Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe
Resource
win7-20240903-en
General
-
Target
db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe
-
Size
590KB
-
MD5
dae53a0132d9fda7de89607ef5351d80
-
SHA1
f667d33a61c10a433acab11bb7e4717f358d2eac
-
SHA256
db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693a
-
SHA512
2aa4e87015e9b9d28933d913b302c15f99faf20dbba4864102579c38f34116475b4c8b5b2cf73c1d6945cd20fcf72813d4ee2d89209067229a8d15ff7fb4ce16
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayl:n3C9Lebz+xt4vFeFmgayl
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1848-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 ddvjp.exe 2548 lfxxrrx.exe 2372 hnnnhn.exe 2084 lffxxxl.exe 2812 tbbhnb.exe 2236 1dppv.exe 2976 7xxflrx.exe 2608 hbhnbb.exe 2004 pddjv.exe 2332 1pjpv.exe 1396 pddjp.exe 2956 9xrfrxl.exe 2572 pjdjv.exe 1560 htbhnn.exe 2936 1xlfflf.exe 2376 pvvvj.exe 3004 dvpvd.exe 2216 1lxfrrf.exe 2320 fxlrxfr.exe 3060 hbnnbh.exe 1860 hntbnt.exe 544 thttbb.exe 1588 jdvvj.exe 340 rfllrrf.exe 1576 9vddj.exe 3068 ttbthh.exe 372 5pjvd.exe 2256 bhntbt.exe 1404 dvjpv.exe 1676 lfrrxxl.exe 2164 thbhnt.exe 1872 ppvvd.exe 2548 xxlrlxf.exe 1500 1vppv.exe 2552 rlxfllr.exe 2756 xllrrxf.exe 2816 bthhnh.exe 2824 ppddj.exe 3036 7vpvd.exe 2896 lflxflx.exe 2872 5tbhnt.exe 2604 jvjjp.exe 2668 1vjpp.exe 2464 xrflrfx.exe 2004 tnbhnt.exe 2888 hhhtbh.exe 1900 5djjv.exe 2956 pdpvd.exe 2692 frlxfll.exe 2672 lfrrxfl.exe 2932 ntbbhb.exe 1600 5jvjv.exe 348 9dddj.exe 1844 lfrrfxl.exe 1712 hbnthh.exe 1932 jvjpv.exe 2648 9djjp.exe 2352 xlxfllx.exe 2916 hbtbhn.exe 2788 btbhnb.exe 1128 jjddv.exe 1276 pjppd.exe 2508 xrllxfr.exe 2180 llrrxff.exe -
resource yara_rule behavioral1/memory/1848-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2696 1848 db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe 30 PID 1848 wrote to memory of 2696 1848 db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe 30 PID 1848 wrote to memory of 2696 1848 db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe 30 PID 1848 wrote to memory of 2696 1848 db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe 30 PID 2696 wrote to memory of 2548 2696 ddvjp.exe 31 PID 2696 wrote to memory of 2548 2696 ddvjp.exe 31 PID 2696 wrote to memory of 2548 2696 ddvjp.exe 31 PID 2696 wrote to memory of 2548 2696 ddvjp.exe 31 PID 2548 wrote to memory of 2372 2548 lfxxrrx.exe 32 PID 2548 wrote to memory of 2372 2548 lfxxrrx.exe 32 PID 2548 wrote to memory of 2372 2548 lfxxrrx.exe 32 PID 2548 wrote to memory of 2372 2548 lfxxrrx.exe 32 PID 2372 wrote to memory of 2084 2372 hnnnhn.exe 33 PID 2372 wrote to memory of 2084 2372 hnnnhn.exe 33 PID 2372 wrote to memory of 2084 2372 hnnnhn.exe 33 PID 2372 wrote to memory of 2084 2372 hnnnhn.exe 33 PID 2084 wrote to memory of 2812 2084 lffxxxl.exe 34 PID 2084 wrote to memory of 2812 2084 lffxxxl.exe 34 PID 2084 wrote to memory of 2812 2084 lffxxxl.exe 34 PID 2084 wrote to memory of 2812 2084 lffxxxl.exe 34 PID 2812 wrote to memory of 2236 2812 tbbhnb.exe 35 PID 2812 wrote to memory of 2236 2812 tbbhnb.exe 35 PID 2812 wrote to memory of 2236 2812 tbbhnb.exe 35 PID 2812 wrote to memory of 2236 2812 tbbhnb.exe 35 PID 2236 wrote to memory of 2976 2236 1dppv.exe 36 PID 2236 wrote to memory of 2976 2236 1dppv.exe 36 PID 2236 wrote to memory of 2976 2236 1dppv.exe 36 PID 2236 wrote to memory of 2976 2236 1dppv.exe 36 PID 2976 wrote to memory of 2608 2976 7xxflrx.exe 37 PID 2976 wrote to memory of 2608 2976 7xxflrx.exe 37 PID 2976 wrote to memory of 2608 2976 7xxflrx.exe 37 PID 2976 wrote to memory of 2608 2976 7xxflrx.exe 37 PID 2608 wrote to memory of 2004 2608 hbhnbb.exe 38 PID 2608 wrote to memory of 2004 2608 hbhnbb.exe 38 PID 2608 wrote to memory of 2004 2608 hbhnbb.exe 38 PID 2608 wrote to memory of 2004 2608 hbhnbb.exe 38 PID 2004 wrote to memory of 2332 2004 pddjv.exe 39 PID 2004 wrote to memory of 2332 2004 pddjv.exe 39 PID 2004 wrote to memory of 2332 2004 pddjv.exe 39 PID 2004 wrote to memory of 2332 2004 pddjv.exe 39 PID 2332 wrote to memory of 1396 2332 1pjpv.exe 40 PID 2332 wrote to memory of 1396 2332 1pjpv.exe 40 PID 2332 wrote to memory of 1396 2332 1pjpv.exe 40 PID 2332 wrote to memory of 1396 2332 1pjpv.exe 40 PID 1396 wrote to memory of 2956 1396 pddjp.exe 41 PID 1396 wrote to memory of 2956 1396 pddjp.exe 41 PID 1396 wrote to memory of 2956 1396 pddjp.exe 41 PID 1396 wrote to memory of 2956 1396 pddjp.exe 41 PID 2956 wrote to memory of 2572 2956 9xrfrxl.exe 42 PID 2956 wrote to memory of 2572 2956 9xrfrxl.exe 42 PID 2956 wrote to memory of 2572 2956 9xrfrxl.exe 42 PID 2956 wrote to memory of 2572 2956 9xrfrxl.exe 42 PID 2572 wrote to memory of 1560 2572 pjdjv.exe 43 PID 2572 wrote to memory of 1560 2572 pjdjv.exe 43 PID 2572 wrote to memory of 1560 2572 pjdjv.exe 43 PID 2572 wrote to memory of 1560 2572 pjdjv.exe 43 PID 1560 wrote to memory of 2936 1560 htbhnn.exe 44 PID 1560 wrote to memory of 2936 1560 htbhnn.exe 44 PID 1560 wrote to memory of 2936 1560 htbhnn.exe 44 PID 1560 wrote to memory of 2936 1560 htbhnn.exe 44 PID 2936 wrote to memory of 2376 2936 1xlfflf.exe 45 PID 2936 wrote to memory of 2376 2936 1xlfflf.exe 45 PID 2936 wrote to memory of 2376 2936 1xlfflf.exe 45 PID 2936 wrote to memory of 2376 2936 1xlfflf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe"C:\Users\Admin\AppData\Local\Temp\db7daee704fcb1f5c09a91eb100edf7487bf2cf7c450f147db7442658a0f693aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\ddvjp.exec:\ddvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lfxxrrx.exec:\lfxxrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hnnnhn.exec:\hnnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lffxxxl.exec:\lffxxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tbbhnb.exec:\tbbhnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\1dppv.exec:\1dppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\7xxflrx.exec:\7xxflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hbhnbb.exec:\hbhnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pddjv.exec:\pddjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\1pjpv.exec:\1pjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pddjp.exec:\pddjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\9xrfrxl.exec:\9xrfrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pjdjv.exec:\pjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\htbhnn.exec:\htbhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\1xlfflf.exec:\1xlfflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pvvvj.exec:\pvvvj.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dvpvd.exec:\dvpvd.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1lxfrrf.exec:\1lxfrrf.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe20⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hbnnbh.exec:\hbnnbh.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hntbnt.exec:\hntbnt.exe22⤵
- Executes dropped EXE
PID:1860 -
\??\c:\thttbb.exec:\thttbb.exe23⤵
- Executes dropped EXE
PID:544 -
\??\c:\jdvvj.exec:\jdvvj.exe24⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rfllrrf.exec:\rfllrrf.exe25⤵
- Executes dropped EXE
PID:340 -
\??\c:\9vddj.exec:\9vddj.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ttbthh.exec:\ttbthh.exe27⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5pjvd.exec:\5pjvd.exe28⤵
- Executes dropped EXE
PID:372 -
\??\c:\bhntbt.exec:\bhntbt.exe29⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dvjpv.exec:\dvjpv.exe30⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe31⤵
- Executes dropped EXE
PID:1676 -
\??\c:\thbhnt.exec:\thbhnt.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ppvvd.exec:\ppvvd.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xxlrlxf.exec:\xxlrlxf.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1vppv.exec:\1vppv.exe35⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlxfllr.exec:\rlxfllr.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xllrrxf.exec:\xllrrxf.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bthhnh.exec:\bthhnh.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ppddj.exec:\ppddj.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7vpvd.exec:\7vpvd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\lflxflx.exec:\lflxflx.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5tbhnt.exec:\5tbhnt.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jvjjp.exec:\jvjjp.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1vjpp.exec:\1vjpp.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xrflrfx.exec:\xrflrfx.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tnbhnt.exec:\tnbhnt.exe46⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hhhtbh.exec:\hhhtbh.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5djjv.exec:\5djjv.exe48⤵
- Executes dropped EXE
PID:1900 -
\??\c:\pdpvd.exec:\pdpvd.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\frlxfll.exec:\frlxfll.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe51⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ntbbhb.exec:\ntbbhb.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5jvjv.exec:\5jvjv.exe53⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9dddj.exec:\9dddj.exe54⤵
- Executes dropped EXE
PID:348 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hbnthh.exec:\hbnthh.exe56⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jvjpv.exec:\jvjpv.exe57⤵
- Executes dropped EXE
PID:1932 -
\??\c:\9djjp.exec:\9djjp.exe58⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xlxfllx.exec:\xlxfllx.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hbtbhn.exec:\hbtbhn.exe60⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btbhnb.exec:\btbhnb.exe61⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjddv.exec:\jjddv.exe62⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pjppd.exec:\pjppd.exe63⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xrllxfr.exec:\xrllxfr.exe64⤵
- Executes dropped EXE
PID:2508 -
\??\c:\llrrxff.exec:\llrrxff.exe65⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hbtttt.exec:\hbtttt.exe66⤵PID:2008
-
\??\c:\dvjpv.exec:\dvjpv.exe67⤵PID:2196
-
\??\c:\dpdjv.exec:\dpdjv.exe68⤵PID:1264
-
\??\c:\7lxlffl.exec:\7lxlffl.exe69⤵PID:540
-
\??\c:\btntbt.exec:\btntbt.exe70⤵PID:1652
-
\??\c:\nbntbh.exec:\nbntbh.exe71⤵PID:1620
-
\??\c:\jdjdd.exec:\jdjdd.exe72⤵PID:1508
-
\??\c:\jjddp.exec:\jjddp.exe73⤵PID:1716
-
\??\c:\9xflrfl.exec:\9xflrfl.exe74⤵PID:2384
-
\??\c:\hhbbth.exec:\hhbbth.exe75⤵PID:2200
-
\??\c:\9btttt.exec:\9btttt.exe76⤵PID:2752
-
\??\c:\ppddv.exec:\ppddv.exe77⤵PID:2084
-
\??\c:\jdvdd.exec:\jdvdd.exe78⤵PID:2828
-
\??\c:\7lflrfl.exec:\7lflrfl.exe79⤵PID:2764
-
\??\c:\nnbttt.exec:\nnbttt.exe80⤵PID:3036
-
\??\c:\btnttb.exec:\btnttb.exe81⤵PID:2896
-
\??\c:\7jdpp.exec:\7jdpp.exe82⤵PID:1964
-
\??\c:\jjddd.exec:\jjddd.exe83⤵PID:2688
-
\??\c:\3lxflll.exec:\3lxflll.exe84⤵PID:2652
-
\??\c:\tnhttb.exec:\tnhttb.exe85⤵PID:1848
-
\??\c:\nhnbbh.exec:\nhnbbh.exe86⤵PID:2332
-
\??\c:\vjpdd.exec:\vjpdd.exe87⤵PID:908
-
\??\c:\ddjvj.exec:\ddjvj.exe88⤵PID:1884
-
\??\c:\ffffrrx.exec:\ffffrrx.exe89⤵PID:1008
-
\??\c:\thtbhb.exec:\thtbhb.exe90⤵PID:1420
-
\??\c:\bthhnh.exec:\bthhnh.exe91⤵PID:2680
-
\??\c:\dvjvj.exec:\dvjvj.exe92⤵PID:2992
-
\??\c:\jdvdp.exec:\jdvdp.exe93⤵PID:2920
-
\??\c:\7xrxlxl.exec:\7xrxlxl.exe94⤵PID:1444
-
\??\c:\rlxfllr.exec:\rlxfllr.exe95⤵PID:1868
-
\??\c:\bnhhbb.exec:\bnhhbb.exe96⤵PID:2144
-
\??\c:\bhbbhn.exec:\bhbbhn.exe97⤵PID:1680
-
\??\c:\dvpdd.exec:\dvpdd.exe98⤵PID:1724
-
\??\c:\ffrxflr.exec:\ffrxflr.exe99⤵PID:1288
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe100⤵PID:3056
-
\??\c:\bthttt.exec:\bthttt.exe101⤵PID:1400
-
\??\c:\hhbhnn.exec:\hhbhnn.exe102⤵PID:912
-
\??\c:\jvpdv.exec:\jvpdv.exe103⤵PID:340
-
\??\c:\flfrlxf.exec:\flfrlxf.exe104⤵PID:1576
-
\??\c:\9fxxfff.exec:\9fxxfff.exe105⤵PID:1240
-
\??\c:\btnbnn.exec:\btnbnn.exe106⤵PID:2460
-
\??\c:\btbhtb.exec:\btbhtb.exe107⤵PID:2256
-
\??\c:\vjdpd.exec:\vjdpd.exe108⤵PID:1404
-
\??\c:\fxlxlxf.exec:\fxlxlxf.exe109⤵PID:2444
-
\??\c:\xrfflxl.exec:\xrfflxl.exe110⤵PID:2404
-
\??\c:\7bnnhn.exec:\7bnnhn.exe111⤵PID:892
-
\??\c:\vpjpd.exec:\vpjpd.exe112⤵PID:1504
-
\??\c:\rlfflff.exec:\rlfflff.exe113⤵PID:2800
-
\??\c:\hbbnnt.exec:\hbbnnt.exe114⤵PID:3024
-
\??\c:\3tbhnb.exec:\3tbhnb.exe115⤵PID:1732
-
\??\c:\3pddd.exec:\3pddd.exe116⤵PID:2820
-
\??\c:\1frxfxl.exec:\1frxfxl.exe117⤵PID:2832
-
\??\c:\thtbhn.exec:\thtbhn.exe118⤵PID:2856
-
\??\c:\1jvvj.exec:\1jvvj.exe119⤵PID:2616
-
\??\c:\tnhntt.exec:\tnhntt.exe120⤵PID:700
-
\??\c:\bhttbh.exec:\bhttbh.exe121⤵PID:1604
-
\??\c:\pjdjp.exec:\pjdjp.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-