Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 06:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a599ee1085ee575689428222304fc280N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
a599ee1085ee575689428222304fc280N.exe
-
Size
230KB
-
MD5
a599ee1085ee575689428222304fc280
-
SHA1
a01d4a057661c1181dfdc120456069151ef20770
-
SHA256
a1c38a68b5bccf29121f4f585c719ffc70d0e1d111a0b0e15184df1a8523c209
-
SHA512
aebed0e624de3ff226cf3cfc196ee7a6e03ee9c5806e9537b469ee71ba4ceb3b774ef726b64ace6cb042585398c416fae69fbdf1d80f04d325b639ebd681a859
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1fu:n3C9BRo7MlrWKo+lxKk1fu
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2204-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 hbntnn.exe 264 dpjdj.exe 2976 fxxfxfx.exe 3000 htbbhh.exe 2752 3jvvj.exe 3024 ntntnh.exe 2720 pdvvj.exe 2776 fxlxfrl.exe 2076 nbnnbb.exe 872 pdddd.exe 2480 frflrrx.exe 1020 xlfllrf.exe 1680 bntbhb.exe 1968 pdjjd.exe 1720 rlrlxrl.exe 1696 hbnbnn.exe 1936 1pvpv.exe 2280 9xrrfxf.exe 1844 1tbbtn.exe 1412 3vpdp.exe 2524 3djvd.exe 2260 llfrxlx.exe 1624 btttbb.exe 1708 3vpjv.exe 1660 rrlxllr.exe 2056 bntbhn.exe 2856 dpdvd.exe 856 rlrrrrx.exe 2412 xlrflfl.exe 2908 jdpjd.exe 1656 1dpvd.exe 1760 3rfllll.exe 2492 bthhth.exe 2736 tnnnbb.exe 2636 dpjjd.exe 2756 1frlxfl.exe 2700 tnbhtb.exe 2752 tnbbhb.exe 2788 7jpjv.exe 2796 7djjp.exe 2764 xflrxlf.exe 2608 3tntnt.exe 756 1tttht.exe 2316 1pvdj.exe 872 vjpvp.exe 2464 lfrfrfr.exe 712 xffxlxl.exe 2444 btnhtn.exe 2276 thnthb.exe 1968 jdjjj.exe 1884 lrlrffr.exe 1128 llxxrrf.exe 1028 tththt.exe 2532 nhttbh.exe 1508 dvddv.exe 1972 9pjpd.exe 2884 fxrxrfr.exe 1180 tbttnt.exe 1176 bnbhnn.exe 980 ddpvp.exe 1624 vpvjv.exe 2340 9llrxxf.exe 1428 5lfrxlf.exe 2224 hbhnbb.exe -
resource yara_rule behavioral1/memory/2204-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2916 2204 a599ee1085ee575689428222304fc280N.exe 30 PID 2204 wrote to memory of 2916 2204 a599ee1085ee575689428222304fc280N.exe 30 PID 2204 wrote to memory of 2916 2204 a599ee1085ee575689428222304fc280N.exe 30 PID 2204 wrote to memory of 2916 2204 a599ee1085ee575689428222304fc280N.exe 30 PID 2916 wrote to memory of 264 2916 hbntnn.exe 31 PID 2916 wrote to memory of 264 2916 hbntnn.exe 31 PID 2916 wrote to memory of 264 2916 hbntnn.exe 31 PID 2916 wrote to memory of 264 2916 hbntnn.exe 31 PID 264 wrote to memory of 2976 264 dpjdj.exe 32 PID 264 wrote to memory of 2976 264 dpjdj.exe 32 PID 264 wrote to memory of 2976 264 dpjdj.exe 32 PID 264 wrote to memory of 2976 264 dpjdj.exe 32 PID 2976 wrote to memory of 3000 2976 fxxfxfx.exe 33 PID 2976 wrote to memory of 3000 2976 fxxfxfx.exe 33 PID 2976 wrote to memory of 3000 2976 fxxfxfx.exe 33 PID 2976 wrote to memory of 3000 2976 fxxfxfx.exe 33 PID 3000 wrote to memory of 2752 3000 htbbhh.exe 34 PID 3000 wrote to memory of 2752 3000 htbbhh.exe 34 PID 3000 wrote to memory of 2752 3000 htbbhh.exe 34 PID 3000 wrote to memory of 2752 3000 htbbhh.exe 34 PID 2752 wrote to memory of 3024 2752 3jvvj.exe 35 PID 2752 wrote to memory of 3024 2752 3jvvj.exe 35 PID 2752 wrote to memory of 3024 2752 3jvvj.exe 35 PID 2752 wrote to memory of 3024 2752 3jvvj.exe 35 PID 3024 wrote to memory of 2720 3024 ntntnh.exe 36 PID 3024 wrote to memory of 2720 3024 ntntnh.exe 36 PID 3024 wrote to memory of 2720 3024 ntntnh.exe 36 PID 3024 wrote to memory of 2720 3024 ntntnh.exe 36 PID 2720 wrote to memory of 2776 2720 pdvvj.exe 37 PID 2720 wrote to memory of 2776 2720 pdvvj.exe 37 PID 2720 wrote to memory of 2776 2720 pdvvj.exe 37 PID 2720 wrote to memory of 2776 2720 pdvvj.exe 37 PID 2776 wrote to memory of 2076 2776 fxlxfrl.exe 38 PID 2776 wrote to memory of 2076 2776 fxlxfrl.exe 38 PID 2776 wrote to memory of 2076 2776 fxlxfrl.exe 38 PID 2776 wrote to memory of 2076 2776 fxlxfrl.exe 38 PID 2076 wrote to memory of 872 2076 nbnnbb.exe 40 PID 2076 wrote to memory of 872 2076 nbnnbb.exe 40 PID 2076 wrote to memory of 872 2076 nbnnbb.exe 40 PID 2076 wrote to memory of 872 2076 nbnnbb.exe 40 PID 872 wrote to memory of 2480 872 pdddd.exe 41 PID 872 wrote to memory of 2480 872 pdddd.exe 41 PID 872 wrote to memory of 2480 872 pdddd.exe 41 PID 872 wrote to memory of 2480 872 pdddd.exe 41 PID 2480 wrote to memory of 1020 2480 frflrrx.exe 42 PID 2480 wrote to memory of 1020 2480 frflrrx.exe 42 PID 2480 wrote to memory of 1020 2480 frflrrx.exe 42 PID 2480 wrote to memory of 1020 2480 frflrrx.exe 42 PID 1020 wrote to memory of 1680 1020 xlfllrf.exe 43 PID 1020 wrote to memory of 1680 1020 xlfllrf.exe 43 PID 1020 wrote to memory of 1680 1020 xlfllrf.exe 43 PID 1020 wrote to memory of 1680 1020 xlfllrf.exe 43 PID 1680 wrote to memory of 1968 1680 bntbhb.exe 44 PID 1680 wrote to memory of 1968 1680 bntbhb.exe 44 PID 1680 wrote to memory of 1968 1680 bntbhb.exe 44 PID 1680 wrote to memory of 1968 1680 bntbhb.exe 44 PID 1968 wrote to memory of 1720 1968 pdjjd.exe 45 PID 1968 wrote to memory of 1720 1968 pdjjd.exe 45 PID 1968 wrote to memory of 1720 1968 pdjjd.exe 45 PID 1968 wrote to memory of 1720 1968 pdjjd.exe 45 PID 1720 wrote to memory of 1696 1720 rlrlxrl.exe 46 PID 1720 wrote to memory of 1696 1720 rlrlxrl.exe 46 PID 1720 wrote to memory of 1696 1720 rlrlxrl.exe 46 PID 1720 wrote to memory of 1696 1720 rlrlxrl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a599ee1085ee575689428222304fc280N.exe"C:\Users\Admin\AppData\Local\Temp\a599ee1085ee575689428222304fc280N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\hbntnn.exec:\hbntnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dpjdj.exec:\dpjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\fxxfxfx.exec:\fxxfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\htbbhh.exec:\htbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3jvvj.exec:\3jvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ntntnh.exec:\ntntnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\pdvvj.exec:\pdvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\fxlxfrl.exec:\fxlxfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nbnnbb.exec:\nbnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\pdddd.exec:\pdddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\frflrrx.exec:\frflrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xlfllrf.exec:\xlfllrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\bntbhb.exec:\bntbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\pdjjd.exec:\pdjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rlrlxrl.exec:\rlrlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hbnbnn.exec:\hbnbnn.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1pvpv.exec:\1pvpv.exe18⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9xrrfxf.exec:\9xrrfxf.exe19⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1tbbtn.exec:\1tbbtn.exe20⤵
- Executes dropped EXE
PID:1844 -
\??\c:\3vpdp.exec:\3vpdp.exe21⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3djvd.exec:\3djvd.exe22⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llfrxlx.exec:\llfrxlx.exe23⤵
- Executes dropped EXE
PID:2260 -
\??\c:\btttbb.exec:\btttbb.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3vpjv.exec:\3vpjv.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rrlxllr.exec:\rrlxllr.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\bntbhn.exec:\bntbhn.exe27⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dpdvd.exec:\dpdvd.exe28⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe29⤵
- Executes dropped EXE
PID:856 -
\??\c:\xlrflfl.exec:\xlrflfl.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jdpjd.exec:\jdpjd.exe31⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1dpvd.exec:\1dpvd.exe32⤵
- Executes dropped EXE
PID:1656 -
\??\c:\3rfllll.exec:\3rfllll.exe33⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bthhth.exec:\bthhth.exe34⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnnnbb.exec:\tnnnbb.exe35⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dpjjd.exec:\dpjjd.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1frlxfl.exec:\1frlxfl.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tnbhtb.exec:\tnbhtb.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tnbbhb.exec:\tnbbhb.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7jpjv.exec:\7jpjv.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\7djjp.exec:\7djjp.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xflrxlf.exec:\xflrxlf.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3tntnt.exec:\3tntnt.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1tttht.exec:\1tttht.exe44⤵
- Executes dropped EXE
PID:756 -
\??\c:\1pvdj.exec:\1pvdj.exe45⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vjpvp.exec:\vjpvp.exe46⤵
- Executes dropped EXE
PID:872 -
\??\c:\lfrfrfr.exec:\lfrfrfr.exe47⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xffxlxl.exec:\xffxlxl.exe48⤵
- Executes dropped EXE
PID:712 -
\??\c:\btnhtn.exec:\btnhtn.exe49⤵
- Executes dropped EXE
PID:2444 -
\??\c:\thnthb.exec:\thnthb.exe50⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdjjj.exec:\jdjjj.exe51⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lrlrffr.exec:\lrlrffr.exe52⤵
- Executes dropped EXE
PID:1884 -
\??\c:\llxxrrf.exec:\llxxrrf.exe53⤵
- Executes dropped EXE
PID:1128 -
\??\c:\tththt.exec:\tththt.exe54⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nhttbh.exec:\nhttbh.exe55⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dvddv.exec:\dvddv.exe56⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9pjpd.exec:\9pjpd.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxrxrfr.exec:\fxrxrfr.exe58⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tbttnt.exec:\tbttnt.exe59⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bnbhnn.exec:\bnbhnn.exe60⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ddpvp.exec:\ddpvp.exe61⤵
- Executes dropped EXE
PID:980 -
\??\c:\vpvjv.exec:\vpvjv.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9llrxxf.exec:\9llrxxf.exe63⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5lfrxlf.exec:\5lfrxlf.exe64⤵
- Executes dropped EXE
PID:1428 -
\??\c:\hbhnbb.exec:\hbhnbb.exe65⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nbbhtt.exec:\nbbhtt.exe66⤵PID:1420
-
\??\c:\dvvdv.exec:\dvvdv.exe67⤵PID:2856
-
\??\c:\jjpjj.exec:\jjpjj.exe68⤵PID:1908
-
\??\c:\1fxrrrr.exec:\1fxrrrr.exe69⤵PID:2416
-
\??\c:\1xlfrxr.exec:\1xlfrxr.exe70⤵PID:1540
-
\??\c:\htbtnb.exec:\htbtnb.exe71⤵PID:2916
-
\??\c:\pjjjj.exec:\pjjjj.exe72⤵PID:932
-
\??\c:\7pjpv.exec:\7pjpv.exe73⤵PID:1756
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe74⤵PID:2176
-
\??\c:\fxlxxfl.exec:\fxlxxfl.exe75⤵PID:2736
-
\??\c:\nhttbn.exec:\nhttbn.exe76⤵PID:3068
-
\??\c:\jpjpj.exec:\jpjpj.exe77⤵PID:2756
-
\??\c:\jvjdj.exec:\jvjdj.exe78⤵PID:2744
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe79⤵PID:2752
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe80⤵PID:2820
-
\??\c:\ttntbh.exec:\ttntbh.exe81⤵PID:2548
-
\??\c:\vpjpj.exec:\vpjpj.exe82⤵PID:2720
-
\??\c:\9jvvp.exec:\9jvvp.exe83⤵PID:2608
-
\??\c:\rflffrx.exec:\rflffrx.exe84⤵PID:2716
-
\??\c:\5frxflx.exec:\5frxflx.exe85⤵PID:2316
-
\??\c:\tnbtbt.exec:\tnbtbt.exe86⤵PID:1648
-
\??\c:\dpdjp.exec:\dpdjp.exe87⤵PID:2464
-
\??\c:\pvvpp.exec:\pvvpp.exe88⤵PID:316
-
\??\c:\fllrxxf.exec:\fllrxxf.exe89⤵PID:2444
-
\??\c:\rlxfrrr.exec:\rlxfrrr.exe90⤵PID:1680
-
\??\c:\hthbtt.exec:\hthbtt.exe91⤵PID:1852
-
\??\c:\jddpv.exec:\jddpv.exe92⤵PID:1016
-
\??\c:\vjjpp.exec:\vjjpp.exe93⤵PID:1920
-
\??\c:\frlffrx.exec:\frlffrx.exe94⤵PID:1620
-
\??\c:\9ffffxf.exec:\9ffffxf.exe95⤵PID:2532
-
\??\c:\bnhhnh.exec:\bnhhnh.exe96⤵PID:2832
-
\??\c:\htnnht.exec:\htnnht.exe97⤵PID:1412
-
\??\c:\pdjdj.exec:\pdjdj.exe98⤵PID:1924
-
\??\c:\pjdvd.exec:\pjdvd.exe99⤵PID:604
-
\??\c:\3fxlrlr.exec:\3fxlrlr.exe100⤵PID:1876
-
\??\c:\nhbbhh.exec:\nhbbhh.exe101⤵PID:980
-
\??\c:\bhtnhb.exec:\bhtnhb.exe102⤵PID:2516
-
\??\c:\vppvv.exec:\vppvv.exe103⤵PID:2340
-
\??\c:\pdjpp.exec:\pdjpp.exe104⤵PID:1704
-
\??\c:\rxxxfxl.exec:\rxxxfxl.exe105⤵PID:1516
-
\??\c:\fxxxflr.exec:\fxxxflr.exe106⤵PID:1472
-
\??\c:\bnbnnn.exec:\bnbnnn.exe107⤵PID:2856
-
\??\c:\pdpjj.exec:\pdpjj.exe108⤵PID:1904
-
\??\c:\jvddd.exec:\jvddd.exe109⤵PID:2184
-
\??\c:\ffllrrf.exec:\ffllrrf.exe110⤵PID:2908
-
\??\c:\ffllfff.exec:\ffllfff.exe111⤵PID:1652
-
\??\c:\1tbbtt.exec:\1tbbtt.exe112⤵PID:1760
-
\??\c:\hntbhh.exec:\hntbhh.exe113⤵PID:1552
-
\??\c:\pvddj.exec:\pvddj.exe114⤵PID:2936
-
\??\c:\jvpjj.exec:\jvpjj.exe115⤵PID:2748
-
\??\c:\1rrxflx.exec:\1rrxflx.exe116⤵PID:2696
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe117⤵PID:2772
-
\??\c:\7thnnt.exec:\7thnnt.exe118⤵PID:2816
-
\??\c:\5pddj.exec:\5pddj.exe119⤵PID:2296
-
\??\c:\pvppp.exec:\pvppp.exe120⤵PID:2544
-
\??\c:\lxllxfx.exec:\lxllxfx.exe121⤵PID:2576
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe122⤵PID:2108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-