Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe
Resource
win7-20240903-en
General
-
Target
1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe
-
Size
230KB
-
MD5
517281f7bd56a43094ec1300f76f4e2f
-
SHA1
26235c95e67a2e5cd3869d5e0c49658c9f6bbef6
-
SHA256
1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b
-
SHA512
d2b334d69248fe135cbbb75bd9145dc22b95ede8048302ac8bda138a16b2c3fdf60de55c531a6ced06bbfe1cd0ddc36169ebc12ac568fab67df5e043a7ac02ea
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1fE:n3C9BRo7MlrWKo+lxKk1c
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/656-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/488-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 pjddp.exe 1736 lxrrxxl.exe 2516 9btbbn.exe 2724 ffffrxr.exe 2840 nhntnn.exe 2744 dvvdp.exe 2860 rrlrlrf.exe 2580 lxlxrrx.exe 2332 bnbthh.exe 2084 dvdjv.exe 1664 5rlrxfl.exe 2936 5nhtht.exe 2572 ddppd.exe 2920 5rllrrx.exe 2820 3hntbt.exe 656 vpjpd.exe 1568 9vpvd.exe 3016 3fllrlr.exe 1248 nnhnbh.exe 2052 vvppd.exe 988 rxfxflx.exe 1484 3fxfllr.exe 2540 5thhtt.exe 1776 pdppv.exe 2252 frrrxxf.exe 488 bththn.exe 1772 jjdjj.exe 2384 9rfrrrx.exe 1036 9frlrrx.exe 2336 bbbnth.exe 1496 jpjvp.exe 2664 ffrlxfl.exe 2912 nhbhhn.exe 1112 9vjpv.exe 2692 jdjjp.exe 2892 rlffrfr.exe 2716 lfrlrrx.exe 2904 tnbnth.exe 3028 hbtbhn.exe 2788 7vdjv.exe 2672 vpddp.exe 1784 xxllxxr.exe 2704 hbnntb.exe 1836 3httbh.exe 976 dvppp.exe 2928 vvdvd.exe 644 3llrlfr.exe 2816 rlxflrf.exe 680 nhntbn.exe 2920 1tbnbb.exe 1936 jdpdp.exe 1912 rlrrrxl.exe 2952 lxlxllx.exe 2984 rfrfrrx.exe 344 bthnbb.exe 1236 pjdvj.exe 2316 jdvdd.exe 3032 llxlxxf.exe 1768 9rrlxxl.exe 1544 tnbhnb.exe 1520 dvjvd.exe 1776 dpvvd.exe 1792 frflfxf.exe 2456 rlxflrx.exe -
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/656-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/488-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2664 2104 1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe 30 PID 2104 wrote to memory of 2664 2104 1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe 30 PID 2104 wrote to memory of 2664 2104 1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe 30 PID 2104 wrote to memory of 2664 2104 1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe 30 PID 2664 wrote to memory of 1736 2664 pjddp.exe 31 PID 2664 wrote to memory of 1736 2664 pjddp.exe 31 PID 2664 wrote to memory of 1736 2664 pjddp.exe 31 PID 2664 wrote to memory of 1736 2664 pjddp.exe 31 PID 1736 wrote to memory of 2516 1736 lxrrxxl.exe 32 PID 1736 wrote to memory of 2516 1736 lxrrxxl.exe 32 PID 1736 wrote to memory of 2516 1736 lxrrxxl.exe 32 PID 1736 wrote to memory of 2516 1736 lxrrxxl.exe 32 PID 2516 wrote to memory of 2724 2516 9btbbn.exe 33 PID 2516 wrote to memory of 2724 2516 9btbbn.exe 33 PID 2516 wrote to memory of 2724 2516 9btbbn.exe 33 PID 2516 wrote to memory of 2724 2516 9btbbn.exe 33 PID 2724 wrote to memory of 2840 2724 ffffrxr.exe 34 PID 2724 wrote to memory of 2840 2724 ffffrxr.exe 34 PID 2724 wrote to memory of 2840 2724 ffffrxr.exe 34 PID 2724 wrote to memory of 2840 2724 ffffrxr.exe 34 PID 2840 wrote to memory of 2744 2840 nhntnn.exe 35 PID 2840 wrote to memory of 2744 2840 nhntnn.exe 35 PID 2840 wrote to memory of 2744 2840 nhntnn.exe 35 PID 2840 wrote to memory of 2744 2840 nhntnn.exe 35 PID 2744 wrote to memory of 2860 2744 dvvdp.exe 36 PID 2744 wrote to memory of 2860 2744 dvvdp.exe 36 PID 2744 wrote to memory of 2860 2744 dvvdp.exe 36 PID 2744 wrote to memory of 2860 2744 dvvdp.exe 36 PID 2860 wrote to memory of 2580 2860 rrlrlrf.exe 37 PID 2860 wrote to memory of 2580 2860 rrlrlrf.exe 37 PID 2860 wrote to memory of 2580 2860 rrlrlrf.exe 37 PID 2860 wrote to memory of 2580 2860 rrlrlrf.exe 37 PID 2580 wrote to memory of 2332 2580 lxlxrrx.exe 38 PID 2580 wrote to memory of 2332 2580 lxlxrrx.exe 38 PID 2580 wrote to memory of 2332 2580 lxlxrrx.exe 38 PID 2580 wrote to memory of 2332 2580 lxlxrrx.exe 38 PID 2332 wrote to memory of 2084 2332 bnbthh.exe 39 PID 2332 wrote to memory of 2084 2332 bnbthh.exe 39 PID 2332 wrote to memory of 2084 2332 bnbthh.exe 39 PID 2332 wrote to memory of 2084 2332 bnbthh.exe 39 PID 2084 wrote to memory of 1664 2084 dvdjv.exe 40 PID 2084 wrote to memory of 1664 2084 dvdjv.exe 40 PID 2084 wrote to memory of 1664 2084 dvdjv.exe 40 PID 2084 wrote to memory of 1664 2084 dvdjv.exe 40 PID 1664 wrote to memory of 2936 1664 5rlrxfl.exe 41 PID 1664 wrote to memory of 2936 1664 5rlrxfl.exe 41 PID 1664 wrote to memory of 2936 1664 5rlrxfl.exe 41 PID 1664 wrote to memory of 2936 1664 5rlrxfl.exe 41 PID 2936 wrote to memory of 2572 2936 5nhtht.exe 42 PID 2936 wrote to memory of 2572 2936 5nhtht.exe 42 PID 2936 wrote to memory of 2572 2936 5nhtht.exe 42 PID 2936 wrote to memory of 2572 2936 5nhtht.exe 42 PID 2572 wrote to memory of 2920 2572 ddppd.exe 43 PID 2572 wrote to memory of 2920 2572 ddppd.exe 43 PID 2572 wrote to memory of 2920 2572 ddppd.exe 43 PID 2572 wrote to memory of 2920 2572 ddppd.exe 43 PID 2920 wrote to memory of 2820 2920 5rllrrx.exe 44 PID 2920 wrote to memory of 2820 2920 5rllrrx.exe 44 PID 2920 wrote to memory of 2820 2920 5rllrrx.exe 44 PID 2920 wrote to memory of 2820 2920 5rllrrx.exe 44 PID 2820 wrote to memory of 656 2820 3hntbt.exe 45 PID 2820 wrote to memory of 656 2820 3hntbt.exe 45 PID 2820 wrote to memory of 656 2820 3hntbt.exe 45 PID 2820 wrote to memory of 656 2820 3hntbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe"C:\Users\Admin\AppData\Local\Temp\1a2321e84b672b1896ab762da561f6282448e152de5e73904ecf6b41905bcf6b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pjddp.exec:\pjddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\9btbbn.exec:\9btbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ffffrxr.exec:\ffffrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nhntnn.exec:\nhntnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dvvdp.exec:\dvvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\lxlxrrx.exec:\lxlxrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bnbthh.exec:\bnbthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\dvdjv.exec:\dvdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\5rlrxfl.exec:\5rlrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\5nhtht.exec:\5nhtht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ddppd.exec:\ddppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5rllrrx.exec:\5rllrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\3hntbt.exec:\3hntbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vpjpd.exec:\vpjpd.exe17⤵
- Executes dropped EXE
PID:656 -
\??\c:\9vpvd.exec:\9vpvd.exe18⤵
- Executes dropped EXE
PID:1568 -
\??\c:\3fllrlr.exec:\3fllrlr.exe19⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nnhnbh.exec:\nnhnbh.exe20⤵
- Executes dropped EXE
PID:1248 -
\??\c:\vvppd.exec:\vvppd.exe21⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rxfxflx.exec:\rxfxflx.exe22⤵
- Executes dropped EXE
PID:988 -
\??\c:\3fxfllr.exec:\3fxfllr.exe23⤵
- Executes dropped EXE
PID:1484 -
\??\c:\5thhtt.exec:\5thhtt.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pdppv.exec:\pdppv.exe25⤵
- Executes dropped EXE
PID:1776 -
\??\c:\frrrxxf.exec:\frrrxxf.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bththn.exec:\bththn.exe27⤵
- Executes dropped EXE
PID:488 -
\??\c:\jjdjj.exec:\jjdjj.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\9rfrrrx.exec:\9rfrrrx.exe29⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9frlrrx.exec:\9frlrrx.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bbbnth.exec:\bbbnth.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jpjvp.exec:\jpjvp.exe32⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ffrlxfl.exec:\ffrlxfl.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nhbhhn.exec:\nhbhhn.exe34⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9vjpv.exec:\9vjpv.exe35⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jdjjp.exec:\jdjjp.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rlffrfr.exec:\rlffrfr.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnbnth.exec:\tnbnth.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hbtbhn.exec:\hbtbhn.exe40⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7vdjv.exec:\7vdjv.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vpddp.exec:\vpddp.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xxllxxr.exec:\xxllxxr.exe43⤵
- Executes dropped EXE
PID:1784 -
\??\c:\hbnntb.exec:\hbnntb.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3httbh.exec:\3httbh.exe45⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dvppp.exec:\dvppp.exe46⤵
- Executes dropped EXE
PID:976 -
\??\c:\vvdvd.exec:\vvdvd.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3llrlfr.exec:\3llrlfr.exe48⤵
- Executes dropped EXE
PID:644 -
\??\c:\rlxflrf.exec:\rlxflrf.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nhntbn.exec:\nhntbn.exe50⤵
- Executes dropped EXE
PID:680 -
\??\c:\1tbnbb.exec:\1tbnbb.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jdpdp.exec:\jdpdp.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rlrrrxl.exec:\rlrrrxl.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lxlxllx.exec:\lxlxllx.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rfrfrrx.exec:\rfrfrrx.exe55⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bthnbb.exec:\bthnbb.exe56⤵
- Executes dropped EXE
PID:344 -
\??\c:\pjdvj.exec:\pjdvj.exe57⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jdvdd.exec:\jdvdd.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\llxlxxf.exec:\llxlxxf.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9rrlxxl.exec:\9rrlxxl.exe60⤵
- Executes dropped EXE
PID:1768 -
\??\c:\tnbhnb.exec:\tnbhnb.exe61⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dvjvd.exec:\dvjvd.exe62⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dpvvd.exec:\dpvvd.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\frflfxf.exec:\frflfxf.exe64⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rlxflrx.exec:\rlxflrx.exe65⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hhnnbh.exec:\hhnnbh.exe66⤵PID:2044
-
\??\c:\btntbb.exec:\btntbb.exe67⤵PID:2272
-
\??\c:\jdjjp.exec:\jdjjp.exe68⤵PID:2384
-
\??\c:\vjvvp.exec:\vjvvp.exe69⤵PID:2548
-
\??\c:\lfrrllr.exec:\lfrrllr.exe70⤵PID:1844
-
\??\c:\xrrxxxl.exec:\xrrxxxl.exe71⤵PID:1940
-
\??\c:\3nhhbb.exec:\3nhhbb.exe72⤵PID:2344
-
\??\c:\httnbb.exec:\httnbb.exe73⤵PID:876
-
\??\c:\jdpvv.exec:\jdpvv.exe74⤵PID:1588
-
\??\c:\7jvjp.exec:\7jvjp.exe75⤵PID:2184
-
\??\c:\frfxffl.exec:\frfxffl.exe76⤵PID:2844
-
\??\c:\tnbbnn.exec:\tnbbnn.exe77⤵PID:3060
-
\??\c:\nhhntb.exec:\nhhntb.exe78⤵PID:3056
-
\??\c:\vjvpj.exec:\vjvpj.exe79⤵PID:2612
-
\??\c:\7dppv.exec:\7dppv.exe80⤵PID:2916
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe81⤵PID:2648
-
\??\c:\lxxxxxf.exec:\lxxxxxf.exe82⤵PID:2848
-
\??\c:\nbhbhb.exec:\nbhbhb.exe83⤵PID:2340
-
\??\c:\btbbbb.exec:\btbbbb.exe84⤵PID:1084
-
\??\c:\dvjjj.exec:\dvjjj.exe85⤵PID:1464
-
\??\c:\jdjpp.exec:\jdjpp.exe86⤵PID:2824
-
\??\c:\rffxfxf.exec:\rffxfxf.exe87⤵PID:1492
-
\??\c:\frllxxf.exec:\frllxxf.exe88⤵
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\tbhhbb.exec:\tbhhbb.exe89⤵PID:2572
-
\??\c:\vvvjd.exec:\vvvjd.exe90⤵PID:2684
-
\??\c:\1pdjj.exec:\1pdjj.exe91⤵PID:1752
-
\??\c:\llflrrx.exec:\llflrrx.exe92⤵PID:1632
-
\??\c:\xlxfffl.exec:\xlxfffl.exe93⤵PID:656
-
\??\c:\hbthht.exec:\hbthht.exe94⤵PID:1568
-
\??\c:\9hnhtn.exec:\9hnhtn.exe95⤵PID:2680
-
\??\c:\9jjpd.exec:\9jjpd.exe96⤵PID:2072
-
\??\c:\dpddj.exec:\dpddj.exe97⤵PID:2300
-
\??\c:\lfxxllf.exec:\lfxxllf.exe98⤵PID:356
-
\??\c:\lrflffx.exec:\lrflffx.exe99⤵PID:984
-
\??\c:\hbtthn.exec:\hbtthn.exe100⤵PID:1212
-
\??\c:\tbnnhh.exec:\tbnnhh.exe101⤵PID:904
-
\??\c:\vdjvd.exec:\vdjvd.exe102⤵PID:1284
-
\??\c:\9jvdj.exec:\9jvdj.exe103⤵PID:2472
-
\??\c:\ffrrfxf.exec:\ffrrfxf.exe104⤵PID:2512
-
\??\c:\hthnnn.exec:\hthnnn.exe105⤵PID:2352
-
\??\c:\ttbbtt.exec:\ttbbtt.exe106⤵PID:2496
-
\??\c:\1dddp.exec:\1dddp.exe107⤵PID:2164
-
\??\c:\1dpdd.exec:\1dpdd.exe108⤵PID:1612
-
\??\c:\lxrllrx.exec:\lxrllrx.exe109⤵PID:1904
-
\??\c:\fflxflf.exec:\fflxflf.exe110⤵PID:1900
-
\??\c:\tbtbth.exec:\tbtbth.exe111⤵PID:1708
-
\??\c:\tnhtbt.exec:\tnhtbt.exe112⤵PID:2664
-
\??\c:\pdppd.exec:\pdppd.exe113⤵PID:1696
-
\??\c:\dvpvd.exec:\dvpvd.exe114⤵PID:2480
-
\??\c:\7frxfff.exec:\7frxfff.exe115⤵PID:2880
-
\??\c:\7fxxflx.exec:\7fxxflx.exe116⤵PID:2688
-
\??\c:\hthbnn.exec:\hthbnn.exe117⤵PID:2224
-
\??\c:\nnthhb.exec:\nnthhb.exe118⤵PID:2856
-
\??\c:\7jvdp.exec:\7jvdp.exe119⤵PID:2748
-
\??\c:\7ffrrxf.exec:\7ffrrxf.exe120⤵PID:2616
-
\??\c:\7lxxrrf.exec:\7lxxrrf.exe121⤵PID:2900
-
\??\c:\rrlrffl.exec:\rrlrffl.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-