Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe
Resource
win7-20240903-en
General
-
Target
d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe
-
Size
124KB
-
MD5
d76ffc4a45ebdc52e58b8a72354c76d6
-
SHA1
392a3eac1f5d8cc812d4d222df51c2e1916cf79e
-
SHA256
d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251
-
SHA512
e616f2b27b5153b065f0167df2c8835c7c87949b52c22ffafe07230ec8f5f2dcea35301075aa677fa2d7ee6c888c2f0e6a4373207c1cf1a0c60c76279bba5bcb
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0GsgcD2:n3C9BRomRph+0GsgcK
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2068-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/296-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2872 9btbnt.exe 2972 djjjd.exe 2852 xflxrxx.exe 2616 ffrffxr.exe 1008 nnbthn.exe 2712 pjjdj.exe 3052 3vpdp.exe 2692 9bnntt.exe 748 vppjj.exe 616 ffrfllx.exe 2348 bbthth.exe 2040 dvjdv.exe 2160 7pdjv.exe 2844 lfflrrx.exe 2304 3thtnh.exe 332 dpdvd.exe 2204 1jjvj.exe 1732 fxlrflx.exe 2484 thnntt.exe 1256 hbtbnn.exe 2168 dpppv.exe 1300 lfxfrrf.exe 112 fllxfxx.exe 1444 httbhn.exe 1532 dvpjj.exe 1984 5frrxxx.exe 1900 rxxfxxl.exe 3008 tnbthb.exe 296 jppdj.exe 1016 dvjvv.exe 2016 lffflll.exe 2732 nhtbnb.exe 2736 jdvjv.exe 2868 9pppd.exe 2780 1rrxffr.exe 2760 lfllxrf.exe 2896 hbtbtb.exe 2600 5pddv.exe 2648 lfllxxf.exe 2176 1lffllr.exe 1880 tnbbhh.exe 1568 9nbhtt.exe 2788 9vjvv.exe 2240 jvddd.exe 3028 fflllrr.exe 1320 lflrflr.exe 1244 rrffrrx.exe 2004 tnthtb.exe 2040 9pjdv.exe 1644 jvdvd.exe 2796 7xlffff.exe 596 rlrfrrl.exe 320 xrxflrr.exe 2424 htnbbb.exe 2292 ntttbn.exe 2496 dvvvd.exe 1752 pdvdp.exe 2136 5xfxlff.exe 1860 ffffxfl.exe 2144 fxrlfrf.exe 636 hbnntt.exe 2548 jvvdp.exe 1792 ddpdv.exe 1172 llxrxxx.exe -
resource yara_rule behavioral1/memory/2068-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/296-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2872 2068 d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe 30 PID 2068 wrote to memory of 2872 2068 d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe 30 PID 2068 wrote to memory of 2872 2068 d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe 30 PID 2068 wrote to memory of 2872 2068 d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe 30 PID 2872 wrote to memory of 2972 2872 9btbnt.exe 31 PID 2872 wrote to memory of 2972 2872 9btbnt.exe 31 PID 2872 wrote to memory of 2972 2872 9btbnt.exe 31 PID 2872 wrote to memory of 2972 2872 9btbnt.exe 31 PID 2972 wrote to memory of 2852 2972 djjjd.exe 32 PID 2972 wrote to memory of 2852 2972 djjjd.exe 32 PID 2972 wrote to memory of 2852 2972 djjjd.exe 32 PID 2972 wrote to memory of 2852 2972 djjjd.exe 32 PID 2852 wrote to memory of 2616 2852 xflxrxx.exe 33 PID 2852 wrote to memory of 2616 2852 xflxrxx.exe 33 PID 2852 wrote to memory of 2616 2852 xflxrxx.exe 33 PID 2852 wrote to memory of 2616 2852 xflxrxx.exe 33 PID 2616 wrote to memory of 1008 2616 ffrffxr.exe 34 PID 2616 wrote to memory of 1008 2616 ffrffxr.exe 34 PID 2616 wrote to memory of 1008 2616 ffrffxr.exe 34 PID 2616 wrote to memory of 1008 2616 ffrffxr.exe 34 PID 1008 wrote to memory of 2712 1008 nnbthn.exe 35 PID 1008 wrote to memory of 2712 1008 nnbthn.exe 35 PID 1008 wrote to memory of 2712 1008 nnbthn.exe 35 PID 1008 wrote to memory of 2712 1008 nnbthn.exe 35 PID 2712 wrote to memory of 3052 2712 pjjdj.exe 36 PID 2712 wrote to memory of 3052 2712 pjjdj.exe 36 PID 2712 wrote to memory of 3052 2712 pjjdj.exe 36 PID 2712 wrote to memory of 3052 2712 pjjdj.exe 36 PID 3052 wrote to memory of 2692 3052 3vpdp.exe 37 PID 3052 wrote to memory of 2692 3052 3vpdp.exe 37 PID 3052 wrote to memory of 2692 3052 3vpdp.exe 37 PID 3052 wrote to memory of 2692 3052 3vpdp.exe 37 PID 2692 wrote to memory of 748 2692 9bnntt.exe 38 PID 2692 wrote to memory of 748 2692 9bnntt.exe 38 PID 2692 wrote to memory of 748 2692 9bnntt.exe 38 PID 2692 wrote to memory of 748 2692 9bnntt.exe 38 PID 748 wrote to memory of 616 748 vppjj.exe 39 PID 748 wrote to memory of 616 748 vppjj.exe 39 PID 748 wrote to memory of 616 748 vppjj.exe 39 PID 748 wrote to memory of 616 748 vppjj.exe 39 PID 616 wrote to memory of 2348 616 ffrfllx.exe 40 PID 616 wrote to memory of 2348 616 ffrfllx.exe 40 PID 616 wrote to memory of 2348 616 ffrfllx.exe 40 PID 616 wrote to memory of 2348 616 ffrfllx.exe 40 PID 2348 wrote to memory of 2040 2348 bbthth.exe 41 PID 2348 wrote to memory of 2040 2348 bbthth.exe 41 PID 2348 wrote to memory of 2040 2348 bbthth.exe 41 PID 2348 wrote to memory of 2040 2348 bbthth.exe 41 PID 2040 wrote to memory of 2160 2040 dvjdv.exe 42 PID 2040 wrote to memory of 2160 2040 dvjdv.exe 42 PID 2040 wrote to memory of 2160 2040 dvjdv.exe 42 PID 2040 wrote to memory of 2160 2040 dvjdv.exe 42 PID 2160 wrote to memory of 2844 2160 7pdjv.exe 43 PID 2160 wrote to memory of 2844 2160 7pdjv.exe 43 PID 2160 wrote to memory of 2844 2160 7pdjv.exe 43 PID 2160 wrote to memory of 2844 2160 7pdjv.exe 43 PID 2844 wrote to memory of 2304 2844 lfflrrx.exe 44 PID 2844 wrote to memory of 2304 2844 lfflrrx.exe 44 PID 2844 wrote to memory of 2304 2844 lfflrrx.exe 44 PID 2844 wrote to memory of 2304 2844 lfflrrx.exe 44 PID 2304 wrote to memory of 332 2304 3thtnh.exe 45 PID 2304 wrote to memory of 332 2304 3thtnh.exe 45 PID 2304 wrote to memory of 332 2304 3thtnh.exe 45 PID 2304 wrote to memory of 332 2304 3thtnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe"C:\Users\Admin\AppData\Local\Temp\d134fa96e96898f8f9ae773760844e9304d97d3224a33a4425e088c1c8e90251.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9btbnt.exec:\9btbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\djjjd.exec:\djjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xflxrxx.exec:\xflxrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ffrffxr.exec:\ffrffxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nnbthn.exec:\nnbthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\pjjdj.exec:\pjjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3vpdp.exec:\3vpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\9bnntt.exec:\9bnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vppjj.exec:\vppjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\ffrfllx.exec:\ffrfllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\bbthth.exec:\bbthth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\dvjdv.exec:\dvjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\7pdjv.exec:\7pdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\lfflrrx.exec:\lfflrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\3thtnh.exec:\3thtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\dpdvd.exec:\dpdvd.exe17⤵
- Executes dropped EXE
PID:332 -
\??\c:\1jjvj.exec:\1jjvj.exe18⤵
- Executes dropped EXE
PID:2204 -
\??\c:\fxlrflx.exec:\fxlrflx.exe19⤵
- Executes dropped EXE
PID:1732 -
\??\c:\thnntt.exec:\thnntt.exe20⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbtbnn.exec:\hbtbnn.exe21⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dpppv.exec:\dpppv.exe22⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\fllxfxx.exec:\fllxfxx.exe24⤵
- Executes dropped EXE
PID:112 -
\??\c:\httbhn.exec:\httbhn.exe25⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dvpjj.exec:\dvpjj.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5frrxxx.exec:\5frrxxx.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rxxfxxl.exec:\rxxfxxl.exe28⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tnbthb.exec:\tnbthb.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jppdj.exec:\jppdj.exe30⤵
- Executes dropped EXE
PID:296 -
\??\c:\dvjvv.exec:\dvjvv.exe31⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lffflll.exec:\lffflll.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nhtbnb.exec:\nhtbnb.exe33⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvjv.exec:\jdvjv.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9pppd.exec:\9pppd.exe35⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1rrxffr.exec:\1rrxffr.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lfllxrf.exec:\lfllxrf.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hbtbtb.exec:\hbtbtb.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5pddv.exec:\5pddv.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lfllxxf.exec:\lfllxxf.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1lffllr.exec:\1lffllr.exe41⤵
- Executes dropped EXE
PID:2176 -
\??\c:\tnbbhh.exec:\tnbbhh.exe42⤵
- Executes dropped EXE
PID:1880 -
\??\c:\9nbhtt.exec:\9nbhtt.exe43⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9vjvv.exec:\9vjvv.exe44⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jvddd.exec:\jvddd.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\fflllrr.exec:\fflllrr.exe46⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lflrflr.exec:\lflrflr.exe47⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rrffrrx.exec:\rrffrrx.exe48⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tnthtb.exec:\tnthtb.exe49⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9pjdv.exec:\9pjdv.exe50⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jvdvd.exec:\jvdvd.exe51⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7xlffff.exec:\7xlffff.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rlrfrrl.exec:\rlrfrrl.exe53⤵
- Executes dropped EXE
PID:596 -
\??\c:\xrxflrr.exec:\xrxflrr.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\htnbbb.exec:\htnbbb.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ntttbn.exec:\ntttbn.exe56⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvvvd.exec:\dvvvd.exe57⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pdvdp.exec:\pdvdp.exe58⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5xfxlff.exec:\5xfxlff.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ffffxfl.exec:\ffffxfl.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860 -
\??\c:\fxrlfrf.exec:\fxrlfrf.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbnntt.exec:\hbnntt.exe62⤵
- Executes dropped EXE
PID:636 -
\??\c:\jvvdp.exec:\jvvdp.exe63⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ddpdv.exec:\ddpdv.exe64⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llxrxxx.exec:\llxrxxx.exe65⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbthtn.exec:\hbthtn.exe66⤵PID:2260
-
\??\c:\9nhtbh.exec:\9nhtbh.exe67⤵PID:2512
-
\??\c:\vpjpj.exec:\vpjpj.exe68⤵PID:3020
-
\??\c:\vpdvj.exec:\vpdvj.exe69⤵PID:1920
-
\??\c:\xrlrfrr.exec:\xrlrfrr.exe70⤵PID:1468
-
\??\c:\fxlfrfx.exec:\fxlfrfx.exe71⤵PID:396
-
\??\c:\7tbthn.exec:\7tbthn.exe72⤵PID:1016
-
\??\c:\nhhhtb.exec:\nhhhtb.exe73⤵PID:760
-
\??\c:\dddvj.exec:\dddvj.exe74⤵PID:2448
-
\??\c:\1fxrflr.exec:\1fxrflr.exe75⤵PID:2596
-
\??\c:\lflxflx.exec:\lflxflx.exe76⤵PID:2132
-
\??\c:\bhhhnh.exec:\bhhhnh.exe77⤵PID:2772
-
\??\c:\nbhbbt.exec:\nbhbbt.exe78⤵PID:2288
-
\??\c:\ppvvd.exec:\ppvvd.exe79⤵PID:2312
-
\??\c:\1vvpv.exec:\1vvpv.exe80⤵PID:2904
-
\??\c:\flrlxrx.exec:\flrlxrx.exe81⤵PID:836
-
\??\c:\tnhhtt.exec:\tnhhtt.exe82⤵PID:2944
-
\??\c:\hntbhh.exec:\hntbhh.exe83⤵PID:2176
-
\??\c:\pjddp.exec:\pjddp.exe84⤵PID:2800
-
\??\c:\7ppdj.exec:\7ppdj.exe85⤵PID:1568
-
\??\c:\5rlrfll.exec:\5rlrfll.exe86⤵PID:2196
-
\??\c:\3ffrflx.exec:\3ffrflx.exe87⤵PID:2264
-
\??\c:\htbhbb.exec:\htbhbb.exe88⤵PID:1632
-
\??\c:\bbntht.exec:\bbntht.exe89⤵PID:2020
-
\??\c:\pjddp.exec:\pjddp.exe90⤵PID:2084
-
\??\c:\djdjj.exec:\djdjj.exe91⤵PID:852
-
\??\c:\3lrlrff.exec:\3lrlrff.exe92⤵PID:2804
-
\??\c:\bhhbbb.exec:\bhhbbb.exe93⤵PID:1868
-
\??\c:\nnbthh.exec:\nnbthh.exe94⤵PID:2796
-
\??\c:\vjjjv.exec:\vjjjv.exe95⤵PID:1700
-
\??\c:\pjvpj.exec:\pjvpj.exe96⤵PID:2416
-
\??\c:\frfxfxx.exec:\frfxfxx.exe97⤵PID:2460
-
\??\c:\xrfrlrx.exec:\xrfrlrx.exe98⤵PID:2120
-
\??\c:\9tbbhh.exec:\9tbbhh.exe99⤵PID:276
-
\??\c:\btbtbh.exec:\btbtbh.exe100⤵PID:1256
-
\??\c:\pjvvp.exec:\pjvvp.exe101⤵PID:1200
-
\??\c:\jdddj.exec:\jdddj.exe102⤵PID:2536
-
\??\c:\rfrrfrx.exec:\rfrrfrx.exe103⤵PID:860
-
\??\c:\fxlrlrl.exec:\fxlrlrl.exe104⤵PID:2556
-
\??\c:\btbhhn.exec:\btbhhn.exe105⤵PID:1652
-
\??\c:\1btbhn.exec:\1btbhn.exe106⤵PID:1712
-
\??\c:\9djjj.exec:\9djjj.exe107⤵PID:1964
-
\??\c:\jdjpv.exec:\jdjpv.exe108⤵PID:2500
-
\??\c:\9llfrxf.exec:\9llfrxf.exe109⤵PID:1928
-
\??\c:\rfrrfll.exec:\rfrrfll.exe110⤵PID:788
-
\??\c:\hnbnth.exec:\hnbnth.exe111⤵PID:1272
-
\??\c:\dvvdp.exec:\dvvdp.exe112⤵PID:3024
-
\??\c:\jjvjv.exec:\jjvjv.exe113⤵PID:2928
-
\??\c:\xrlrflr.exec:\xrlrflr.exe114⤵PID:2908
-
\??\c:\lffrfrx.exec:\lffrfrx.exe115⤵PID:2716
-
\??\c:\tthhnb.exec:\tthhnb.exe116⤵PID:2448
-
\??\c:\hhhtnn.exec:\hhhtnn.exe117⤵PID:2972
-
\??\c:\vpppd.exec:\vpppd.exe118⤵PID:2132
-
\??\c:\dvpvd.exec:\dvpvd.exe119⤵PID:2624
-
\??\c:\xrxfrfl.exec:\xrxfrfl.exe120⤵PID:2588
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe121⤵PID:2876
-
\??\c:\nnhbth.exec:\nnhbth.exe122⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-