Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7a052c606ae90eea024aba8758fe4680N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
7a052c606ae90eea024aba8758fe4680N.exe
-
Size
249KB
-
MD5
7a052c606ae90eea024aba8758fe4680
-
SHA1
de926d61996ea48085a2db620d2c6cefb0ab429b
-
SHA256
cc7b0d979fb2e790a08744a9183d31406b616998fbc5a23ce298172e25b60e72
-
SHA512
78faf30e6b7206c3c1e0ac0a9c169f7982bf4303a1ab788f4072fd75fbe10c79190c3ee3003611fd26e0df95ef8834d31e3accd060182c9ea8337c0c071e18d3
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRlin:n3C9uD6AUDCa4NYmRMn
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2032-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 7lrxxfl.exe 1368 5btthb.exe 2180 ffxfllf.exe 2752 fflfllr.exe 2964 bnbhbb.exe 2700 7pjjv.exe 1920 hbtntt.exe 2572 5nnbhn.exe 3064 fxrxlrx.exe 2436 nbtthh.exe 1120 jpdjp.exe 2776 1flfrlr.exe 1984 bntbbb.exe 952 jvvvv.exe 1612 7rlrfll.exe 2940 hbnntt.exe 2236 vppdj.exe 2140 dvjdp.exe 2072 lxrxfll.exe 448 pjvdp.exe 2880 dpddj.exe 1044 1rfflll.exe 2168 jdvdj.exe 1632 pdvdp.exe 2116 1lxfffx.exe 2160 3bhnnh.exe 300 pdjpp.exe 1020 3htntt.exe 2952 nhbtbh.exe 2032 7pjpp.exe 1616 1frlrlr.exe 1708 7nbbbt.exe 2324 hbhhtb.exe 2228 dvjjj.exe 2764 rffrlll.exe 2644 rlfxllx.exe 2812 nhtbnn.exe 2656 nbnbhn.exe 2832 dvddj.exe 2556 vvvjj.exe 2560 xrrxfrl.exe 3044 3btbbb.exe 2192 nbtttt.exe 1888 5pddd.exe 1436 7ffxxxx.exe 1800 xlxrffr.exe 2776 3httbb.exe 340 5bbbhn.exe 1524 pjvjp.exe 2920 rlxflrf.exe 2728 xlrrffl.exe 1924 ntnntt.exe 2388 hbtbnn.exe 2148 vpdjj.exe 1476 vjvvd.exe 760 3rxflfl.exe 1736 hbnhnn.exe 2896 5hnthh.exe 1152 7vddd.exe 1648 5rxrrrx.exe 1892 rxxrfxx.exe 1548 7xrflfl.exe 2100 thnntt.exe 2400 dvvvj.exe -
resource yara_rule behavioral1/memory/2032-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2836 2032 7a052c606ae90eea024aba8758fe4680N.exe 31 PID 2032 wrote to memory of 2836 2032 7a052c606ae90eea024aba8758fe4680N.exe 31 PID 2032 wrote to memory of 2836 2032 7a052c606ae90eea024aba8758fe4680N.exe 31 PID 2032 wrote to memory of 2836 2032 7a052c606ae90eea024aba8758fe4680N.exe 31 PID 2836 wrote to memory of 1368 2836 7lrxxfl.exe 32 PID 2836 wrote to memory of 1368 2836 7lrxxfl.exe 32 PID 2836 wrote to memory of 1368 2836 7lrxxfl.exe 32 PID 2836 wrote to memory of 1368 2836 7lrxxfl.exe 32 PID 1368 wrote to memory of 2180 1368 5btthb.exe 33 PID 1368 wrote to memory of 2180 1368 5btthb.exe 33 PID 1368 wrote to memory of 2180 1368 5btthb.exe 33 PID 1368 wrote to memory of 2180 1368 5btthb.exe 33 PID 2180 wrote to memory of 2752 2180 ffxfllf.exe 34 PID 2180 wrote to memory of 2752 2180 ffxfllf.exe 34 PID 2180 wrote to memory of 2752 2180 ffxfllf.exe 34 PID 2180 wrote to memory of 2752 2180 ffxfllf.exe 34 PID 2752 wrote to memory of 2964 2752 fflfllr.exe 35 PID 2752 wrote to memory of 2964 2752 fflfllr.exe 35 PID 2752 wrote to memory of 2964 2752 fflfllr.exe 35 PID 2752 wrote to memory of 2964 2752 fflfllr.exe 35 PID 2964 wrote to memory of 2700 2964 bnbhbb.exe 36 PID 2964 wrote to memory of 2700 2964 bnbhbb.exe 36 PID 2964 wrote to memory of 2700 2964 bnbhbb.exe 36 PID 2964 wrote to memory of 2700 2964 bnbhbb.exe 36 PID 2700 wrote to memory of 1920 2700 7pjjv.exe 37 PID 2700 wrote to memory of 1920 2700 7pjjv.exe 37 PID 2700 wrote to memory of 1920 2700 7pjjv.exe 37 PID 2700 wrote to memory of 1920 2700 7pjjv.exe 37 PID 1920 wrote to memory of 2572 1920 hbtntt.exe 38 PID 1920 wrote to memory of 2572 1920 hbtntt.exe 38 PID 1920 wrote to memory of 2572 1920 hbtntt.exe 38 PID 1920 wrote to memory of 2572 1920 hbtntt.exe 38 PID 2572 wrote to memory of 3064 2572 5nnbhn.exe 39 PID 2572 wrote to memory of 3064 2572 5nnbhn.exe 39 PID 2572 wrote to memory of 3064 2572 5nnbhn.exe 39 PID 2572 wrote to memory of 3064 2572 5nnbhn.exe 39 PID 3064 wrote to memory of 2436 3064 fxrxlrx.exe 40 PID 3064 wrote to memory of 2436 3064 fxrxlrx.exe 40 PID 3064 wrote to memory of 2436 3064 fxrxlrx.exe 40 PID 3064 wrote to memory of 2436 3064 fxrxlrx.exe 40 PID 2436 wrote to memory of 1120 2436 nbtthh.exe 41 PID 2436 wrote to memory of 1120 2436 nbtthh.exe 41 PID 2436 wrote to memory of 1120 2436 nbtthh.exe 41 PID 2436 wrote to memory of 1120 2436 nbtthh.exe 41 PID 1120 wrote to memory of 2776 1120 jpdjp.exe 42 PID 1120 wrote to memory of 2776 1120 jpdjp.exe 42 PID 1120 wrote to memory of 2776 1120 jpdjp.exe 42 PID 1120 wrote to memory of 2776 1120 jpdjp.exe 42 PID 2776 wrote to memory of 1984 2776 1flfrlr.exe 43 PID 2776 wrote to memory of 1984 2776 1flfrlr.exe 43 PID 2776 wrote to memory of 1984 2776 1flfrlr.exe 43 PID 2776 wrote to memory of 1984 2776 1flfrlr.exe 43 PID 1984 wrote to memory of 952 1984 bntbbb.exe 44 PID 1984 wrote to memory of 952 1984 bntbbb.exe 44 PID 1984 wrote to memory of 952 1984 bntbbb.exe 44 PID 1984 wrote to memory of 952 1984 bntbbb.exe 44 PID 952 wrote to memory of 1612 952 jvvvv.exe 45 PID 952 wrote to memory of 1612 952 jvvvv.exe 45 PID 952 wrote to memory of 1612 952 jvvvv.exe 45 PID 952 wrote to memory of 1612 952 jvvvv.exe 45 PID 1612 wrote to memory of 2940 1612 7rlrfll.exe 46 PID 1612 wrote to memory of 2940 1612 7rlrfll.exe 46 PID 1612 wrote to memory of 2940 1612 7rlrfll.exe 46 PID 1612 wrote to memory of 2940 1612 7rlrfll.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a052c606ae90eea024aba8758fe4680N.exe"C:\Users\Admin\AppData\Local\Temp\7a052c606ae90eea024aba8758fe4680N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\7lrxxfl.exec:\7lrxxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\5btthb.exec:\5btthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\ffxfllf.exec:\ffxfllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\fflfllr.exec:\fflfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bnbhbb.exec:\bnbhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7pjjv.exec:\7pjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hbtntt.exec:\hbtntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\5nnbhn.exec:\5nnbhn.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\nbtthh.exec:\nbtthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jpdjp.exec:\jpdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\1flfrlr.exec:\1flfrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\bntbbb.exec:\bntbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jvvvv.exec:\jvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\7rlrfll.exec:\7rlrfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\hbnntt.exec:\hbnntt.exe17⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vppdj.exec:\vppdj.exe18⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dvjdp.exec:\dvjdp.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lxrxfll.exec:\lxrxfll.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjvdp.exec:\pjvdp.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\dpddj.exec:\dpddj.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1rfflll.exec:\1rfflll.exe23⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdvdj.exec:\jdvdj.exe24⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pdvdp.exec:\pdvdp.exe25⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1lxfffx.exec:\1lxfffx.exe26⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3bhnnh.exec:\3bhnnh.exe27⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pdjpp.exec:\pdjpp.exe28⤵
- Executes dropped EXE
PID:300 -
\??\c:\3htntt.exec:\3htntt.exe29⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nhbtbh.exec:\nhbtbh.exe30⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7pjpp.exec:\7pjpp.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1frlrlr.exec:\1frlrlr.exe32⤵
- Executes dropped EXE
PID:1616 -
\??\c:\7nbbbt.exec:\7nbbbt.exe33⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hbhhtb.exec:\hbhhtb.exe34⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dvjjj.exec:\dvjjj.exe35⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rffrlll.exec:\rffrlll.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rlfxllx.exec:\rlfxllx.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nhtbnn.exec:\nhtbnn.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nbnbhn.exec:\nbnbhn.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvddj.exec:\dvddj.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvvjj.exec:\vvvjj.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xrrxfrl.exec:\xrrxfrl.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3btbbb.exec:\3btbbb.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nbtttt.exec:\nbtttt.exe44⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5pddd.exec:\5pddd.exe45⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7ffxxxx.exec:\7ffxxxx.exe46⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xlxrffr.exec:\xlxrffr.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3httbb.exec:\3httbb.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5bbbhn.exec:\5bbbhn.exe49⤵
- Executes dropped EXE
PID:340 -
\??\c:\pjvjp.exec:\pjvjp.exe50⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rlxflrf.exec:\rlxflrf.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xlrrffl.exec:\xlrrffl.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ntnntt.exec:\ntnntt.exe53⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hbtbnn.exec:\hbtbnn.exe54⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpdjj.exec:\vpdjj.exe55⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vjvvd.exec:\vjvvd.exe56⤵
- Executes dropped EXE
PID:1476 -
\??\c:\3rxflfl.exec:\3rxflfl.exe57⤵
- Executes dropped EXE
PID:760 -
\??\c:\hbnhnn.exec:\hbnhnn.exe58⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5hnthh.exec:\5hnthh.exe59⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7vddd.exec:\7vddd.exe60⤵
- Executes dropped EXE
PID:1152 -
\??\c:\5rxrrrx.exec:\5rxrrrx.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rxxrfxx.exec:\rxxrfxx.exe62⤵
- Executes dropped EXE
PID:1892 -
\??\c:\7xrflfl.exec:\7xrflfl.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\thnntt.exec:\thnntt.exe64⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvvvj.exec:\dvvvj.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1jpvv.exec:\1jpvv.exe66⤵PID:1560
-
\??\c:\ffrxrrl.exec:\ffrxrrl.exe67⤵PID:2088
-
\??\c:\rlrxllr.exec:\rlrxllr.exe68⤵PID:3008
-
\??\c:\nhnnbb.exec:\nhnnbb.exe69⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\3htbtt.exec:\3htbtt.exe70⤵PID:2472
-
\??\c:\1dvjp.exec:\1dvjp.exe71⤵PID:1512
-
\??\c:\1lflrrf.exec:\1lflrrf.exe72⤵PID:2648
-
\??\c:\lfrxffl.exec:\lfrxffl.exe73⤵PID:2688
-
\??\c:\bnhnbb.exec:\bnhnbb.exe74⤵PID:2180
-
\??\c:\hhtbtt.exec:\hhtbtt.exe75⤵PID:2548
-
\??\c:\dpppv.exec:\dpppv.exe76⤵PID:2816
-
\??\c:\jdpdp.exec:\jdpdp.exe77⤵PID:2576
-
\??\c:\xrxfrlx.exec:\xrxfrlx.exe78⤵PID:2564
-
\??\c:\rflxfrx.exec:\rflxfrx.exe79⤵PID:2652
-
\??\c:\bthntb.exec:\bthntb.exe80⤵PID:2660
-
\??\c:\5dvpp.exec:\5dvpp.exe81⤵PID:2592
-
\??\c:\dvdjj.exec:\dvdjj.exe82⤵PID:2056
-
\??\c:\fxllxxl.exec:\fxllxxl.exe83⤵PID:2272
-
\??\c:\xrfrlfl.exec:\xrfrlfl.exe84⤵PID:2608
-
\??\c:\tntthh.exec:\tntthh.exe85⤵PID:1884
-
\??\c:\jdvdv.exec:\jdvdv.exe86⤵PID:1652
-
\??\c:\jvppd.exec:\jvppd.exe87⤵PID:1908
-
\??\c:\lxrlllx.exec:\lxrlllx.exe88⤵PID:1912
-
\??\c:\rlrrffr.exec:\rlrrffr.exe89⤵PID:952
-
\??\c:\tnbhnn.exec:\tnbhnn.exe90⤵PID:2852
-
\??\c:\vpdjp.exec:\vpdjp.exe91⤵PID:2872
-
\??\c:\jdpvd.exec:\jdpvd.exe92⤵PID:1964
-
\??\c:\5fffrfl.exec:\5fffrfl.exe93⤵PID:2916
-
\??\c:\xfrrrlr.exec:\xfrrrlr.exe94⤵PID:1576
-
\??\c:\bttbnt.exec:\bttbnt.exe95⤵PID:1156
-
\??\c:\3vpdj.exec:\3vpdj.exe96⤵PID:1080
-
\??\c:\pjdjv.exec:\pjdjv.exe97⤵PID:980
-
\??\c:\xrfflrf.exec:\xrfflrf.exe98⤵PID:832
-
\??\c:\rrxflxl.exec:\rrxflxl.exe99⤵PID:1580
-
\??\c:\tnbttn.exec:\tnbttn.exe100⤵PID:2168
-
\??\c:\pdjpp.exec:\pdjpp.exe101⤵PID:700
-
\??\c:\dppjp.exec:\dppjp.exe102⤵PID:2116
-
\??\c:\flxxflf.exec:\flxxflf.exe103⤵PID:3024
-
\??\c:\rflrxrr.exec:\rflrxrr.exe104⤵PID:1412
-
\??\c:\hhtthh.exec:\hhtthh.exe105⤵PID:1668
-
\??\c:\dvvjp.exec:\dvvjp.exe106⤵PID:872
-
\??\c:\pjpvj.exec:\pjpvj.exe107⤵PID:2312
-
\??\c:\1xffrxf.exec:\1xffrxf.exe108⤵PID:2332
-
\??\c:\5bttbh.exec:\5bttbh.exe109⤵PID:1516
-
\??\c:\nnhbnn.exec:\nnhbnn.exe110⤵PID:2720
-
\??\c:\9dpdj.exec:\9dpdj.exe111⤵PID:2340
-
\??\c:\vvvpd.exec:\vvvpd.exe112⤵PID:2428
-
\??\c:\xrflrfl.exec:\xrflrfl.exe113⤵PID:2684
-
\??\c:\tnntnn.exec:\tnntnn.exe114⤵PID:2960
-
\??\c:\hbthtt.exec:\hbthtt.exe115⤵PID:2568
-
\??\c:\jvpdv.exec:\jvpdv.exe116⤵PID:2732
-
\??\c:\ddvpd.exec:\ddvpd.exe117⤵PID:2588
-
\??\c:\xrffllf.exec:\xrffllf.exe118⤵PID:2564
-
\??\c:\9rrffxl.exec:\9rrffxl.exe119⤵PID:2604
-
\??\c:\nnhbbh.exec:\nnhbbh.exe120⤵PID:2552
-
\??\c:\1bnthn.exec:\1bnthn.exe121⤵PID:3048
-
\??\c:\vpjpj.exec:\vpjpj.exe122⤵PID:1904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-