:\vvvjd.exe60⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe61⤵
- Executes dropped EXE
PID:916 -
\??\c:\lfrxfff.exec:\lfrxfff.exe62⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tnbthh.exec:\tnbthh.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bnbbtb.exec:\bnbbtb.exe64⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vpvvd.exec:\vpvvd.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\vdvjp.exec:\vdvjp.exe66⤵PID:1480
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe67⤵PID:2452
-
\??\c:\5xllrrr.exec:\5xllrrr.exe68⤵PID:2532
-
\??\c:\bbnttt.exec:\bbnttt.exe69⤵PID:1988
-
\??\c:\hthttt.exec:\hthttt.exe70⤵PID:1692
-
\??\c:\7hthnt.exec:\7hthnt.exe71⤵PID:2344
-
\??\c:\7djvv.exec:\7djvv.exe72⤵PID:2516
-
\??\c:\1pddd.exec:\1pddd.exe73⤵PID:2184
-
\??\c:\fxflxfl.exec:\fxflxfl.exe74⤵PID:2844
-
\??\c:\xrflxxr.exec:\xrflxxr.exe75⤵PID:2708
-
\??\c:\5tnttt.exec:\5tnttt.exe76⤵PID:2592
-
\??\c:\tnhhht.exec:\tnhhht.exe77⤵PID:2932
-
\??\c:\nbbbhh.exec:\nbbbhh.exe78⤵PID:2672
-
\??\c:\1jdjp.exec:\1jdjp.exe79⤵PID:2640
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe80⤵PID:2660
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe81⤵PID:2636
-
\??\c:\9bbhhb.exec:\9bbhhb.exe82⤵PID:2084
-
\??\c:\nhtttn.exec:\nhtttn.exe83⤵PID:1188
-
\??\c:\nbhnhn.exec:\nbhnhn.exe84⤵PID:2824
-
\??\c:\vdpjj.exec:\vdpjj.exe85⤵PID:1528
-
\??\c:\pjjjj.exec:\pjjjj.exe86⤵PID:2816
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe87⤵PID:680
-
\??\c:\frxllll.exec:\frxllll.exe88⤵
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\hbnntt.exec:\hbnntt.exe89⤵PID:1636
-
\??\c:\nbnhhb.exec:\nbnhhb.exe90⤵PID:1032
-
\??\c:\bnnnnh.exec:\bnnnnh.exe91⤵PID:1884
-
\??\c:\9jpvd.exec:\9jpvd.exe92⤵PID:3012
-
\??\c:\xlllrrx.exec:\xlllrrx.exe93⤵PID:344
-
\??\c:\rflxxfx.exec:\rflxxfx.exe94⤵PID:2072
-
\??\c:\tnbbhb.exec:\tnbbhb.exe95⤵PID:1908
-
\??\c:\nbbbtn.exec:\nbbbtn.exe96⤵PID:3032
-
\??\c:\bbthth.exec:\bbthth.exe97⤵PID:860
-
\??\c:\9pjjp.exec:\9pjjp.exe98⤵PID:2128
-
\??\c:\pjppp.exec:\pjppp.exe99⤵PID:676
-
\??\c:\rxxxrll.exec:\rxxxrll.exe100⤵PID:1484
-
\??\c:\rlrfrrx.exec:\rlrfrrx.exe101⤵PID:2212
-
\??\c:\bnbtnh.exec:\bnbtnh.exe102⤵PID:2312
-
\??\c:\tnbbtt.exec:\tnbbtt.exe103⤵PID:2384
-
\??\c:\bnnhbb.exec:\bnnhbb.exe104⤵PID:1764
-
\??\c:\jvdjd.exec:\jvdjd.exe105⤵PID:1036
-
\??\c:\1vddj.exec:\1vddj.exe106⤵PID:2148
-
\??\c:\3rfffff.exec:\3rfffff.exe107⤵PID:1900
-
\??\c:\bthnhh.exec:\bthnhh.exe108⤵PID:1588
-
\??\c:\5bhnth.exec:\5bhnth.exe109⤵PID:2404
-
\??\c:\jpvdj.exec:\jpvdj.exe110⤵PID:876
-
\??\c:\ppjjd.exec:\ppjjd.exe111⤵PID:2692
-
\??\c:\vjppv.exec:\vjppv.exe112⤵PID:2912
-
\??\c:\lrrrflr.exec:\lrrrflr.exe113⤵PID:2736
-
\??\c:\1rfxfrr.exec:\1rfxfrr.exe114⤵PID:3056
-
\??\c:\xllllfl.exec:\xllllfl.exe115⤵PID:2620
-
\??\c:\5bnnnn.exec:\5bnnnn.exe116⤵PID:1844
-
\??\c:\9vddj.exec:\9vddj.exe117⤵PID:1916
-
\??\c:\3pvvd.exec:\3pvvd.exe118⤵PID:2616
-
\??\c:\djvpj.exec:\djvpj.exe119⤵PID:2244
-
\??\c:\7lxxxxf.exec:\7lxxxxf.exe120⤵PID:2364
-
\??\c:\lxrlrrr.exec:\lxrlrrr.exe121⤵PID:1084
-
\??\c:\9nhnnh.exec:\9nhnnh.exe122⤵PID:2964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-