Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe
Resource
win7-20240708-en
General
-
Target
060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe
-
Size
64KB
-
MD5
b4988fec4542896684d24990aef04412
-
SHA1
e98f6dcd7121bbf51cbdea53418d1acd647a1ae7
-
SHA256
060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60
-
SHA512
6eaeb84effff8c600c8751bd45843e635f330380ded234ae149a3e5ff19eceb6b239125de2eaf5a61e4be374539fb1a2fdfb74a1c510b98d203392bdffce6ebd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27mS:ymb3NkkiQ3mdBjFI9W
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2492-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2464 5xllrrf.exe 2388 5nhnbb.exe 1920 dvpvj.exe 2844 rlflxfr.exe 2424 5lxxffr.exe 2852 bttbnt.exe 2672 vvjpv.exe 2624 vvdjj.exe 2148 xxlrxlr.exe 2884 ttnbnn.exe 2516 btnthn.exe 2896 jdjjv.exe 1136 pjvvv.exe 2944 lllxrxl.exe 2064 bnnhbt.exe 1884 vjjjj.exe 2448 5rrllrx.exe 352 tbhhnb.exe 2988 tththb.exe 1104 jjjpj.exe 308 3xrlrrx.exe 2292 7fxlxxr.exe 1624 tbbhtn.exe 1660 pjvdp.exe 1972 vpddv.exe 2476 3frrrrr.exe 2112 9hnttt.exe 3036 btntnn.exe 1744 vvppd.exe 2116 5rxlxff.exe 1080 3fxfrxr.exe 2484 bnhhtn.exe 1704 dvpvj.exe 2784 jdvdd.exe 2780 lfrfllr.exe 2764 tntbbh.exe 2776 nnbhth.exe 2596 tnttnn.exe 2756 5pddp.exe 2752 jvjvp.exe 2680 lfxxflr.exe 2820 xfffffr.exe 832 thttnn.exe 2924 hbhntt.exe 2884 jvvjp.exe 2912 7ffrlll.exe 340 hnnttn.exe 2768 tbnttb.exe 1052 pjjpv.exe 1880 ppjvd.exe 1408 ffrrrrx.exe 2420 xxflxxx.exe 1632 9hhhhb.exe 2540 tnbbhb.exe 580 9dpjp.exe 1552 9dddj.exe 1232 fxlrfff.exe 2416 lfxlxfr.exe 440 tbbnhn.exe 1948 7ppvv.exe 1328 pvvjj.exe 944 rfrxffl.exe 1092 lffrflx.exe 568 htttbb.exe -
resource yara_rule behavioral1/memory/2492-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2464 2492 060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe 30 PID 2492 wrote to memory of 2464 2492 060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe 30 PID 2492 wrote to memory of 2464 2492 060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe 30 PID 2492 wrote to memory of 2464 2492 060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe 30 PID 2464 wrote to memory of 2388 2464 5xllrrf.exe 31 PID 2464 wrote to memory of 2388 2464 5xllrrf.exe 31 PID 2464 wrote to memory of 2388 2464 5xllrrf.exe 31 PID 2464 wrote to memory of 2388 2464 5xllrrf.exe 31 PID 2388 wrote to memory of 1920 2388 5nhnbb.exe 32 PID 2388 wrote to memory of 1920 2388 5nhnbb.exe 32 PID 2388 wrote to memory of 1920 2388 5nhnbb.exe 32 PID 2388 wrote to memory of 1920 2388 5nhnbb.exe 32 PID 1920 wrote to memory of 2844 1920 dvpvj.exe 33 PID 1920 wrote to memory of 2844 1920 dvpvj.exe 33 PID 1920 wrote to memory of 2844 1920 dvpvj.exe 33 PID 1920 wrote to memory of 2844 1920 dvpvj.exe 33 PID 2844 wrote to memory of 2424 2844 rlflxfr.exe 34 PID 2844 wrote to memory of 2424 2844 rlflxfr.exe 34 PID 2844 wrote to memory of 2424 2844 rlflxfr.exe 34 PID 2844 wrote to memory of 2424 2844 rlflxfr.exe 34 PID 2424 wrote to memory of 2852 2424 5lxxffr.exe 35 PID 2424 wrote to memory of 2852 2424 5lxxffr.exe 35 PID 2424 wrote to memory of 2852 2424 5lxxffr.exe 35 PID 2424 wrote to memory of 2852 2424 5lxxffr.exe 35 PID 2852 wrote to memory of 2672 2852 bttbnt.exe 36 PID 2852 wrote to memory of 2672 2852 bttbnt.exe 36 PID 2852 wrote to memory of 2672 2852 bttbnt.exe 36 PID 2852 wrote to memory of 2672 2852 bttbnt.exe 36 PID 2672 wrote to memory of 2624 2672 vvjpv.exe 37 PID 2672 wrote to memory of 2624 2672 vvjpv.exe 37 PID 2672 wrote to memory of 2624 2672 vvjpv.exe 37 PID 2672 wrote to memory of 2624 2672 vvjpv.exe 37 PID 2624 wrote to memory of 2148 2624 vvdjj.exe 38 PID 2624 wrote to memory of 2148 2624 vvdjj.exe 38 PID 2624 wrote to memory of 2148 2624 vvdjj.exe 38 PID 2624 wrote to memory of 2148 2624 vvdjj.exe 38 PID 2148 wrote to memory of 2884 2148 xxlrxlr.exe 39 PID 2148 wrote to memory of 2884 2148 xxlrxlr.exe 39 PID 2148 wrote to memory of 2884 2148 xxlrxlr.exe 39 PID 2148 wrote to memory of 2884 2148 xxlrxlr.exe 39 PID 2884 wrote to memory of 2516 2884 ttnbnn.exe 40 PID 2884 wrote to memory of 2516 2884 ttnbnn.exe 40 PID 2884 wrote to memory of 2516 2884 ttnbnn.exe 40 PID 2884 wrote to memory of 2516 2884 ttnbnn.exe 40 PID 2516 wrote to memory of 2896 2516 btnthn.exe 41 PID 2516 wrote to memory of 2896 2516 btnthn.exe 41 PID 2516 wrote to memory of 2896 2516 btnthn.exe 41 PID 2516 wrote to memory of 2896 2516 btnthn.exe 41 PID 2896 wrote to memory of 1136 2896 jdjjv.exe 42 PID 2896 wrote to memory of 1136 2896 jdjjv.exe 42 PID 2896 wrote to memory of 1136 2896 jdjjv.exe 42 PID 2896 wrote to memory of 1136 2896 jdjjv.exe 42 PID 1136 wrote to memory of 2944 1136 pjvvv.exe 43 PID 1136 wrote to memory of 2944 1136 pjvvv.exe 43 PID 1136 wrote to memory of 2944 1136 pjvvv.exe 43 PID 1136 wrote to memory of 2944 1136 pjvvv.exe 43 PID 2944 wrote to memory of 2064 2944 lllxrxl.exe 44 PID 2944 wrote to memory of 2064 2944 lllxrxl.exe 44 PID 2944 wrote to memory of 2064 2944 lllxrxl.exe 44 PID 2944 wrote to memory of 2064 2944 lllxrxl.exe 44 PID 2064 wrote to memory of 1884 2064 bnnhbt.exe 45 PID 2064 wrote to memory of 1884 2064 bnnhbt.exe 45 PID 2064 wrote to memory of 1884 2064 bnnhbt.exe 45 PID 2064 wrote to memory of 1884 2064 bnnhbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe"C:\Users\Admin\AppData\Local\Temp\060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\5xllrrf.exec:\5xllrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\5nhnbb.exec:\5nhnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvpvj.exec:\dvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rlflxfr.exec:\rlflxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5lxxffr.exec:\5lxxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\bttbnt.exec:\bttbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vvjpv.exec:\vvjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vvdjj.exec:\vvdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xxlrxlr.exec:\xxlrxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ttnbnn.exec:\ttnbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\btnthn.exec:\btnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\jdjjv.exec:\jdjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pjvvv.exec:\pjvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\lllxrxl.exec:\lllxrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bnnhbt.exec:\bnnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vjjjj.exec:\vjjjj.exe17⤵
- Executes dropped EXE
PID:1884 -
\??\c:\5rrllrx.exec:\5rrllrx.exe18⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tbhhnb.exec:\tbhhnb.exe19⤵
- Executes dropped EXE
PID:352 -
\??\c:\tththb.exec:\tththb.exe20⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jjjpj.exec:\jjjpj.exe21⤵
- Executes dropped EXE
PID:1104 -
\??\c:\3xrlrrx.exec:\3xrlrrx.exe22⤵
- Executes dropped EXE
PID:308 -
\??\c:\7fxlxxr.exec:\7fxlxxr.exe23⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tbbhtn.exec:\tbbhtn.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjvdp.exec:\pjvdp.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vpddv.exec:\vpddv.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3frrrrr.exec:\3frrrrr.exe27⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9hnttt.exec:\9hnttt.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\btntnn.exec:\btntnn.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vvppd.exec:\vvppd.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5rxlxff.exec:\5rxlxff.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3fxfrxr.exec:\3fxfrxr.exe32⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bnhhtn.exec:\bnhhtn.exe33⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dvpvj.exec:\dvpvj.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jdvdd.exec:\jdvdd.exe35⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lfrfllr.exec:\lfrfllr.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tntbbh.exec:\tntbbh.exe37⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nnbhth.exec:\nnbhth.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tnttnn.exec:\tnttnn.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5pddp.exec:\5pddp.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jvjvp.exec:\jvjvp.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lfxxflr.exec:\lfxxflr.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xfffffr.exec:\xfffffr.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\thttnn.exec:\thttnn.exe44⤵
- Executes dropped EXE
PID:832 -
\??\c:\hbhntt.exec:\hbhntt.exe45⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvvjp.exec:\jvvjp.exe46⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7ffrlll.exec:\7ffrlll.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hnnttn.exec:\hnnttn.exe48⤵
- Executes dropped EXE
PID:340 -
\??\c:\tbnttb.exec:\tbnttb.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pjjpv.exec:\pjjpv.exe50⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ppjvd.exec:\ppjvd.exe51⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe52⤵
- Executes dropped EXE
PID:1408 -
\??\c:\xxflxxx.exec:\xxflxxx.exe53⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9hhhhb.exec:\9hhhhb.exe54⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tnbbhb.exec:\tnbbhb.exe55⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9dpjp.exec:\9dpjp.exe56⤵
- Executes dropped EXE
PID:580 -
\??\c:\9dddj.exec:\9dddj.exe57⤵
- Executes dropped EXE
PID:1552 -
\??\c:\fxlrfff.exec:\fxlrfff.exe58⤵
- Executes dropped EXE
PID:1232 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2416 -
\??\c:\tbbnhn.exec:\tbbnhn.exe60⤵
- Executes dropped EXE
PID:440 -
\??\c:\7ppvv.exec:\7ppvv.exe61⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pvvjj.exec:\pvvjj.exe62⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rfrxffl.exec:\rfrxffl.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\lffrflx.exec:\lffrflx.exe64⤵
- Executes dropped EXE
PID:1092 -
\??\c:\htttbb.exec:\htttbb.exe65⤵
- Executes dropped EXE
PID:568 -
\??\c:\tnbbhb.exec:\tnbbhb.exe66⤵PID:2308
-
\??\c:\1vvdj.exec:\1vvdj.exe67⤵PID:884
-
\??\c:\dddjd.exec:\dddjd.exe68⤵PID:2120
-
\??\c:\rfllxrx.exec:\rfllxrx.exe69⤵
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\rxxllff.exec:\rxxllff.exe70⤵PID:2004
-
\??\c:\9hnntn.exec:\9hnntn.exe71⤵PID:1600
-
\??\c:\bnnbhb.exec:\bnnbhb.exe72⤵PID:2104
-
\??\c:\1djpp.exec:\1djpp.exe73⤵PID:1668
-
\??\c:\lxlfrfl.exec:\lxlfrfl.exe74⤵PID:2668
-
\??\c:\5rlrflr.exec:\5rlrflr.exe75⤵PID:2704
-
\??\c:\3hnbhn.exec:\3hnbhn.exe76⤵PID:2788
-
\??\c:\nbbhnt.exec:\nbbhnt.exe77⤵PID:2772
-
\??\c:\hbthnn.exec:\hbthnn.exe78⤵PID:2776
-
\??\c:\jdvvd.exec:\jdvvd.exe79⤵PID:2892
-
\??\c:\9frrxrx.exec:\9frrxrx.exe80⤵PID:2756
-
\??\c:\fxxxllx.exec:\fxxxllx.exe81⤵PID:2852
-
\??\c:\hntbhh.exec:\hntbhh.exe82⤵PID:2680
-
\??\c:\bntbnn.exec:\bntbnn.exe83⤵PID:2396
-
\??\c:\3jvdd.exec:\3jvdd.exe84⤵PID:804
-
\??\c:\9ppvp.exec:\9ppvp.exe85⤵PID:2860
-
\??\c:\xfxlrll.exec:\xfxlrll.exe86⤵
- System Location Discovery: System Language Discovery
PID:2884 -
\??\c:\9frrrrf.exec:\9frrrrf.exe87⤵PID:2516
-
\??\c:\nbnbnh.exec:\nbnbnh.exe88⤵PID:340
-
\??\c:\nbhhtt.exec:\nbhhtt.exe89⤵PID:2316
-
\??\c:\jjppv.exec:\jjppv.exe90⤵PID:1896
-
\??\c:\dpvjp.exec:\dpvjp.exe91⤵PID:1864
-
\??\c:\1lrfxrr.exec:\1lrfxrr.exe92⤵PID:1956
-
\??\c:\lxlxflr.exec:\lxlxflr.exe93⤵PID:624
-
\??\c:\rfrfrrf.exec:\rfrfrrf.exe94⤵PID:1632
-
\??\c:\tnbhnt.exec:\tnbhnt.exe95⤵PID:2544
-
\??\c:\tnbbnh.exec:\tnbbnh.exe96⤵PID:2504
-
\??\c:\dpjjv.exec:\dpjjv.exe97⤵PID:2996
-
\??\c:\pvvpv.exec:\pvvpv.exe98⤵PID:2304
-
\??\c:\5xllrrf.exec:\5xllrrf.exe99⤵PID:296
-
\??\c:\frxxxrx.exec:\frxxxrx.exe100⤵PID:440
-
\??\c:\nbbhnn.exec:\nbbhnn.exe101⤵PID:1536
-
\??\c:\bbbbtt.exec:\bbbbtt.exe102⤵PID:1328
-
\??\c:\pjjjp.exec:\pjjjp.exe103⤵PID:944
-
\??\c:\vpvjj.exec:\vpvjj.exe104⤵PID:1092
-
\??\c:\fxllrxl.exec:\fxllrxl.exe105⤵PID:2160
-
\??\c:\lrxllxx.exec:\lrxllxx.exe106⤵PID:800
-
\??\c:\tnhhhh.exec:\tnhhhh.exe107⤵PID:1504
-
\??\c:\nbthbh.exec:\nbthbh.exe108⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\pjvvd.exec:\pjvvd.exe109⤵PID:2432
-
\??\c:\vjvvd.exec:\vjvvd.exe110⤵PID:1592
-
\??\c:\3xxrxxl.exec:\3xxrxxl.exe111⤵PID:2468
-
\??\c:\rfffllr.exec:\rfffllr.exe112⤵PID:2104
-
\??\c:\btnnnb.exec:\btnnnb.exe113⤵PID:2484
-
\??\c:\tnbhht.exec:\tnbhht.exe114⤵PID:2668
-
\??\c:\5jppv.exec:\5jppv.exe115⤵PID:2784
-
\??\c:\pdpjv.exec:\pdpjv.exe116⤵PID:2780
-
\??\c:\ddjjj.exec:\ddjjj.exe117⤵PID:2764
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe118⤵PID:2908
-
\??\c:\lflfrxl.exec:\lflfrxl.exe119⤵PID:2596
-
\??\c:\7bbhth.exec:\7bbhth.exe120⤵PID:2756
-
\??\c:\tnthbh.exec:\tnthbh.exe121⤵PID:2752
-
\??\c:\vdpjj.exec:\vdpjj.exe122⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-