Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe
Resource
win7-20240903-en
General
-
Target
63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe
-
Size
78KB
-
MD5
8bee09cfc2c228897bd40f42b83b661d
-
SHA1
23167dd6efe8fc926b9609da1eef3aa90b942307
-
SHA256
63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a
-
SHA512
36274662c2b50216f47957f242b61d845e55cf91d0a77f4487266c37f4834beeee7a28d3d946d87d8c69703126c7ebca8010e801e93aa979557d0bbadcea627c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIjaQkPcy8WTeAwHSYq0:ymb3NkkiQ3mdBjFIpkPcy8qsHSH0
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2120-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 rxrffxx.exe 2388 vdjdd.exe 2056 1llffll.exe 2868 tttbth.exe 2876 5pvdp.exe 2640 jdjpv.exe 2652 nnbbnb.exe 2668 3vjdp.exe 2292 xrllxxl.exe 984 3nnbnt.exe 1716 dvpdp.exe 2144 dvpvp.exe 1896 rxxxllf.exe 2504 nbnttt.exe 1344 vjvvj.exe 1672 vvvjj.exe 2844 xrlxrxf.exe 2984 tnbthb.exe 2820 dppdp.exe 1976 ppjjv.exe 1092 ffrxlrf.exe 2472 nnhhbh.exe 1724 lrlxrff.exe 1476 lffrxxl.exe 2456 bthnbn.exe 328 pvvjj.exe 872 rrrxlxx.exe 2300 xxlrlrr.exe 2180 bthnhn.exe 2536 3vpjp.exe 764 llffrrf.exe 2480 fxlxflr.exe 708 hhnnbn.exe 632 pjvdj.exe 2924 3lxlfxr.exe 2296 rlxlxrf.exe 3024 bhttbb.exe 2628 tnbhnb.exe 2772 pdvvj.exe 2776 dvpjp.exe 2412 xffxxrr.exe 2648 rlffrlx.exe 2932 bnbbbt.exe 2360 djpdj.exe 1728 vpjvd.exe 2016 9ffrlrx.exe 1912 rrlflxl.exe 1624 tbbnnb.exe 1872 djvvj.exe 2504 9djvv.exe 2988 xrflllr.exe 2828 1xllxfr.exe 2804 nhbntb.exe 2168 1thhhh.exe 2984 ppdvd.exe 1700 vvvjj.exe 3040 rrlrxfr.exe 1448 tbttnt.exe 1092 tnbhbb.exe 2244 7jpjd.exe 1208 ppjpd.exe 1584 xlrlfxr.exe 1652 btntbn.exe 1720 vpjdv.exe -
resource yara_rule behavioral1/memory/2120-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2532 2120 63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe 31 PID 2120 wrote to memory of 2532 2120 63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe 31 PID 2120 wrote to memory of 2532 2120 63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe 31 PID 2120 wrote to memory of 2532 2120 63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe 31 PID 2532 wrote to memory of 2388 2532 rxrffxx.exe 32 PID 2532 wrote to memory of 2388 2532 rxrffxx.exe 32 PID 2532 wrote to memory of 2388 2532 rxrffxx.exe 32 PID 2532 wrote to memory of 2388 2532 rxrffxx.exe 32 PID 2388 wrote to memory of 2056 2388 vdjdd.exe 33 PID 2388 wrote to memory of 2056 2388 vdjdd.exe 33 PID 2388 wrote to memory of 2056 2388 vdjdd.exe 33 PID 2388 wrote to memory of 2056 2388 vdjdd.exe 33 PID 2056 wrote to memory of 2868 2056 1llffll.exe 34 PID 2056 wrote to memory of 2868 2056 1llffll.exe 34 PID 2056 wrote to memory of 2868 2056 1llffll.exe 34 PID 2056 wrote to memory of 2868 2056 1llffll.exe 34 PID 2868 wrote to memory of 2876 2868 tttbth.exe 35 PID 2868 wrote to memory of 2876 2868 tttbth.exe 35 PID 2868 wrote to memory of 2876 2868 tttbth.exe 35 PID 2868 wrote to memory of 2876 2868 tttbth.exe 35 PID 2876 wrote to memory of 2640 2876 5pvdp.exe 36 PID 2876 wrote to memory of 2640 2876 5pvdp.exe 36 PID 2876 wrote to memory of 2640 2876 5pvdp.exe 36 PID 2876 wrote to memory of 2640 2876 5pvdp.exe 36 PID 2640 wrote to memory of 2652 2640 jdjpv.exe 37 PID 2640 wrote to memory of 2652 2640 jdjpv.exe 37 PID 2640 wrote to memory of 2652 2640 jdjpv.exe 37 PID 2640 wrote to memory of 2652 2640 jdjpv.exe 37 PID 2652 wrote to memory of 2668 2652 nnbbnb.exe 38 PID 2652 wrote to memory of 2668 2652 nnbbnb.exe 38 PID 2652 wrote to memory of 2668 2652 nnbbnb.exe 38 PID 2652 wrote to memory of 2668 2652 nnbbnb.exe 38 PID 2668 wrote to memory of 2292 2668 3vjdp.exe 39 PID 2668 wrote to memory of 2292 2668 3vjdp.exe 39 PID 2668 wrote to memory of 2292 2668 3vjdp.exe 39 PID 2668 wrote to memory of 2292 2668 3vjdp.exe 39 PID 2292 wrote to memory of 984 2292 xrllxxl.exe 40 PID 2292 wrote to memory of 984 2292 xrllxxl.exe 40 PID 2292 wrote to memory of 984 2292 xrllxxl.exe 40 PID 2292 wrote to memory of 984 2292 xrllxxl.exe 40 PID 984 wrote to memory of 1716 984 3nnbnt.exe 41 PID 984 wrote to memory of 1716 984 3nnbnt.exe 41 PID 984 wrote to memory of 1716 984 3nnbnt.exe 41 PID 984 wrote to memory of 1716 984 3nnbnt.exe 41 PID 1716 wrote to memory of 2144 1716 dvpdp.exe 42 PID 1716 wrote to memory of 2144 1716 dvpdp.exe 42 PID 1716 wrote to memory of 2144 1716 dvpdp.exe 42 PID 1716 wrote to memory of 2144 1716 dvpdp.exe 42 PID 2144 wrote to memory of 1896 2144 dvpvp.exe 43 PID 2144 wrote to memory of 1896 2144 dvpvp.exe 43 PID 2144 wrote to memory of 1896 2144 dvpvp.exe 43 PID 2144 wrote to memory of 1896 2144 dvpvp.exe 43 PID 1896 wrote to memory of 2504 1896 rxxxllf.exe 44 PID 1896 wrote to memory of 2504 1896 rxxxllf.exe 44 PID 1896 wrote to memory of 2504 1896 rxxxllf.exe 44 PID 1896 wrote to memory of 2504 1896 rxxxllf.exe 44 PID 2504 wrote to memory of 1344 2504 nbnttt.exe 45 PID 2504 wrote to memory of 1344 2504 nbnttt.exe 45 PID 2504 wrote to memory of 1344 2504 nbnttt.exe 45 PID 2504 wrote to memory of 1344 2504 nbnttt.exe 45 PID 1344 wrote to memory of 1672 1344 vjvvj.exe 46 PID 1344 wrote to memory of 1672 1344 vjvvj.exe 46 PID 1344 wrote to memory of 1672 1344 vjvvj.exe 46 PID 1344 wrote to memory of 1672 1344 vjvvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe"C:\Users\Admin\AppData\Local\Temp\63b7ce89c421ec6a1fcd8be60ddc34fc33d92d73f9cb9145010f18faf070091a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rxrffxx.exec:\rxrffxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\vdjdd.exec:\vdjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\1llffll.exec:\1llffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\tttbth.exec:\tttbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\5pvdp.exec:\5pvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jdjpv.exec:\jdjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nnbbnb.exec:\nnbbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3vjdp.exec:\3vjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xrllxxl.exec:\xrllxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\3nnbnt.exec:\3nnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\dvpdp.exec:\dvpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\dvpvp.exec:\dvpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\rxxxllf.exec:\rxxxllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\nbnttt.exec:\nbnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vjvvj.exec:\vjvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\vvvjj.exec:\vvvjj.exe17⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrlxrxf.exec:\xrlxrxf.exe18⤵
- Executes dropped EXE
PID:2844 -
\??\c:\tnbthb.exec:\tnbthb.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dppdp.exec:\dppdp.exe20⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ppjjv.exec:\ppjjv.exe21⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe22⤵
- Executes dropped EXE
PID:1092 -
\??\c:\nnhhbh.exec:\nnhhbh.exe23⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lrlxrff.exec:\lrlxrff.exe24⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lffrxxl.exec:\lffrxxl.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bthnbn.exec:\bthnbn.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pvvjj.exec:\pvvjj.exe27⤵
- Executes dropped EXE
PID:328 -
\??\c:\rrrxlxx.exec:\rrrxlxx.exe28⤵
- Executes dropped EXE
PID:872 -
\??\c:\xxlrlrr.exec:\xxlrlrr.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bthnhn.exec:\bthnhn.exe30⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3vpjp.exec:\3vpjp.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\llffrrf.exec:\llffrrf.exe32⤵
- Executes dropped EXE
PID:764 -
\??\c:\fxlxflr.exec:\fxlxflr.exe33⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hhnnbn.exec:\hhnnbn.exe34⤵
- Executes dropped EXE
PID:708 -
\??\c:\pjvdj.exec:\pjvdj.exe35⤵
- Executes dropped EXE
PID:632 -
\??\c:\3lxlfxr.exec:\3lxlfxr.exe36⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlxlxrf.exec:\rlxlxrf.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bhttbb.exec:\bhttbb.exe38⤵
- Executes dropped EXE
PID:3024 -
\??\c:\tnbhnb.exec:\tnbhnb.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pdvvj.exec:\pdvvj.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dvpjp.exec:\dvpjp.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xffxxrr.exec:\xffxxrr.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rlffrlx.exec:\rlffrlx.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bnbbbt.exec:\bnbbbt.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\djpdj.exec:\djpdj.exe45⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vpjvd.exec:\vpjvd.exe46⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9ffrlrx.exec:\9ffrlrx.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rrlflxl.exec:\rrlflxl.exe48⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tbbnnb.exec:\tbbnnb.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\djvvj.exec:\djvvj.exe50⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9djvv.exec:\9djvv.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrflllr.exec:\xrflllr.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\1xllxfr.exec:\1xllxfr.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nhbntb.exec:\nhbntb.exe54⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1thhhh.exec:\1thhhh.exe55⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ppdvd.exec:\ppdvd.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vvvjj.exec:\vvvjj.exe57⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrlrxfr.exec:\rrlrxfr.exe58⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tbttnt.exec:\tbttnt.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tnbhbb.exec:\tnbhbb.exe60⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7jpjd.exec:\7jpjd.exe61⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ppjpd.exec:\ppjpd.exe62⤵
- Executes dropped EXE
PID:1208 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe63⤵
- Executes dropped EXE
PID:1584 -
\??\c:\btntbn.exec:\btntbn.exe64⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vpjdv.exec:\vpjdv.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vvvpp.exec:\vvvpp.exe66⤵PID:2256
-
\??\c:\lxxlrlx.exec:\lxxlrlx.exe67⤵PID:2064
-
\??\c:\rlfflrx.exec:\rlfflrx.exe68⤵PID:2684
-
\??\c:\nhbbnn.exec:\nhbbnn.exe69⤵PID:2084
-
\??\c:\vppvd.exec:\vppvd.exe70⤵PID:2348
-
\??\c:\7jjdd.exec:\7jjdd.exe71⤵PID:2544
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe72⤵PID:764
-
\??\c:\rlxlrlx.exec:\rlxlrlx.exe73⤵PID:2552
-
\??\c:\1nbnhn.exec:\1nbnhn.exe74⤵PID:2096
-
\??\c:\pvddd.exec:\pvddd.exe75⤵PID:2920
-
\??\c:\3jddp.exec:\3jddp.exe76⤵PID:2760
-
\??\c:\rrllxxf.exec:\rrllxxf.exe77⤵PID:2612
-
\??\c:\xrxlrfl.exec:\xrxlrfl.exe78⤵PID:2692
-
\??\c:\nhhtbh.exec:\nhhtbh.exe79⤵
- System Location Discovery: System Language Discovery
PID:2872 -
\??\c:\1vvjd.exec:\1vvjd.exe80⤵PID:2720
-
\??\c:\vjjjv.exec:\vjjjv.exe81⤵PID:2728
-
\??\c:\fflfxfx.exec:\fflfxfx.exe82⤵PID:824
-
\??\c:\1btbbn.exec:\1btbbn.exe83⤵PID:1292
-
\??\c:\nnthbn.exec:\nnthbn.exe84⤵PID:2020
-
\??\c:\hbbhtt.exec:\hbbhtt.exe85⤵PID:984
-
\??\c:\3vvpp.exec:\3vvpp.exe86⤵PID:1716
-
\??\c:\lxfffll.exec:\lxfffll.exe87⤵PID:2420
-
\??\c:\xflfllr.exec:\xflfllr.exe88⤵PID:1708
-
\??\c:\tnthbh.exec:\tnthbh.exe89⤵PID:1692
-
\??\c:\5tnbnt.exec:\5tnbnt.exe90⤵PID:1592
-
\??\c:\jdjvd.exec:\jdjvd.exe91⤵PID:2832
-
\??\c:\7ddjv.exec:\7ddjv.exe92⤵PID:2704
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe93⤵PID:2800
-
\??\c:\hbttht.exec:\hbttht.exe94⤵PID:2192
-
\??\c:\hhhttb.exec:\hhhttb.exe95⤵PID:2968
-
\??\c:\5ppdp.exec:\5ppdp.exe96⤵PID:2820
-
\??\c:\lxlrffl.exec:\lxlrffl.exe97⤵PID:444
-
\??\c:\rlflrlx.exec:\rlflrlx.exe98⤵PID:1556
-
\??\c:\nbhbnb.exec:\nbhbnb.exe99⤵PID:1176
-
\??\c:\jdvdv.exec:\jdvdv.exe100⤵PID:1464
-
\??\c:\ppvdv.exec:\ppvdv.exe101⤵PID:2332
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe102⤵PID:1680
-
\??\c:\5xlflll.exec:\5xlflll.exe103⤵PID:1564
-
\??\c:\hbnbhn.exec:\hbnbhn.exe104⤵PID:1352
-
\??\c:\hbhntt.exec:\hbhntt.exe105⤵PID:568
-
\??\c:\dvjjv.exec:\dvjjv.exe106⤵PID:1936
-
\??\c:\9xffxll.exec:\9xffxll.exe107⤵PID:1820
-
\??\c:\lfrfxff.exec:\lfrfxff.exe108⤵PID:876
-
\??\c:\3nbtbb.exec:\3nbtbb.exe109⤵PID:2408
-
\??\c:\ttbhtb.exec:\ttbhtb.exe110⤵PID:2520
-
\??\c:\pjvdv.exec:\pjvdv.exe111⤵PID:1552
-
\??\c:\7jvjj.exec:\7jvjj.exe112⤵PID:2072
-
\??\c:\ffxlxxf.exec:\ffxlxxf.exe113⤵PID:708
-
\??\c:\thtbhh.exec:\thtbhh.exe114⤵PID:2272
-
\??\c:\hbttht.exec:\hbttht.exe115⤵PID:2924
-
\??\c:\vdvjj.exec:\vdvjj.exe116⤵PID:2892
-
\??\c:\7vjdp.exec:\7vjdp.exe117⤵PID:3020
-
\??\c:\xlflllr.exec:\xlflllr.exe118⤵PID:2996
-
\??\c:\3bnhhn.exec:\3bnhhn.exe119⤵PID:2640
-
\??\c:\btnhhb.exec:\btnhhb.exe120⤵PID:2772
-
\??\c:\pdjjp.exec:\pdjjp.exe121⤵PID:1984
-
\??\c:\xlxxxrf.exec:\xlxxxrf.exe122⤵PID:824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-