Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82bf70fee4f0aa98319c90c7afcc1710N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
82bf70fee4f0aa98319c90c7afcc1710N.exe
-
Size
249KB
-
MD5
82bf70fee4f0aa98319c90c7afcc1710
-
SHA1
43252046ee1c38a93d765ceb03e4824434320d62
-
SHA256
f05a90a3e75924908edf946feaad95c62c6bab996f1116798e5700f222c2365e
-
SHA512
b518d3a4bd941a8d0f4cbcb741ddf6efcbecc367a8d089251a123941559595a75298706575aa4695ca0d11799399717e47ed591053e6de089381b3a3aef5fc74
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRlg:n3C9uD6AUDCa4NYmRy
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2416 xrxflrt.exe 2176 bnbhnt.exe 1684 vjdpv.exe 2300 xrfffff.exe 2884 pjvjv.exe 2620 dvjdj.exe 2928 rlxflll.exe 2784 hbhthh.exe 2656 jdpdp.exe 2664 lfxflfl.exe 1104 bntttb.exe 1404 vjvvj.exe 1248 pdjdv.exe 2440 frxrlll.exe 328 hbtttt.exe 1920 djdvd.exe 1660 9dpvj.exe 1704 7xrrxxf.exe 2976 5btbhh.exe 2240 7vddd.exe 2364 ddjvp.exe 3024 rrlxfxx.exe 1120 bbbhhb.exe 828 9djjj.exe 2504 xxrrllr.exe 1244 9lfrrff.exe 3052 5ppdd.exe 2532 lflxxlx.exe 1944 xfrfflr.exe 884 hbthnb.exe 2112 dvpjj.exe 592 3xfxxrl.exe 2200 xlxxfxl.exe 1644 3bnntt.exe 1504 hbtttt.exe 2324 pvdjv.exe 2852 jdpdj.exe 3020 rrrlrxl.exe 2848 bttbhb.exe 2732 tbbtnh.exe 2640 3pjpv.exe 2752 5vddd.exe 2628 9rrrfll.exe 2000 5xllrxl.exe 584 hbbtnn.exe 636 jvvjj.exe 1880 jdvvd.exe 1032 rrflfxf.exe 792 fllfflx.exe 628 bhbntn.exe 2352 jdvjj.exe 1448 vjvvd.exe 1920 fxllxxl.exe 2908 xllrllr.exe 2932 btnthb.exe 2948 htbhhh.exe 2976 jjvjv.exe 1908 lrrxlxr.exe 3064 btthhn.exe 888 5ttnnn.exe 448 7jvdp.exe 3036 lxlrflx.exe 324 lfrflrx.exe 2504 5xrxffl.exe -
resource yara_rule behavioral1/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-254-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82bf70fee4f0aa98319c90c7afcc1710N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2416 1724 82bf70fee4f0aa98319c90c7afcc1710N.exe 30 PID 1724 wrote to memory of 2416 1724 82bf70fee4f0aa98319c90c7afcc1710N.exe 30 PID 1724 wrote to memory of 2416 1724 82bf70fee4f0aa98319c90c7afcc1710N.exe 30 PID 1724 wrote to memory of 2416 1724 82bf70fee4f0aa98319c90c7afcc1710N.exe 30 PID 2416 wrote to memory of 2176 2416 xrxflrt.exe 31 PID 2416 wrote to memory of 2176 2416 xrxflrt.exe 31 PID 2416 wrote to memory of 2176 2416 xrxflrt.exe 31 PID 2416 wrote to memory of 2176 2416 xrxflrt.exe 31 PID 2176 wrote to memory of 1684 2176 bnbhnt.exe 32 PID 2176 wrote to memory of 1684 2176 bnbhnt.exe 32 PID 2176 wrote to memory of 1684 2176 bnbhnt.exe 32 PID 2176 wrote to memory of 1684 2176 bnbhnt.exe 32 PID 1684 wrote to memory of 2300 1684 vjdpv.exe 33 PID 1684 wrote to memory of 2300 1684 vjdpv.exe 33 PID 1684 wrote to memory of 2300 1684 vjdpv.exe 33 PID 1684 wrote to memory of 2300 1684 vjdpv.exe 33 PID 2300 wrote to memory of 2884 2300 xrfffff.exe 34 PID 2300 wrote to memory of 2884 2300 xrfffff.exe 34 PID 2300 wrote to memory of 2884 2300 xrfffff.exe 34 PID 2300 wrote to memory of 2884 2300 xrfffff.exe 34 PID 2884 wrote to memory of 2620 2884 pjvjv.exe 35 PID 2884 wrote to memory of 2620 2884 pjvjv.exe 35 PID 2884 wrote to memory of 2620 2884 pjvjv.exe 35 PID 2884 wrote to memory of 2620 2884 pjvjv.exe 35 PID 2620 wrote to memory of 2928 2620 dvjdj.exe 36 PID 2620 wrote to memory of 2928 2620 dvjdj.exe 36 PID 2620 wrote to memory of 2928 2620 dvjdj.exe 36 PID 2620 wrote to memory of 2928 2620 dvjdj.exe 36 PID 2928 wrote to memory of 2784 2928 rlxflll.exe 37 PID 2928 wrote to memory of 2784 2928 rlxflll.exe 37 PID 2928 wrote to memory of 2784 2928 rlxflll.exe 37 PID 2928 wrote to memory of 2784 2928 rlxflll.exe 37 PID 2784 wrote to memory of 2656 2784 hbhthh.exe 38 PID 2784 wrote to memory of 2656 2784 hbhthh.exe 38 PID 2784 wrote to memory of 2656 2784 hbhthh.exe 38 PID 2784 wrote to memory of 2656 2784 hbhthh.exe 38 PID 2656 wrote to memory of 2664 2656 jdpdp.exe 39 PID 2656 wrote to memory of 2664 2656 jdpdp.exe 39 PID 2656 wrote to memory of 2664 2656 jdpdp.exe 39 PID 2656 wrote to memory of 2664 2656 jdpdp.exe 39 PID 2664 wrote to memory of 1104 2664 lfxflfl.exe 40 PID 2664 wrote to memory of 1104 2664 lfxflfl.exe 40 PID 2664 wrote to memory of 1104 2664 lfxflfl.exe 40 PID 2664 wrote to memory of 1104 2664 lfxflfl.exe 40 PID 1104 wrote to memory of 1404 1104 bntttb.exe 41 PID 1104 wrote to memory of 1404 1104 bntttb.exe 41 PID 1104 wrote to memory of 1404 1104 bntttb.exe 41 PID 1104 wrote to memory of 1404 1104 bntttb.exe 41 PID 1404 wrote to memory of 1248 1404 vjvvj.exe 42 PID 1404 wrote to memory of 1248 1404 vjvvj.exe 42 PID 1404 wrote to memory of 1248 1404 vjvvj.exe 42 PID 1404 wrote to memory of 1248 1404 vjvvj.exe 42 PID 1248 wrote to memory of 2440 1248 pdjdv.exe 43 PID 1248 wrote to memory of 2440 1248 pdjdv.exe 43 PID 1248 wrote to memory of 2440 1248 pdjdv.exe 43 PID 1248 wrote to memory of 2440 1248 pdjdv.exe 43 PID 2440 wrote to memory of 328 2440 frxrlll.exe 44 PID 2440 wrote to memory of 328 2440 frxrlll.exe 44 PID 2440 wrote to memory of 328 2440 frxrlll.exe 44 PID 2440 wrote to memory of 328 2440 frxrlll.exe 44 PID 328 wrote to memory of 1920 328 hbtttt.exe 45 PID 328 wrote to memory of 1920 328 hbtttt.exe 45 PID 328 wrote to memory of 1920 328 hbtttt.exe 45 PID 328 wrote to memory of 1920 328 hbtttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\82bf70fee4f0aa98319c90c7afcc1710N.exe"C:\Users\Admin\AppData\Local\Temp\82bf70fee4f0aa98319c90c7afcc1710N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\xrxflrt.exec:\xrxflrt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\bnbhnt.exec:\bnbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\vjdpv.exec:\vjdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\xrfffff.exec:\xrfffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\pjvjv.exec:\pjvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dvjdj.exec:\dvjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rlxflll.exec:\rlxflll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\hbhthh.exec:\hbhthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jdpdp.exec:\jdpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\lfxflfl.exec:\lfxflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bntttb.exec:\bntttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\vjvvj.exec:\vjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\pdjdv.exec:\pdjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\frxrlll.exec:\frxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hbtttt.exec:\hbtttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\djdvd.exec:\djdvd.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9dpvj.exec:\9dpvj.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7xrrxxf.exec:\7xrrxxf.exe19⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5btbhh.exec:\5btbhh.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7vddd.exec:\7vddd.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ddjvp.exec:\ddjvp.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rrlxfxx.exec:\rrlxfxx.exe23⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bbbhhb.exec:\bbbhhb.exe24⤵
- Executes dropped EXE
PID:1120 -
\??\c:\9djjj.exec:\9djjj.exe25⤵
- Executes dropped EXE
PID:828 -
\??\c:\xxrrllr.exec:\xxrrllr.exe26⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9lfrrff.exec:\9lfrrff.exe27⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5ppdd.exec:\5ppdd.exe28⤵
- Executes dropped EXE
PID:3052 -
\??\c:\lflxxlx.exec:\lflxxlx.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xfrfflr.exec:\xfrfflr.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hbthnb.exec:\hbthnb.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\dvpjj.exec:\dvpjj.exe32⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3xfxxrl.exec:\3xfxxrl.exe33⤵
- Executes dropped EXE
PID:592 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3bnntt.exec:\3bnntt.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hbtttt.exec:\hbtttt.exe36⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pvdjv.exec:\pvdjv.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jdpdj.exec:\jdpdj.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrrlrxl.exec:\rrrlrxl.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bttbhb.exec:\bttbhb.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tbbtnh.exec:\tbbtnh.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3pjpv.exec:\3pjpv.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5vddd.exec:\5vddd.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9rrrfll.exec:\9rrrfll.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5xllrxl.exec:\5xllrxl.exe45⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hbbtnn.exec:\hbbtnn.exe46⤵
- Executes dropped EXE
PID:584 -
\??\c:\jvvjj.exec:\jvvjj.exe47⤵
- Executes dropped EXE
PID:636 -
\??\c:\jdvvd.exec:\jdvvd.exe48⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rrflfxf.exec:\rrflfxf.exe49⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fllfflx.exec:\fllfflx.exe50⤵
- Executes dropped EXE
PID:792 -
\??\c:\bhbntn.exec:\bhbntn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628 -
\??\c:\jdvjj.exec:\jdvjj.exe52⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vjvvd.exec:\vjvvd.exe53⤵
- Executes dropped EXE
PID:1448 -
\??\c:\fxllxxl.exec:\fxllxxl.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xllrllr.exec:\xllrllr.exe55⤵
- Executes dropped EXE
PID:2908 -
\??\c:\btnthb.exec:\btnthb.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\htbhhh.exec:\htbhhh.exe57⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jjvjv.exec:\jjvjv.exe58⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lrrxlxr.exec:\lrrxlxr.exe59⤵
- Executes dropped EXE
PID:1908 -
\??\c:\btthhn.exec:\btthhn.exe60⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5ttnnn.exec:\5ttnnn.exe61⤵
- Executes dropped EXE
PID:888 -
\??\c:\7jvdp.exec:\7jvdp.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\lxlrflx.exec:\lxlrflx.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lfrflrx.exec:\lfrflrx.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\5xrxffl.exec:\5xrxffl.exe65⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3bhhtt.exec:\3bhhtt.exe66⤵PID:1632
-
\??\c:\5pddv.exec:\5pddv.exe67⤵PID:2380
-
\??\c:\5pjpp.exec:\5pjpp.exe68⤵PID:3052
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe69⤵PID:1088
-
\??\c:\lffllll.exec:\lffllll.exe70⤵PID:1924
-
\??\c:\nhthhn.exec:\nhthhn.exe71⤵PID:2360
-
\??\c:\ppjpp.exec:\ppjpp.exe72⤵PID:2368
-
\??\c:\jdjvd.exec:\jdjvd.exe73⤵PID:2284
-
\??\c:\rrfrfrl.exec:\rrfrfrl.exe74⤵PID:2692
-
\??\c:\ffrrflf.exec:\ffrrflf.exe75⤵PID:2800
-
\??\c:\nhbntn.exec:\nhbntn.exe76⤵PID:2332
-
\??\c:\nbbnbb.exec:\nbbnbb.exe77⤵PID:1540
-
\??\c:\9vdvd.exec:\9vdvd.exe78⤵PID:2016
-
\??\c:\jjdjv.exec:\jjdjv.exe79⤵PID:2860
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe80⤵PID:2768
-
\??\c:\xrxxlfr.exec:\xrxxlfr.exe81⤵PID:2820
-
\??\c:\hbtbhn.exec:\hbtbhn.exe82⤵PID:2732
-
\??\c:\vpdjj.exec:\vpdjj.exe83⤵PID:2640
-
\??\c:\jdvjv.exec:\jdvjv.exe84⤵PID:2728
-
\??\c:\rrffllx.exec:\rrffllx.exe85⤵PID:2676
-
\??\c:\bbnttt.exec:\bbnttt.exe86⤵PID:2000
-
\??\c:\bbhbnn.exec:\bbhbnn.exe87⤵PID:2212
-
\??\c:\5pvvd.exec:\5pvvd.exe88⤵PID:636
-
\??\c:\dvjpp.exec:\dvjpp.exe89⤵PID:916
-
\??\c:\xlxlllx.exec:\xlxlllx.exe90⤵PID:1404
-
\??\c:\nbntbb.exec:\nbntbb.exe91⤵PID:2920
-
\??\c:\nbtttb.exec:\nbtttb.exe92⤵PID:628
-
\??\c:\dpdjp.exec:\dpdjp.exe93⤵PID:1496
-
\??\c:\jpjpv.exec:\jpjpv.exe94⤵PID:1012
-
\??\c:\xlxfffl.exec:\xlxfffl.exe95⤵PID:1836
-
\??\c:\9bnntn.exec:\9bnntn.exe96⤵PID:2908
-
\??\c:\nhtttt.exec:\nhtttt.exe97⤵PID:2980
-
\??\c:\dvjvd.exec:\dvjvd.exe98⤵PID:2948
-
\??\c:\jjvvp.exec:\jjvvp.exe99⤵PID:2292
-
\??\c:\lxrfffr.exec:\lxrfffr.exe100⤵PID:2120
-
\??\c:\rfrfrxr.exec:\rfrfrxr.exe101⤵PID:3024
-
\??\c:\7nbbtn.exec:\7nbbtn.exe102⤵PID:408
-
\??\c:\dvpjv.exec:\dvpjv.exe103⤵PID:448
-
\??\c:\5vdvp.exec:\5vdvp.exe104⤵PID:3036
-
\??\c:\9frrxxf.exec:\9frrxxf.exe105⤵PID:856
-
\??\c:\btbnth.exec:\btbnth.exe106⤵PID:2504
-
\??\c:\jjdpd.exec:\jjdpd.exe107⤵PID:1604
-
\??\c:\pvvdp.exec:\pvvdp.exe108⤵PID:2380
-
\??\c:\xrfxxrf.exec:\xrfxxrf.exe109⤵PID:1596
-
\??\c:\llllxxr.exec:\llllxxr.exe110⤵PID:1420
-
\??\c:\nbttnh.exec:\nbttnh.exe111⤵PID:1928
-
\??\c:\9vddp.exec:\9vddp.exe112⤵PID:2360
-
\??\c:\pjpvj.exec:\pjpvj.exe113⤵PID:2396
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe114⤵PID:2284
-
\??\c:\lrrfxlx.exec:\lrrfxlx.exe115⤵PID:1680
-
\??\c:\hbthth.exec:\hbthth.exe116⤵PID:2704
-
\??\c:\9pjvj.exec:\9pjvj.exe117⤵
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\vvvpd.exec:\vvvpd.exe118⤵PID:2868
-
\??\c:\lfxxfrl.exec:\lfxxfrl.exe119⤵PID:2324
-
\??\c:\htntnh.exec:\htntnh.exe120⤵PID:2860
-
\??\c:\vdppp.exec:\vdppp.exe121⤵
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\vjvjv.exec:\vjvjv.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-