Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe
Resource
win7-20240903-en
General
-
Target
8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe
-
Size
82KB
-
MD5
646462650ef09a5934afdd3a59580db0
-
SHA1
101cb20d74cf74724941662c0ca64863a14b4ad1
-
SHA256
8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7
-
SHA512
3853f23078ec8a600e2d42ddd5eb652e20feaa58319974ad013174b9f3ab677117a04b6833074e27e9ab0fdbe6d6690cc853f017292e91af97e56a01fc738055
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89L:ymb3NkkiQ3mdBjFIIp9L9QrrA8l
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1660-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-9037-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2068 jjdjd.exe 1976 5ttbhb.exe 2080 7vppv.exe 2852 5dpvj.exe 3056 rrfrflx.exe 2988 bbnnnn.exe 2556 jdvjp.exe 2968 xrflxfl.exe 1552 bbtbhh.exe 2524 tnhnbt.exe 536 7vppv.exe 1788 djdvd.exe 764 7fxfrxf.exe 1512 9nbbnh.exe 768 9jvvv.exe 1144 jvjjv.exe 2872 9lflxxr.exe 2116 nhtbbh.exe 2128 jddpd.exe 1988 pjdpv.exe 2152 lfllxlr.exe 832 xrlrlrf.exe 1860 lfflffl.exe 2400 1nbhbn.exe 1732 3nhnbn.exe 1736 9vpvj.exe 564 vppdj.exe 380 lrlflff.exe 1660 xrflxxl.exe 2952 btnthn.exe 2456 vpjvj.exe 1560 jvjjj.exe 2704 dvpdj.exe 2708 llxlxxr.exe 1440 xrrxlfl.exe 2356 thtntt.exe 2692 nhtnnb.exe 2724 ppvdj.exe 2572 pjvdp.exe 2972 rfrxrrx.exe 2620 hbbbhh.exe 1480 nbhhhh.exe 1552 pjvjp.exe 712 ddvdd.exe 1188 5lxrxlr.exe 1712 xlxxxfl.exe 2020 3bhtbt.exe 1948 1dpdd.exe 1576 fxlrxlr.exe 768 fxlrflr.exe 2112 btnbnn.exe 2180 nbthhn.exe 2140 jjvdj.exe 2192 jpdjd.exe 2196 rfrrffr.exe 664 hbbhnn.exe 952 7httbb.exe 832 3pjjj.exe 2924 5xxxxxf.exe 1920 xxffxrx.exe 948 bttbhn.exe 1324 5hnbbh.exe 1748 dvvjv.exe 1208 xlxxxxf.exe -
resource yara_rule behavioral1/memory/1660-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-9037-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2068 1660 8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe 31 PID 1660 wrote to memory of 2068 1660 8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe 31 PID 1660 wrote to memory of 2068 1660 8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe 31 PID 1660 wrote to memory of 2068 1660 8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe 31 PID 2068 wrote to memory of 1976 2068 jjdjd.exe 32 PID 2068 wrote to memory of 1976 2068 jjdjd.exe 32 PID 2068 wrote to memory of 1976 2068 jjdjd.exe 32 PID 2068 wrote to memory of 1976 2068 jjdjd.exe 32 PID 1976 wrote to memory of 2080 1976 5ttbhb.exe 33 PID 1976 wrote to memory of 2080 1976 5ttbhb.exe 33 PID 1976 wrote to memory of 2080 1976 5ttbhb.exe 33 PID 1976 wrote to memory of 2080 1976 5ttbhb.exe 33 PID 2080 wrote to memory of 2852 2080 7vppv.exe 34 PID 2080 wrote to memory of 2852 2080 7vppv.exe 34 PID 2080 wrote to memory of 2852 2080 7vppv.exe 34 PID 2080 wrote to memory of 2852 2080 7vppv.exe 34 PID 2852 wrote to memory of 3056 2852 5dpvj.exe 35 PID 2852 wrote to memory of 3056 2852 5dpvj.exe 35 PID 2852 wrote to memory of 3056 2852 5dpvj.exe 35 PID 2852 wrote to memory of 3056 2852 5dpvj.exe 35 PID 3056 wrote to memory of 2988 3056 rrfrflx.exe 36 PID 3056 wrote to memory of 2988 3056 rrfrflx.exe 36 PID 3056 wrote to memory of 2988 3056 rrfrflx.exe 36 PID 3056 wrote to memory of 2988 3056 rrfrflx.exe 36 PID 2988 wrote to memory of 2556 2988 bbnnnn.exe 37 PID 2988 wrote to memory of 2556 2988 bbnnnn.exe 37 PID 2988 wrote to memory of 2556 2988 bbnnnn.exe 37 PID 2988 wrote to memory of 2556 2988 bbnnnn.exe 37 PID 2556 wrote to memory of 2968 2556 jdvjp.exe 38 PID 2556 wrote to memory of 2968 2556 jdvjp.exe 38 PID 2556 wrote to memory of 2968 2556 jdvjp.exe 38 PID 2556 wrote to memory of 2968 2556 jdvjp.exe 38 PID 2968 wrote to memory of 1552 2968 xrflxfl.exe 39 PID 2968 wrote to memory of 1552 2968 xrflxfl.exe 39 PID 2968 wrote to memory of 1552 2968 xrflxfl.exe 39 PID 2968 wrote to memory of 1552 2968 xrflxfl.exe 39 PID 1552 wrote to memory of 2524 1552 bbtbhh.exe 40 PID 1552 wrote to memory of 2524 1552 bbtbhh.exe 40 PID 1552 wrote to memory of 2524 1552 bbtbhh.exe 40 PID 1552 wrote to memory of 2524 1552 bbtbhh.exe 40 PID 2524 wrote to memory of 536 2524 tnhnbt.exe 41 PID 2524 wrote to memory of 536 2524 tnhnbt.exe 41 PID 2524 wrote to memory of 536 2524 tnhnbt.exe 41 PID 2524 wrote to memory of 536 2524 tnhnbt.exe 41 PID 536 wrote to memory of 1788 536 7vppv.exe 42 PID 536 wrote to memory of 1788 536 7vppv.exe 42 PID 536 wrote to memory of 1788 536 7vppv.exe 42 PID 536 wrote to memory of 1788 536 7vppv.exe 42 PID 1788 wrote to memory of 764 1788 djdvd.exe 43 PID 1788 wrote to memory of 764 1788 djdvd.exe 43 PID 1788 wrote to memory of 764 1788 djdvd.exe 43 PID 1788 wrote to memory of 764 1788 djdvd.exe 43 PID 764 wrote to memory of 1512 764 7fxfrxf.exe 44 PID 764 wrote to memory of 1512 764 7fxfrxf.exe 44 PID 764 wrote to memory of 1512 764 7fxfrxf.exe 44 PID 764 wrote to memory of 1512 764 7fxfrxf.exe 44 PID 1512 wrote to memory of 768 1512 9nbbnh.exe 45 PID 1512 wrote to memory of 768 1512 9nbbnh.exe 45 PID 1512 wrote to memory of 768 1512 9nbbnh.exe 45 PID 1512 wrote to memory of 768 1512 9nbbnh.exe 45 PID 768 wrote to memory of 1144 768 9jvvv.exe 46 PID 768 wrote to memory of 1144 768 9jvvv.exe 46 PID 768 wrote to memory of 1144 768 9jvvv.exe 46 PID 768 wrote to memory of 1144 768 9jvvv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe"C:\Users\Admin\AppData\Local\Temp\8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\jjdjd.exec:\jjdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\5ttbhb.exec:\5ttbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\7vppv.exec:\7vppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\5dpvj.exec:\5dpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rrfrflx.exec:\rrfrflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\bbnnnn.exec:\bbnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jdvjp.exec:\jdvjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xrflxfl.exec:\xrflxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bbtbhh.exec:\bbtbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\tnhnbt.exec:\tnhnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7vppv.exec:\7vppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\djdvd.exec:\djdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\7fxfrxf.exec:\7fxfrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\9nbbnh.exec:\9nbbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\9jvvv.exec:\9jvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\jvjjv.exec:\jvjjv.exe17⤵
- Executes dropped EXE
PID:1144 -
\??\c:\9lflxxr.exec:\9lflxxr.exe18⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhtbbh.exec:\nhtbbh.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jddpd.exec:\jddpd.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjdpv.exec:\pjdpv.exe21⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lfllxlr.exec:\lfllxlr.exe22⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\lfflffl.exec:\lfflffl.exe24⤵
- Executes dropped EXE
PID:1860 -
\??\c:\1nbhbn.exec:\1nbhbn.exe25⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3nhnbn.exec:\3nhnbn.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9vpvj.exec:\9vpvj.exe27⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vppdj.exec:\vppdj.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\lrlflff.exec:\lrlflff.exe29⤵
- Executes dropped EXE
PID:380 -
\??\c:\xrflxxl.exec:\xrflxxl.exe30⤵
- Executes dropped EXE
PID:1660 -
\??\c:\btnthn.exec:\btnthn.exe31⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vpjvj.exec:\vpjvj.exe32⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jvjjj.exec:\jvjjj.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dvpdj.exec:\dvpdj.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\llxlxxr.exec:\llxlxxr.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\xrrxlfl.exec:\xrrxlfl.exe36⤵
- Executes dropped EXE
PID:1440 -
\??\c:\thtntt.exec:\thtntt.exe37⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nhtnnb.exec:\nhtnnb.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ppvdj.exec:\ppvdj.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pjvdp.exec:\pjvdp.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe41⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hbbbhh.exec:\hbbbhh.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nbhhhh.exec:\nbhhhh.exe43⤵
- Executes dropped EXE
PID:1480 -
\??\c:\pjvjp.exec:\pjvjp.exe44⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ddvdd.exec:\ddvdd.exe45⤵
- Executes dropped EXE
PID:712 -
\??\c:\5lxrxlr.exec:\5lxrxlr.exe46⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xlxxxfl.exec:\xlxxxfl.exe47⤵
- Executes dropped EXE
PID:1712 -
\??\c:\3bhtbt.exec:\3bhtbt.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1dpdd.exec:\1dpdd.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fxlrxlr.exec:\fxlrxlr.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxlrflr.exec:\fxlrflr.exe51⤵
- Executes dropped EXE
PID:768 -
\??\c:\btnbnn.exec:\btnbnn.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nbthhn.exec:\nbthhn.exe53⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jjvdj.exec:\jjvdj.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jpdjd.exec:\jpdjd.exe55⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rfrrffr.exec:\rfrrffr.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hbbhnn.exec:\hbbhnn.exe57⤵
- Executes dropped EXE
PID:664 -
\??\c:\7httbb.exec:\7httbb.exe58⤵
- Executes dropped EXE
PID:952 -
\??\c:\3pjjj.exec:\3pjjj.exe59⤵
- Executes dropped EXE
PID:832 -
\??\c:\5xxxxxf.exec:\5xxxxxf.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xxffxrx.exec:\xxffxrx.exe61⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bttbhn.exec:\bttbhn.exe62⤵
- Executes dropped EXE
PID:948 -
\??\c:\5hnbbh.exec:\5hnbbh.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dvvjv.exec:\dvvjv.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1208 -
\??\c:\xrrfxfx.exec:\xrrfxfx.exe66⤵PID:2960
-
\??\c:\bnbbhb.exec:\bnbbhb.exe67⤵
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\pjvdj.exec:\pjvdj.exe68⤵PID:2352
-
\??\c:\pjvdj.exec:\pjvdj.exe69⤵PID:2880
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe70⤵PID:2480
-
\??\c:\rrfrffl.exec:\rrfrffl.exe71⤵PID:1796
-
\??\c:\nnthnt.exec:\nnthnt.exe72⤵PID:2788
-
\??\c:\bntbtb.exec:\bntbtb.exe73⤵PID:2376
-
\??\c:\1jdjp.exec:\1jdjp.exe74⤵PID:2708
-
\??\c:\9dpvj.exec:\9dpvj.exe75⤵PID:3064
-
\??\c:\xrxxffr.exec:\xrxxffr.exe76⤵PID:2372
-
\??\c:\1xrxffl.exec:\1xrxffl.exe77⤵PID:2828
-
\??\c:\bthntb.exec:\bthntb.exe78⤵
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\tttbbb.exec:\tttbbb.exe79⤵PID:2628
-
\??\c:\jjjjp.exec:\jjjjp.exe80⤵PID:2668
-
\??\c:\vpjjd.exec:\vpjjd.exe81⤵PID:2676
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe82⤵PID:1792
-
\??\c:\rlrrxfx.exec:\rlrrxfx.exe83⤵PID:2616
-
\??\c:\hbtbhh.exec:\hbtbhh.exe84⤵PID:1552
-
\??\c:\tnthhn.exec:\tnthhn.exe85⤵PID:1088
-
\??\c:\pjvdj.exec:\pjvdj.exe86⤵PID:1188
-
\??\c:\ddvdp.exec:\ddvdp.exe87⤵PID:992
-
\??\c:\xrfrxrx.exec:\xrfrxrx.exe88⤵PID:2020
-
\??\c:\fxfllrx.exec:\fxfllrx.exe89⤵PID:1908
-
\??\c:\5bhhtt.exec:\5bhhtt.exe90⤵PID:2884
-
\??\c:\5nhnbh.exec:\5nhnbh.exe91⤵PID:2112
-
\??\c:\1jdjp.exec:\1jdjp.exe92⤵PID:2872
-
\??\c:\7jdvd.exec:\7jdvd.exe93⤵PID:1388
-
\??\c:\3frrrlr.exec:\3frrrlr.exe94⤵PID:1696
-
\??\c:\rlrrlfr.exec:\rlrrlfr.exe95⤵PID:2656
-
\??\c:\xrflrrr.exec:\xrflrrr.exe96⤵PID:1964
-
\??\c:\9tntbh.exec:\9tntbh.exe97⤵PID:1620
-
\??\c:\hthhhh.exec:\hthhhh.exe98⤵PID:808
-
\??\c:\jdvjj.exec:\jdvjj.exe99⤵PID:2024
-
\??\c:\vpddj.exec:\vpddj.exe100⤵PID:1328
-
\??\c:\7fxrrfl.exec:\7fxrrfl.exe101⤵PID:2380
-
\??\c:\3xlxllr.exec:\3xlxllr.exe102⤵PID:948
-
\??\c:\bthhbb.exec:\bthhbb.exe103⤵PID:884
-
\??\c:\htnnbb.exec:\htnnbb.exe104⤵PID:2088
-
\??\c:\5vvjp.exec:\5vvjp.exe105⤵PID:2964
-
\??\c:\pjvvj.exec:\pjvvj.exe106⤵PID:1972
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe107⤵PID:2840
-
\??\c:\rlffffl.exec:\rlffffl.exe108⤵PID:2504
-
\??\c:\9tnnhh.exec:\9tnnhh.exe109⤵PID:2684
-
\??\c:\jdppv.exec:\jdppv.exe110⤵PID:2300
-
\??\c:\1ddpd.exec:\1ddpd.exe111⤵PID:2788
-
\??\c:\3fllllr.exec:\3fllllr.exe112⤵PID:2780
-
\??\c:\3rflxlr.exec:\3rflxlr.exe113⤵PID:2708
-
\??\c:\5ntntt.exec:\5ntntt.exe114⤵PID:2716
-
\??\c:\thnhnn.exec:\thnhnn.exe115⤵PID:2720
-
\??\c:\nthttb.exec:\nthttb.exe116⤵PID:2592
-
\??\c:\vpvjj.exec:\vpvjj.exe117⤵PID:2992
-
\??\c:\dpvjd.exec:\dpvjd.exe118⤵PID:2604
-
\??\c:\rlxlflr.exec:\rlxlflr.exe119⤵PID:2448
-
\??\c:\lxflrfl.exec:\lxflrfl.exe120⤵PID:2608
-
\??\c:\9nbntt.exec:\9nbntt.exe121⤵PID:1792
-
\??\c:\1bnttt.exec:\1bnttt.exe122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-