Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 08:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c9e7780cef3b232ce9d4ebf13bbc6f10N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
c9e7780cef3b232ce9d4ebf13bbc6f10N.exe
-
Size
63KB
-
MD5
c9e7780cef3b232ce9d4ebf13bbc6f10
-
SHA1
3b27de6970169396ad39d1552444ee632a308117
-
SHA256
4610b4a5b1c8426b11db18a751258992b3f4978706aaa81182637b6667e9e6c6
-
SHA512
d75477827677e8e07feb0ef4510b0c5dd2bafcb10d018373cb9b4ca852052d07788e4cff92d5f50702bb0ccf0f124224fdc6aec706617eda83cef65c475747cc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRT:ymb3NkkiQ3mdBjFIje5
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2388-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2084 dvdvj.exe 2536 fxflllx.exe 352 1xrxffl.exe 2708 dvvpp.exe 2980 lfffflr.exe 2640 1thtbn.exe 2764 bnnbht.exe 2656 rrflrrf.exe 2460 xrlxlrx.exe 316 bbbhtb.exe 2692 9dpdd.exe 2500 jjvpd.exe 1448 7lrxllx.exe 772 ffxlxxr.exe 1100 1bhhhn.exe 1744 pddvp.exe 3056 jdppv.exe 3040 3xlrfrx.exe 2076 rrxfxxl.exe 2364 tththh.exe 608 tbbntb.exe 2940 ppjvd.exe 1284 vpjpv.exe 1428 5xxfxxl.exe 1912 1llxffl.exe 2360 9xlfrxl.exe 1928 btnnbh.exe 1868 vjpjv.exe 1620 5ddjv.exe 2084 ffxfxrr.exe 2920 7xlfllr.exe 848 7nnbnt.exe 2228 5bbnnt.exe 2748 dvdpv.exe 2756 vpjpd.exe 2916 3dvjp.exe 2792 7fxxfrx.exe 2772 1lxrfrx.exe 2888 rlxfrrf.exe 2676 nhthnb.exe 2124 3tnttn.exe 2004 1tntnt.exe 2328 jdppd.exe 2856 9jppd.exe 2440 3lfrxfr.exe 2672 fxrxlrx.exe 2500 lfllxfl.exe 2824 5bbhbb.exe 1764 3ttnth.exe 2128 btbhnt.exe 1016 5pdvj.exe 3044 ppddv.exe 3056 rlfrrrf.exe 2304 rlxlxlx.exe 2252 tnnbth.exe 2176 tnbbbb.exe 844 nnbnhh.exe 2988 vjvjj.exe 1540 dpddp.exe 1120 xxxlllr.exe 1240 hhnntn.exe 1904 dpvdp.exe 2012 ppppd.exe 1924 pvpdj.exe -
resource yara_rule behavioral1/memory/2388-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2084 2388 c9e7780cef3b232ce9d4ebf13bbc6f10N.exe 30 PID 2388 wrote to memory of 2084 2388 c9e7780cef3b232ce9d4ebf13bbc6f10N.exe 30 PID 2388 wrote to memory of 2084 2388 c9e7780cef3b232ce9d4ebf13bbc6f10N.exe 30 PID 2388 wrote to memory of 2084 2388 c9e7780cef3b232ce9d4ebf13bbc6f10N.exe 30 PID 2084 wrote to memory of 2536 2084 dvdvj.exe 31 PID 2084 wrote to memory of 2536 2084 dvdvj.exe 31 PID 2084 wrote to memory of 2536 2084 dvdvj.exe 31 PID 2084 wrote to memory of 2536 2084 dvdvj.exe 31 PID 2536 wrote to memory of 352 2536 fxflllx.exe 32 PID 2536 wrote to memory of 352 2536 fxflllx.exe 32 PID 2536 wrote to memory of 352 2536 fxflllx.exe 32 PID 2536 wrote to memory of 352 2536 fxflllx.exe 32 PID 352 wrote to memory of 2708 352 1xrxffl.exe 33 PID 352 wrote to memory of 2708 352 1xrxffl.exe 33 PID 352 wrote to memory of 2708 352 1xrxffl.exe 33 PID 352 wrote to memory of 2708 352 1xrxffl.exe 33 PID 2708 wrote to memory of 2980 2708 dvvpp.exe 34 PID 2708 wrote to memory of 2980 2708 dvvpp.exe 34 PID 2708 wrote to memory of 2980 2708 dvvpp.exe 34 PID 2708 wrote to memory of 2980 2708 dvvpp.exe 34 PID 2980 wrote to memory of 2640 2980 lfffflr.exe 35 PID 2980 wrote to memory of 2640 2980 lfffflr.exe 35 PID 2980 wrote to memory of 2640 2980 lfffflr.exe 35 PID 2980 wrote to memory of 2640 2980 lfffflr.exe 35 PID 2640 wrote to memory of 2764 2640 1thtbn.exe 36 PID 2640 wrote to memory of 2764 2640 1thtbn.exe 36 PID 2640 wrote to memory of 2764 2640 1thtbn.exe 36 PID 2640 wrote to memory of 2764 2640 1thtbn.exe 36 PID 2764 wrote to memory of 2656 2764 bnnbht.exe 37 PID 2764 wrote to memory of 2656 2764 bnnbht.exe 37 PID 2764 wrote to memory of 2656 2764 bnnbht.exe 37 PID 2764 wrote to memory of 2656 2764 bnnbht.exe 37 PID 2656 wrote to memory of 2460 2656 rrflrrf.exe 38 PID 2656 wrote to memory of 2460 2656 rrflrrf.exe 38 PID 2656 wrote to memory of 2460 2656 rrflrrf.exe 38 PID 2656 wrote to memory of 2460 2656 rrflrrf.exe 38 PID 2460 wrote to memory of 316 2460 xrlxlrx.exe 39 PID 2460 wrote to memory of 316 2460 xrlxlrx.exe 39 PID 2460 wrote to memory of 316 2460 xrlxlrx.exe 39 PID 2460 wrote to memory of 316 2460 xrlxlrx.exe 39 PID 316 wrote to memory of 2692 316 bbbhtb.exe 40 PID 316 wrote to memory of 2692 316 bbbhtb.exe 40 PID 316 wrote to memory of 2692 316 bbbhtb.exe 40 PID 316 wrote to memory of 2692 316 bbbhtb.exe 40 PID 2692 wrote to memory of 2500 2692 9dpdd.exe 41 PID 2692 wrote to memory of 2500 2692 9dpdd.exe 41 PID 2692 wrote to memory of 2500 2692 9dpdd.exe 41 PID 2692 wrote to memory of 2500 2692 9dpdd.exe 41 PID 2500 wrote to memory of 1448 2500 jjvpd.exe 42 PID 2500 wrote to memory of 1448 2500 jjvpd.exe 42 PID 2500 wrote to memory of 1448 2500 jjvpd.exe 42 PID 2500 wrote to memory of 1448 2500 jjvpd.exe 42 PID 1448 wrote to memory of 772 1448 7lrxllx.exe 43 PID 1448 wrote to memory of 772 1448 7lrxllx.exe 43 PID 1448 wrote to memory of 772 1448 7lrxllx.exe 43 PID 1448 wrote to memory of 772 1448 7lrxllx.exe 43 PID 772 wrote to memory of 1100 772 ffxlxxr.exe 44 PID 772 wrote to memory of 1100 772 ffxlxxr.exe 44 PID 772 wrote to memory of 1100 772 ffxlxxr.exe 44 PID 772 wrote to memory of 1100 772 ffxlxxr.exe 44 PID 1100 wrote to memory of 1744 1100 1bhhhn.exe 45 PID 1100 wrote to memory of 1744 1100 1bhhhn.exe 45 PID 1100 wrote to memory of 1744 1100 1bhhhn.exe 45 PID 1100 wrote to memory of 1744 1100 1bhhhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9e7780cef3b232ce9d4ebf13bbc6f10N.exe"C:\Users\Admin\AppData\Local\Temp\c9e7780cef3b232ce9d4ebf13bbc6f10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvdvj.exec:\dvdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\fxflllx.exec:\fxflllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1xrxffl.exec:\1xrxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\dvvpp.exec:\dvvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\lfffflr.exec:\lfffflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\1thtbn.exec:\1thtbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bnnbht.exec:\bnnbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rrflrrf.exec:\rrflrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\bbbhtb.exec:\bbbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\9dpdd.exec:\9dpdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jjvpd.exec:\jjvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\7lrxllx.exec:\7lrxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\ffxlxxr.exec:\ffxlxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\1bhhhn.exec:\1bhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\pddvp.exec:\pddvp.exe17⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jdppv.exec:\jdppv.exe18⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3xlrfrx.exec:\3xlrfrx.exe19⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rrxfxxl.exec:\rrxfxxl.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tththh.exec:\tththh.exe21⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tbbntb.exec:\tbbntb.exe22⤵
- Executes dropped EXE
PID:608 -
\??\c:\ppjvd.exec:\ppjvd.exe23⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vpjpv.exec:\vpjpv.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\5xxfxxl.exec:\5xxfxxl.exe25⤵
- Executes dropped EXE
PID:1428 -
\??\c:\1llxffl.exec:\1llxffl.exe26⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9xlfrxl.exec:\9xlfrxl.exe27⤵
- Executes dropped EXE
PID:2360 -
\??\c:\btnnbh.exec:\btnnbh.exe28⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vjpjv.exec:\vjpjv.exe29⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5ddjv.exec:\5ddjv.exe30⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ffxfxrr.exec:\ffxfxrr.exe31⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7xlfllr.exec:\7xlfllr.exe32⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7nnbnt.exec:\7nnbnt.exe33⤵
- Executes dropped EXE
PID:848 -
\??\c:\5bbnnt.exec:\5bbnnt.exe34⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvdpv.exec:\dvdpv.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vpjpd.exec:\vpjpd.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3dvjp.exec:\3dvjp.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7fxxfrx.exec:\7fxxfrx.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1lxrfrx.exec:\1lxrfrx.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nhthnb.exec:\nhthnb.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3tnttn.exec:\3tnttn.exe42⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1tntnt.exec:\1tntnt.exe43⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jdppd.exec:\jdppd.exe44⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9jppd.exec:\9jppd.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3lfrxfr.exec:\3lfrxfr.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lfllxfl.exec:\lfllxfl.exe48⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5bbhbb.exec:\5bbhbb.exe49⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3ttnth.exec:\3ttnth.exe50⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btbhnt.exec:\btbhnt.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5pdvj.exec:\5pdvj.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ppddv.exec:\ppddv.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rlfrrrf.exec:\rlfrrrf.exe54⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rlxlxlx.exec:\rlxlxlx.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tnnbth.exec:\tnnbth.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tnbbbb.exec:\tnbbbb.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nnbnhh.exec:\nnbnhh.exe58⤵
- Executes dropped EXE
PID:844 -
\??\c:\vjvjj.exec:\vjvjj.exe59⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dpddp.exec:\dpddp.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xxxlllr.exec:\xxxlllr.exe61⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hhnntn.exec:\hhnntn.exe62⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dpvdp.exec:\dpvdp.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ppppd.exec:\ppppd.exe64⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pvpdj.exec:\pvpdj.exe65⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7frllfl.exec:\7frllfl.exe66⤵PID:2300
-
\??\c:\lxlflrr.exec:\lxlflrr.exe67⤵PID:2404
-
\??\c:\3hbhbh.exec:\3hbhbh.exe68⤵PID:2572
-
\??\c:\7hbhhh.exec:\7hbhhh.exe69⤵PID:1184
-
\??\c:\7hhtbh.exec:\7hhtbh.exe70⤵PID:2536
-
\??\c:\dpddj.exec:\dpddj.exe71⤵PID:2516
-
\??\c:\jdjpp.exec:\jdjpp.exe72⤵PID:2296
-
\??\c:\5xrxrff.exec:\5xrxrff.exe73⤵PID:2812
-
\??\c:\frfffxx.exec:\frfffxx.exe74⤵PID:2748
-
\??\c:\nbbnnn.exec:\nbbnnn.exe75⤵PID:2968
-
\??\c:\thtnbh.exec:\thtnbh.exe76⤵PID:2760
-
\??\c:\ppvpj.exec:\ppvpj.exe77⤵PID:2736
-
\??\c:\jdppp.exec:\jdppp.exe78⤵PID:1932
-
\??\c:\xxxfflr.exec:\xxxfflr.exe79⤵PID:2636
-
\??\c:\rfxxfrf.exec:\rfxxfrf.exe80⤵PID:1548
-
\??\c:\thbbhn.exec:\thbbhn.exe81⤵PID:3064
-
\??\c:\nhtbht.exec:\nhtbht.exe82⤵PID:820
-
\??\c:\jjddd.exec:\jjddd.exe83⤵PID:1412
-
\??\c:\3pjvv.exec:\3pjvv.exe84⤵PID:2136
-
\??\c:\fxllrrf.exec:\fxllrrf.exe85⤵PID:388
-
\??\c:\xrrxlfr.exec:\xrrxlfr.exe86⤵PID:684
-
\??\c:\hhbnnb.exec:\hhbnnb.exe87⤵PID:2664
-
\??\c:\3hbhbh.exec:\3hbhbh.exe88⤵
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\pjpdv.exec:\pjpdv.exe89⤵PID:1900
-
\??\c:\jdvvd.exec:\jdvvd.exe90⤵PID:2936
-
\??\c:\xrxfflr.exec:\xrxfflr.exe91⤵PID:2160
-
\??\c:\fxrxffr.exec:\fxrxffr.exe92⤵PID:2244
-
\??\c:\thhnnb.exec:\thhnnb.exe93⤵PID:2108
-
\??\c:\vpdpd.exec:\vpdpd.exe94⤵PID:1616
-
\??\c:\dpdjp.exec:\dpdjp.exe95⤵PID:1700
-
\??\c:\pdpjj.exec:\pdpjj.exe96⤵PID:1464
-
\??\c:\rxxrxxx.exec:\rxxrxxx.exe97⤵PID:608
-
\??\c:\rxrfxrf.exec:\rxrfxrf.exe98⤵PID:2784
-
\??\c:\thnbhn.exec:\thnbhn.exe99⤵PID:1432
-
\??\c:\vpdvj.exec:\vpdvj.exe100⤵PID:1720
-
\??\c:\vjvjd.exec:\vjvjd.exe101⤵PID:1916
-
\??\c:\xfxlffx.exec:\xfxlffx.exe102⤵PID:1296
-
\??\c:\lrxrxrx.exec:\lrxrxrx.exe103⤵PID:1944
-
\??\c:\bthtbh.exec:\bthtbh.exe104⤵PID:2132
-
\??\c:\bnbhtn.exec:\bnbhtn.exe105⤵PID:2388
-
\??\c:\jdppd.exec:\jdppd.exe106⤵PID:2340
-
\??\c:\pjdvv.exec:\pjdvv.exe107⤵PID:1644
-
\??\c:\7pjpd.exec:\7pjpd.exe108⤵PID:2084
-
\??\c:\lfrrfff.exec:\lfrrfff.exe109⤵PID:1632
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe110⤵PID:1972
-
\??\c:\nbttbt.exec:\nbttbt.exe111⤵PID:2740
-
\??\c:\9nhhhb.exec:\9nhhhb.exe112⤵PID:2832
-
\??\c:\1pjvj.exec:\1pjvj.exe113⤵PID:2024
-
\??\c:\jvdvv.exec:\jvdvv.exe114⤵PID:2728
-
\??\c:\rxrlrrr.exec:\rxrlrrr.exe115⤵PID:1712
-
\??\c:\lxxfffl.exec:\lxxfffl.exe116⤵PID:2912
-
\??\c:\nhtbnh.exec:\nhtbnh.exe117⤵PID:2620
-
\??\c:\tntntt.exec:\tntntt.exe118⤵PID:2652
-
\??\c:\9vddv.exec:\9vddv.exe119⤵PID:2648
-
\??\c:\pdjpv.exec:\pdjpv.exe120⤵PID:668
-
\??\c:\xlrllff.exec:\xlrllff.exe121⤵PID:2000
-
\??\c:\9lllxff.exec:\9lllxff.exe122⤵PID:316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-