Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 08:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f5c589d3adacd26919bac7eaf987540N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
6f5c589d3adacd26919bac7eaf987540N.exe
-
Size
589KB
-
MD5
6f5c589d3adacd26919bac7eaf987540
-
SHA1
2d580faca35e9e88b3075a5cb85ffc08e1b58634
-
SHA256
9d4ab1dc9029542ab5b7d6447f63c9a5023ff260a23f89ed608d172a4d653888
-
SHA512
a1144bdfb826c9a4e3533c513824f90c6d682233609d6eca3e4ac276b38b604c92a8fc5f32c6be38ee2c8d6da9dcd95bc2101d47888b68d5df223721f08684f3
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayu:n3C9Lebz+xt4vFeFmgayu
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2496-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 fxffrxl.exe 324 lxrfrrl.exe 1792 lfrxxxx.exe 2924 dvdjj.exe 2164 lfrxflx.exe 2856 vvjjv.exe 2712 djdjd.exe 2824 djjpp.exe 2692 llfxxfl.exe 2644 btntbb.exe 3016 rlrrxfx.exe 1544 tnhntb.exe 1432 7dvvv.exe 2124 thnnnn.exe 1796 bttttt.exe 828 rrxxffl.exe 1936 bthhnn.exe 2836 fxlrxll.exe 2256 bbhbhn.exe 916 lxlfxxf.exe 576 bbhhtt.exe 684 5bnnbb.exe 1892 dvjpp.exe 2352 rrlrfrx.exe 856 ddpdv.exe 564 xflxrll.exe 1568 vjpdv.exe 1448 rfffrrf.exe 1500 nhhbbh.exe 888 xxrxfrx.exe 2972 9rlrffl.exe 2548 dvjpp.exe 2056 jvpvj.exe 1728 rlffrrx.exe 756 xrfxfrx.exe 2880 bthnnt.exe 2672 pjvpv.exe 2320 pjvdj.exe 2820 fxrxxff.exe 2704 xrrxxfl.exe 2708 9bntbh.exe 2460 vpdpv.exe 2716 dvjpp.exe 2024 rfrfllx.exe 2656 frflrxf.exe 2872 vpjjj.exe 1844 fxfffll.exe 1620 bbbhbh.exe 1688 5vppp.exe 1492 5lxllrr.exe 1208 llxflff.exe 2040 3bttbb.exe 1340 jdvpd.exe 2640 vvdpd.exe 1940 9rffflr.exe 2836 7nhhnn.exe 1800 vpddd.exe 1112 vvvjp.exe 1976 3flrxxf.exe 1572 pdvjv.exe 848 jdppv.exe 1812 ffrrfrx.exe 1600 hbbbtn.exe 1856 vvjvv.exe -
resource yara_rule behavioral1/memory/2496-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2064 2496 6f5c589d3adacd26919bac7eaf987540N.exe 30 PID 2496 wrote to memory of 2064 2496 6f5c589d3adacd26919bac7eaf987540N.exe 30 PID 2496 wrote to memory of 2064 2496 6f5c589d3adacd26919bac7eaf987540N.exe 30 PID 2496 wrote to memory of 2064 2496 6f5c589d3adacd26919bac7eaf987540N.exe 30 PID 2064 wrote to memory of 324 2064 fxffrxl.exe 31 PID 2064 wrote to memory of 324 2064 fxffrxl.exe 31 PID 2064 wrote to memory of 324 2064 fxffrxl.exe 31 PID 2064 wrote to memory of 324 2064 fxffrxl.exe 31 PID 324 wrote to memory of 1792 324 lxrfrrl.exe 32 PID 324 wrote to memory of 1792 324 lxrfrrl.exe 32 PID 324 wrote to memory of 1792 324 lxrfrrl.exe 32 PID 324 wrote to memory of 1792 324 lxrfrrl.exe 32 PID 1792 wrote to memory of 2924 1792 lfrxxxx.exe 33 PID 1792 wrote to memory of 2924 1792 lfrxxxx.exe 33 PID 1792 wrote to memory of 2924 1792 lfrxxxx.exe 33 PID 1792 wrote to memory of 2924 1792 lfrxxxx.exe 33 PID 2924 wrote to memory of 2164 2924 dvdjj.exe 34 PID 2924 wrote to memory of 2164 2924 dvdjj.exe 34 PID 2924 wrote to memory of 2164 2924 dvdjj.exe 34 PID 2924 wrote to memory of 2164 2924 dvdjj.exe 34 PID 2164 wrote to memory of 2856 2164 lfrxflx.exe 35 PID 2164 wrote to memory of 2856 2164 lfrxflx.exe 35 PID 2164 wrote to memory of 2856 2164 lfrxflx.exe 35 PID 2164 wrote to memory of 2856 2164 lfrxflx.exe 35 PID 2856 wrote to memory of 2712 2856 vvjjv.exe 36 PID 2856 wrote to memory of 2712 2856 vvjjv.exe 36 PID 2856 wrote to memory of 2712 2856 vvjjv.exe 36 PID 2856 wrote to memory of 2712 2856 vvjjv.exe 36 PID 2712 wrote to memory of 2824 2712 djdjd.exe 37 PID 2712 wrote to memory of 2824 2712 djdjd.exe 37 PID 2712 wrote to memory of 2824 2712 djdjd.exe 37 PID 2712 wrote to memory of 2824 2712 djdjd.exe 37 PID 2824 wrote to memory of 2692 2824 djjpp.exe 38 PID 2824 wrote to memory of 2692 2824 djjpp.exe 38 PID 2824 wrote to memory of 2692 2824 djjpp.exe 38 PID 2824 wrote to memory of 2692 2824 djjpp.exe 38 PID 2692 wrote to memory of 2644 2692 llfxxfl.exe 39 PID 2692 wrote to memory of 2644 2692 llfxxfl.exe 39 PID 2692 wrote to memory of 2644 2692 llfxxfl.exe 39 PID 2692 wrote to memory of 2644 2692 llfxxfl.exe 39 PID 2644 wrote to memory of 3016 2644 btntbb.exe 40 PID 2644 wrote to memory of 3016 2644 btntbb.exe 40 PID 2644 wrote to memory of 3016 2644 btntbb.exe 40 PID 2644 wrote to memory of 3016 2644 btntbb.exe 40 PID 3016 wrote to memory of 1544 3016 rlrrxfx.exe 41 PID 3016 wrote to memory of 1544 3016 rlrrxfx.exe 41 PID 3016 wrote to memory of 1544 3016 rlrrxfx.exe 41 PID 3016 wrote to memory of 1544 3016 rlrrxfx.exe 41 PID 1544 wrote to memory of 1432 1544 tnhntb.exe 42 PID 1544 wrote to memory of 1432 1544 tnhntb.exe 42 PID 1544 wrote to memory of 1432 1544 tnhntb.exe 42 PID 1544 wrote to memory of 1432 1544 tnhntb.exe 42 PID 1432 wrote to memory of 2124 1432 7dvvv.exe 43 PID 1432 wrote to memory of 2124 1432 7dvvv.exe 43 PID 1432 wrote to memory of 2124 1432 7dvvv.exe 43 PID 1432 wrote to memory of 2124 1432 7dvvv.exe 43 PID 2124 wrote to memory of 1796 2124 thnnnn.exe 44 PID 2124 wrote to memory of 1796 2124 thnnnn.exe 44 PID 2124 wrote to memory of 1796 2124 thnnnn.exe 44 PID 2124 wrote to memory of 1796 2124 thnnnn.exe 44 PID 1796 wrote to memory of 828 1796 bttttt.exe 45 PID 1796 wrote to memory of 828 1796 bttttt.exe 45 PID 1796 wrote to memory of 828 1796 bttttt.exe 45 PID 1796 wrote to memory of 828 1796 bttttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f5c589d3adacd26919bac7eaf987540N.exe"C:\Users\Admin\AppData\Local\Temp\6f5c589d3adacd26919bac7eaf987540N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\fxffrxl.exec:\fxffrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\lxrfrrl.exec:\lxrfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\dvdjj.exec:\dvdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lfrxflx.exec:\lfrxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\vvjjv.exec:\vvjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\djdjd.exec:\djdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\djjpp.exec:\djjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\llfxxfl.exec:\llfxxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\btntbb.exec:\btntbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rlrrxfx.exec:\rlrrxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\tnhntb.exec:\tnhntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\7dvvv.exec:\7dvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\thnnnn.exec:\thnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\bttttt.exec:\bttttt.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\rrxxffl.exec:\rrxxffl.exe17⤵
- Executes dropped EXE
PID:828 -
\??\c:\bthhnn.exec:\bthhnn.exe18⤵
- Executes dropped EXE
PID:1936 -
\??\c:\fxlrxll.exec:\fxlrxll.exe19⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bbhbhn.exec:\bbhbhn.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lxlfxxf.exec:\lxlfxxf.exe21⤵
- Executes dropped EXE
PID:916 -
\??\c:\bbhhtt.exec:\bbhhtt.exe22⤵
- Executes dropped EXE
PID:576 -
\??\c:\5bnnbb.exec:\5bnnbb.exe23⤵
- Executes dropped EXE
PID:684 -
\??\c:\dvjpp.exec:\dvjpp.exe24⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rrlrfrx.exec:\rrlrfrx.exe25⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ddpdv.exec:\ddpdv.exe26⤵
- Executes dropped EXE
PID:856 -
\??\c:\xflxrll.exec:\xflxrll.exe27⤵
- Executes dropped EXE
PID:564 -
\??\c:\vjpdv.exec:\vjpdv.exe28⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rfffrrf.exec:\rfffrrf.exe29⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nhhbbh.exec:\nhhbbh.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\9rlrffl.exec:\9rlrffl.exe32⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dvjpp.exec:\dvjpp.exe33⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jvpvj.exec:\jvpvj.exe34⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rlffrrx.exec:\rlffrrx.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrfxfrx.exec:\xrfxfrx.exe36⤵
- Executes dropped EXE
PID:756 -
\??\c:\bthnnt.exec:\bthnnt.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pjvpv.exec:\pjvpv.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fxrxxff.exec:\fxrxxff.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xrrxxfl.exec:\xrrxxfl.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9bntbh.exec:\9bntbh.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vpdpv.exec:\vpdpv.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dvjpp.exec:\dvjpp.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rfrfllx.exec:\rfrfllx.exe45⤵
- Executes dropped EXE
PID:2024 -
\??\c:\frflrxf.exec:\frflrxf.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vpjjj.exec:\vpjjj.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxfffll.exec:\fxfffll.exe48⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bbbhbh.exec:\bbbhbh.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5vppp.exec:\5vppp.exe50⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5lxllrr.exec:\5lxllrr.exe51⤵
- Executes dropped EXE
PID:1492 -
\??\c:\llxflff.exec:\llxflff.exe52⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3bttbb.exec:\3bttbb.exe53⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jdvpd.exec:\jdvpd.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vvdpd.exec:\vvdpd.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\9rffflr.exec:\9rffflr.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7nhhnn.exec:\7nhhnn.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vpddd.exec:\vpddd.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vvvjp.exec:\vvvjp.exe59⤵
- Executes dropped EXE
PID:1112 -
\??\c:\3flrxxf.exec:\3flrxxf.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pdvjv.exec:\pdvjv.exe61⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jdppv.exec:\jdppv.exe62⤵
- Executes dropped EXE
PID:848 -
\??\c:\ffrrfrx.exec:\ffrrfrx.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hbbbtn.exec:\hbbbtn.exe64⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vvjvv.exec:\vvjvv.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvvpp.exec:\dvvpp.exe66⤵PID:856
-
\??\c:\3xlllfl.exec:\3xlllfl.exe67⤵PID:2092
-
\??\c:\tttbhn.exec:\tttbhn.exe68⤵PID:2240
-
\??\c:\thnhbh.exec:\thnhbh.exe69⤵PID:2324
-
\??\c:\9pdvv.exec:\9pdvv.exe70⤵PID:1864
-
\??\c:\lfrrlfl.exec:\lfrrlfl.exe71⤵PID:1848
-
\??\c:\nbbbbb.exec:\nbbbbb.exe72⤵PID:2544
-
\??\c:\tnbhbb.exec:\tnbhbb.exe73⤵PID:1508
-
\??\c:\vvpdp.exec:\vvpdp.exe74⤵PID:2520
-
\??\c:\frfffll.exec:\frfffll.exe75⤵PID:2080
-
\??\c:\3xxrxxx.exec:\3xxrxxx.exe76⤵PID:1980
-
\??\c:\nhnhtt.exec:\nhnhtt.exe77⤵PID:2660
-
\??\c:\3jvdj.exec:\3jvdj.exe78⤵PID:592
-
\??\c:\lxrrxrr.exec:\lxrrxrr.exe79⤵PID:956
-
\??\c:\fxfllrr.exec:\fxfllrr.exe80⤵PID:2148
-
\??\c:\htbhhh.exec:\htbhhh.exe81⤵PID:2856
-
\??\c:\jdjjp.exec:\jdjjp.exe82⤵PID:2776
-
\??\c:\rrfrllf.exec:\rrfrllf.exe83⤵PID:2852
-
\??\c:\tthbtn.exec:\tthbtn.exe84⤵PID:2744
-
\??\c:\dpvdv.exec:\dpvdv.exe85⤵PID:2580
-
\??\c:\pjjjp.exec:\pjjjp.exe86⤵PID:2692
-
\??\c:\xlllfff.exec:\xlllfff.exe87⤵PID:1516
-
\??\c:\nbnntb.exec:\nbnntb.exe88⤵PID:3024
-
\??\c:\hbhntb.exec:\hbhntb.exe89⤵PID:3016
-
\??\c:\dvjdp.exec:\dvjdp.exe90⤵PID:1840
-
\??\c:\xflxrll.exec:\xflxrll.exe91⤵
- System Location Discovery: System Language Discovery
PID:2484 -
\??\c:\ttnttb.exec:\ttnttb.exe92⤵PID:1428
-
\??\c:\bhhhnn.exec:\bhhhnn.exe93⤵PID:336
-
\??\c:\dpdvv.exec:\dpdvv.exe94⤵PID:2140
-
\??\c:\lflllfl.exec:\lflllfl.exe95⤵PID:1344
-
\??\c:\llrrxxl.exec:\llrrxxl.exe96⤵PID:1852
-
\??\c:\7bttbb.exec:\7bttbb.exe97⤵PID:2072
-
\??\c:\pjppj.exec:\pjppj.exe98⤵PID:1732
-
\??\c:\5xrrrrr.exec:\5xrrrrr.exe99⤵PID:2256
-
\??\c:\hbhhnn.exec:\hbhhnn.exe100⤵PID:2912
-
\??\c:\bnttnt.exec:\bnttnt.exe101⤵PID:784
-
\??\c:\9vjpv.exec:\9vjpv.exe102⤵PID:684
-
\??\c:\lrrrlrf.exec:\lrrrlrf.exe103⤵PID:2908
-
\??\c:\3lfflrf.exec:\3lfflrf.exe104⤵PID:1608
-
\??\c:\nbnnnn.exec:\nbnnnn.exe105⤵PID:1504
-
\??\c:\djjpp.exec:\djjpp.exe106⤵PID:1648
-
\??\c:\ffrxrrl.exec:\ffrxrrl.exe107⤵PID:2452
-
\??\c:\rlxxflr.exec:\rlxxflr.exe108⤵PID:2268
-
\??\c:\hnhttb.exec:\hnhttb.exe109⤵PID:2112
-
\??\c:\dpppp.exec:\dpppp.exe110⤵PID:876
-
\??\c:\3fffllr.exec:\3fffllr.exe111⤵PID:2120
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe112⤵PID:888
-
\??\c:\5nbtnn.exec:\5nbtnn.exe113⤵PID:2128
-
\??\c:\dvvdd.exec:\dvvdd.exe114⤵PID:1624
-
\??\c:\lxlfxlf.exec:\lxlfxlf.exe115⤵PID:2232
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe116⤵PID:2088
-
\??\c:\3nbhtn.exec:\3nbhtn.exe117⤵
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\vjjpd.exec:\vjjpd.exe118⤵PID:1792
-
\??\c:\xlfxfff.exec:\xlfxfff.exe119⤵PID:2012
-
\??\c:\5xrllff.exec:\5xrllff.exe120⤵PID:2808
-
\??\c:\htnnnt.exec:\htnnnt.exe121⤵PID:2952
-
\??\c:\jjddp.exec:\jjddp.exe122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-