Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe
Resource
win7-20240903-en
General
-
Target
a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe
-
Size
75KB
-
MD5
0f284cb2d33de3b5fd265fd6e882f3c8
-
SHA1
4ac82842e54bdda8d3e971d9eb8dcd4c5c9dc21f
-
SHA256
a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd
-
SHA512
91edf24e98e3622c2ac50b272a73cc74a63e0a9d21b0230e7ab08c434124b04f4fa189a8ce5ccbc6e1ecbbc83b9594809e3aeb8bf6ebc8a7f50ef29d992f1a24
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmg:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHb
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2368-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/640-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 nhbnhn.exe 2996 vpddp.exe 2480 lrxrrrr.exe 2032 hbttbh.exe 2796 dpdjj.exe 2696 1vpjp.exe 2852 nhbhht.exe 1592 thhttn.exe 2592 djjvv.exe 3032 jvjvd.exe 2044 flxrrxr.exe 868 nbnnnn.exe 1564 vjddj.exe 756 9vjpv.exe 1992 fxrlxfr.exe 1372 xlrlxrr.exe 2928 hhbhnn.exe 2924 dpdvd.exe 2216 vpjjv.exe 1872 7xlllff.exe 328 lfrrxrf.exe 1824 bnbhth.exe 640 dpjpv.exe 960 pjjdj.exe 1124 rxllllr.exe 2312 fxxxrxl.exe 1660 nnnhnn.exe 2184 pdvdj.exe 2464 pvdjj.exe 2308 lxllxfl.exe 2332 nbnntt.exe 2104 7bthtb.exe 1724 jvjjp.exe 2760 9xlrrrr.exe 2152 frxlllr.exe 2788 bnbhbh.exe 2800 bnntbt.exe 2716 dpvdj.exe 2840 rflfxxl.exe 2600 5llflfl.exe 2740 bhhthb.exe 2620 ddvpd.exe 3060 djjvj.exe 3040 xlrxxfr.exe 2816 lrxffrx.exe 1732 htbhtn.exe 1208 btttbb.exe 2872 vjjdv.exe 2080 pjpvv.exe 2160 3xfflfl.exe 2892 xrflflx.exe 1912 bbttnb.exe 2804 hbnthn.exe 2200 nbhnbh.exe 2396 5vdvj.exe 1860 dvjvd.exe 1088 lxfflll.exe 2616 tnbbhh.exe 776 tnhhnn.exe 1704 7pddd.exe 960 pvdpj.exe 1124 xrllffl.exe 1672 7rrlfxx.exe 2168 hbbhnn.exe -
resource yara_rule behavioral1/memory/2368-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-278-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2072 2368 a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe 30 PID 2368 wrote to memory of 2072 2368 a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe 30 PID 2368 wrote to memory of 2072 2368 a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe 30 PID 2368 wrote to memory of 2072 2368 a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe 30 PID 2072 wrote to memory of 2996 2072 nhbnhn.exe 31 PID 2072 wrote to memory of 2996 2072 nhbnhn.exe 31 PID 2072 wrote to memory of 2996 2072 nhbnhn.exe 31 PID 2072 wrote to memory of 2996 2072 nhbnhn.exe 31 PID 2996 wrote to memory of 2480 2996 vpddp.exe 32 PID 2996 wrote to memory of 2480 2996 vpddp.exe 32 PID 2996 wrote to memory of 2480 2996 vpddp.exe 32 PID 2996 wrote to memory of 2480 2996 vpddp.exe 32 PID 2480 wrote to memory of 2032 2480 lrxrrrr.exe 33 PID 2480 wrote to memory of 2032 2480 lrxrrrr.exe 33 PID 2480 wrote to memory of 2032 2480 lrxrrrr.exe 33 PID 2480 wrote to memory of 2032 2480 lrxrrrr.exe 33 PID 2032 wrote to memory of 2796 2032 hbttbh.exe 34 PID 2032 wrote to memory of 2796 2032 hbttbh.exe 34 PID 2032 wrote to memory of 2796 2032 hbttbh.exe 34 PID 2032 wrote to memory of 2796 2032 hbttbh.exe 34 PID 2796 wrote to memory of 2696 2796 dpdjj.exe 35 PID 2796 wrote to memory of 2696 2796 dpdjj.exe 35 PID 2796 wrote to memory of 2696 2796 dpdjj.exe 35 PID 2796 wrote to memory of 2696 2796 dpdjj.exe 35 PID 2696 wrote to memory of 2852 2696 1vpjp.exe 36 PID 2696 wrote to memory of 2852 2696 1vpjp.exe 36 PID 2696 wrote to memory of 2852 2696 1vpjp.exe 36 PID 2696 wrote to memory of 2852 2696 1vpjp.exe 36 PID 2852 wrote to memory of 1592 2852 nhbhht.exe 37 PID 2852 wrote to memory of 1592 2852 nhbhht.exe 37 PID 2852 wrote to memory of 1592 2852 nhbhht.exe 37 PID 2852 wrote to memory of 1592 2852 nhbhht.exe 37 PID 1592 wrote to memory of 2592 1592 thhttn.exe 38 PID 1592 wrote to memory of 2592 1592 thhttn.exe 38 PID 1592 wrote to memory of 2592 1592 thhttn.exe 38 PID 1592 wrote to memory of 2592 1592 thhttn.exe 38 PID 2592 wrote to memory of 3032 2592 djjvv.exe 39 PID 2592 wrote to memory of 3032 2592 djjvv.exe 39 PID 2592 wrote to memory of 3032 2592 djjvv.exe 39 PID 2592 wrote to memory of 3032 2592 djjvv.exe 39 PID 3032 wrote to memory of 2044 3032 jvjvd.exe 40 PID 3032 wrote to memory of 2044 3032 jvjvd.exe 40 PID 3032 wrote to memory of 2044 3032 jvjvd.exe 40 PID 3032 wrote to memory of 2044 3032 jvjvd.exe 40 PID 2044 wrote to memory of 868 2044 flxrrxr.exe 41 PID 2044 wrote to memory of 868 2044 flxrrxr.exe 41 PID 2044 wrote to memory of 868 2044 flxrrxr.exe 41 PID 2044 wrote to memory of 868 2044 flxrrxr.exe 41 PID 868 wrote to memory of 1564 868 nbnnnn.exe 42 PID 868 wrote to memory of 1564 868 nbnnnn.exe 42 PID 868 wrote to memory of 1564 868 nbnnnn.exe 42 PID 868 wrote to memory of 1564 868 nbnnnn.exe 42 PID 1564 wrote to memory of 756 1564 vjddj.exe 43 PID 1564 wrote to memory of 756 1564 vjddj.exe 43 PID 1564 wrote to memory of 756 1564 vjddj.exe 43 PID 1564 wrote to memory of 756 1564 vjddj.exe 43 PID 756 wrote to memory of 1992 756 9vjpv.exe 44 PID 756 wrote to memory of 1992 756 9vjpv.exe 44 PID 756 wrote to memory of 1992 756 9vjpv.exe 44 PID 756 wrote to memory of 1992 756 9vjpv.exe 44 PID 1992 wrote to memory of 1372 1992 fxrlxfr.exe 45 PID 1992 wrote to memory of 1372 1992 fxrlxfr.exe 45 PID 1992 wrote to memory of 1372 1992 fxrlxfr.exe 45 PID 1992 wrote to memory of 1372 1992 fxrlxfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe"C:\Users\Admin\AppData\Local\Temp\a9594dc8d05f4a8b27c5f1d5794087f133e644a1ae04cd2d03b584836ccdb7cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nhbnhn.exec:\nhbnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpddp.exec:\vpddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\hbttbh.exec:\hbttbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\dpdjj.exec:\dpdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1vpjp.exec:\1vpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nhbhht.exec:\nhbhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\thhttn.exec:\thhttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\djjvv.exec:\djjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jvjvd.exec:\jvjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\flxrrxr.exec:\flxrrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\nbnnnn.exec:\nbnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\vjddj.exec:\vjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\9vjpv.exec:\9vjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\fxrlxfr.exec:\fxrlxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\xlrlxrr.exec:\xlrlxrr.exe17⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hhbhnn.exec:\hhbhnn.exe18⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpdvd.exec:\dpdvd.exe19⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vpjjv.exec:\vpjjv.exe20⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7xlllff.exec:\7xlllff.exe21⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe22⤵
- Executes dropped EXE
PID:328 -
\??\c:\bnbhth.exec:\bnbhth.exe23⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dpjpv.exec:\dpjpv.exe24⤵
- Executes dropped EXE
PID:640 -
\??\c:\pjjdj.exec:\pjjdj.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\rxllllr.exec:\rxllllr.exe26⤵
- Executes dropped EXE
PID:1124 -
\??\c:\fxxxrxl.exec:\fxxxrxl.exe27⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nnnhnn.exec:\nnnhnn.exe28⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdvdj.exec:\pdvdj.exe29⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pvdjj.exec:\pvdjj.exe30⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxllxfl.exec:\lxllxfl.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nbnntt.exec:\nbnntt.exe32⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7bthtb.exec:\7bthtb.exe33⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jvjjp.exec:\jvjjp.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9xlrrrr.exec:\9xlrrrr.exe35⤵
- Executes dropped EXE
PID:2760 -
\??\c:\frxlllr.exec:\frxlllr.exe36⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bnbhbh.exec:\bnbhbh.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bnntbt.exec:\bnntbt.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dpvdj.exec:\dpvdj.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rflfxxl.exec:\rflfxxl.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5llflfl.exec:\5llflfl.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bhhthb.exec:\bhhthb.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ddvpd.exec:\ddvpd.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\djjvj.exec:\djjvj.exe44⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xlrxxfr.exec:\xlrxxfr.exe45⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lrxffrx.exec:\lrxffrx.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\htbhtn.exec:\htbhtn.exe47⤵
- Executes dropped EXE
PID:1732 -
\??\c:\btttbb.exec:\btttbb.exe48⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vjjdv.exec:\vjjdv.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjpvv.exec:\pjpvv.exe50⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3xfflfl.exec:\3xfflfl.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xrflflx.exec:\xrflflx.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bbttnb.exec:\bbttnb.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hbnthn.exec:\hbnthn.exe54⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nbhnbh.exec:\nbhnbh.exe55⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5vdvj.exec:\5vdvj.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dvjvd.exec:\dvjvd.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860 -
\??\c:\lxfflll.exec:\lxfflll.exe58⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tnbbhh.exec:\tnbbhh.exe59⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnhhnn.exec:\tnhhnn.exe60⤵
- Executes dropped EXE
PID:776 -
\??\c:\7pddd.exec:\7pddd.exe61⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pvdpj.exec:\pvdpj.exe62⤵
- Executes dropped EXE
PID:960 -
\??\c:\xrllffl.exec:\xrllffl.exe63⤵
- Executes dropped EXE
PID:1124 -
\??\c:\7rrlfxx.exec:\7rrlfxx.exe64⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hbbhnn.exec:\hbbhnn.exe65⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nhhhnh.exec:\nhhhnh.exe66⤵PID:1508
-
\??\c:\pjvvj.exec:\pjvvj.exe67⤵PID:592
-
\??\c:\5jjdj.exec:\5jjdj.exe68⤵PID:2164
-
\??\c:\5lllrlx.exec:\5lllrlx.exe69⤵PID:2328
-
\??\c:\7nnthh.exec:\7nnthh.exe70⤵PID:2504
-
\??\c:\3thhnh.exec:\3thhnh.exe71⤵PID:1580
-
\??\c:\9tnnhb.exec:\9tnnhb.exe72⤵PID:2276
-
\??\c:\pjpjj.exec:\pjpjj.exe73⤵PID:1788
-
\??\c:\xrffrxf.exec:\xrffrxf.exe74⤵PID:3052
-
\??\c:\lrlfllf.exec:\lrlfllf.exe75⤵PID:2152
-
\??\c:\7bhhbb.exec:\7bhhbb.exe76⤵PID:2832
-
\??\c:\hbhhhb.exec:\hbhhhb.exe77⤵PID:2796
-
\??\c:\dpdpv.exec:\dpdpv.exe78⤵PID:2764
-
\??\c:\1vjjj.exec:\1vjjj.exe79⤵PID:2840
-
\??\c:\lxxllrr.exec:\lxxllrr.exe80⤵PID:2744
-
\??\c:\lxlxfll.exec:\lxlxfll.exe81⤵PID:2740
-
\??\c:\thtthb.exec:\thtthb.exe82⤵PID:3024
-
\??\c:\9thnnn.exec:\9thnnn.exe83⤵PID:3060
-
\??\c:\3ppvj.exec:\3ppvj.exe84⤵PID:2896
-
\??\c:\ddppv.exec:\ddppv.exe85⤵PID:2816
-
\??\c:\frxrxrx.exec:\frxrxrx.exe86⤵PID:1976
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe87⤵PID:376
-
\??\c:\tnhnbt.exec:\tnhnbt.exe88⤵PID:2872
-
\??\c:\vpjvd.exec:\vpjvd.exe89⤵PID:1944
-
\??\c:\ppdvd.exec:\ppdvd.exe90⤵PID:1220
-
\??\c:\7lrlfff.exec:\7lrlfff.exe91⤵PID:2892
-
\??\c:\lfffllr.exec:\lfffllr.exe92⤵PID:1372
-
\??\c:\9httbt.exec:\9httbt.exe93⤵PID:2804
-
\??\c:\5ttbnt.exec:\5ttbnt.exe94⤵PID:2252
-
\??\c:\vdjvp.exec:\vdjvp.exe95⤵PID:2264
-
\??\c:\5xlflrx.exec:\5xlflrx.exe96⤵PID:1860
-
\??\c:\llflxrx.exec:\llflxrx.exe97⤵PID:844
-
\??\c:\1nhbhn.exec:\1nhbhn.exe98⤵PID:680
-
\??\c:\djvdd.exec:\djvdd.exe99⤵PID:352
-
\??\c:\pjjjp.exec:\pjjjp.exe100⤵PID:2460
-
\??\c:\lfrllrx.exec:\lfrllrx.exe101⤵PID:2412
-
\??\c:\7flrxff.exec:\7flrxff.exe102⤵PID:1520
-
\??\c:\ttbbhn.exec:\ttbbhn.exe103⤵PID:1488
-
\??\c:\thnbtt.exec:\thnbtt.exe104⤵PID:2168
-
\??\c:\nhntbb.exec:\nhntbb.exe105⤵PID:1624
-
\??\c:\ppdjp.exec:\ppdjp.exe106⤵PID:1524
-
\??\c:\5fxfrxf.exec:\5fxfrxf.exe107⤵PID:2120
-
\??\c:\fxlxllr.exec:\fxlxllr.exe108⤵PID:2520
-
\??\c:\tththb.exec:\tththb.exe109⤵PID:1984
-
\??\c:\7ttntn.exec:\7ttntn.exe110⤵PID:2148
-
\??\c:\dddpp.exec:\dddpp.exe111⤵PID:2104
-
\??\c:\9djpp.exec:\9djpp.exe112⤵PID:1788
-
\??\c:\xfxxfrx.exec:\xfxxfrx.exe113⤵PID:2760
-
\??\c:\rlxffxl.exec:\rlxffxl.exe114⤵PID:2144
-
\??\c:\9hhthn.exec:\9hhthn.exe115⤵PID:2788
-
\??\c:\5thbhn.exec:\5thbhn.exe116⤵PID:2916
-
\??\c:\vvpvv.exec:\vvpvv.exe117⤵PID:2132
-
\??\c:\jddjp.exec:\jddjp.exe118⤵PID:2840
-
\??\c:\fxrrffl.exec:\fxrrffl.exe119⤵PID:2600
-
\??\c:\3rffxxf.exec:\3rffxxf.exe120⤵PID:2740
-
\??\c:\7thhth.exec:\7thhth.exe121⤵PID:2608
-
\??\c:\hhthnt.exec:\hhthnt.exe122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-