Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 08:44
Static task
static1
Behavioral task
behavioral1
Sample
9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe
Resource
win7-20240708-en
General
-
Target
9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe
-
Size
71KB
-
MD5
3d4811b42888ac18bdeffe44eb497600
-
SHA1
c5908b0c3e417e082006f62202a19e2aedcf8c88
-
SHA256
9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6
-
SHA512
ac4f87624d2d7a8ff92f0d287f93fe3762dc9da2de4b248df9e813545d2b14d2ded7d2c47802e3a9247b54c856d079bbfdc5f834f5a40f32afc0f662b5b6c4db
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj1:ymb3NkkiQ3mdBjFI4VF
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/3024-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1696 vdpdp.exe 2828 9rrlxfx.exe 2680 1bbbbn.exe 2704 nbnbbh.exe 1644 9pdvd.exe 2576 flllrlr.exe 2548 bthhhh.exe 2988 pdjjj.exe 276 rxfxrlr.exe 264 3rfxxxx.exe 1760 3hbnhb.exe 2360 nhnthn.exe 2040 vjjjj.exe 1780 jvjjj.exe 1488 frrfxxr.exe 816 nnbnbh.exe 1496 nbtbbb.exe 2648 jvddd.exe 1120 jpvdj.exe 280 lxfffll.exe 2532 thbhhn.exe 1588 httnnn.exe 2940 7jvvp.exe 1000 1frrlxr.exe 2464 9lfrxrr.exe 3052 bnttnh.exe 1444 htbbbb.exe 900 vjpjj.exe 1764 jvjdv.exe 2324 rfrllxf.exe 2088 7nbbth.exe 1536 thnbth.exe 2744 dpvpv.exe 2816 vjppj.exe 2780 lxrrlrf.exe 2704 rxffxxx.exe 2456 nbbbtt.exe 2720 hnhhhb.exe 2560 dvddv.exe 2468 vjjdv.exe 2372 3lxxxll.exe 1112 lrrfxrf.exe 276 hthhtt.exe 580 tntttn.exe 1888 pdjdd.exe 592 jdjjd.exe 1404 jvppv.exe 1124 1rlrxll.exe 1952 lffflfl.exe 2012 5httbb.exe 2840 9tbbbb.exe 2248 1dppp.exe 1956 pdpjp.exe 2884 3frlffl.exe 3000 xxrrxll.exe 2652 hnthhn.exe 1012 vpvvv.exe 316 lffflrx.exe 1588 rfllrrx.exe 2592 frxxxxl.exe 1944 nhnbhh.exe 1972 vjjdj.exe 2516 vjpvd.exe 3052 pjddd.exe -
resource yara_rule behavioral1/memory/3024-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1696 3024 9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe 31 PID 3024 wrote to memory of 1696 3024 9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe 31 PID 3024 wrote to memory of 1696 3024 9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe 31 PID 3024 wrote to memory of 1696 3024 9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe 31 PID 1696 wrote to memory of 2828 1696 vdpdp.exe 32 PID 1696 wrote to memory of 2828 1696 vdpdp.exe 32 PID 1696 wrote to memory of 2828 1696 vdpdp.exe 32 PID 1696 wrote to memory of 2828 1696 vdpdp.exe 32 PID 2828 wrote to memory of 2680 2828 9rrlxfx.exe 33 PID 2828 wrote to memory of 2680 2828 9rrlxfx.exe 33 PID 2828 wrote to memory of 2680 2828 9rrlxfx.exe 33 PID 2828 wrote to memory of 2680 2828 9rrlxfx.exe 33 PID 2680 wrote to memory of 2704 2680 1bbbbn.exe 34 PID 2680 wrote to memory of 2704 2680 1bbbbn.exe 34 PID 2680 wrote to memory of 2704 2680 1bbbbn.exe 34 PID 2680 wrote to memory of 2704 2680 1bbbbn.exe 34 PID 2704 wrote to memory of 1644 2704 nbnbbh.exe 35 PID 2704 wrote to memory of 1644 2704 nbnbbh.exe 35 PID 2704 wrote to memory of 1644 2704 nbnbbh.exe 35 PID 2704 wrote to memory of 1644 2704 nbnbbh.exe 35 PID 1644 wrote to memory of 2576 1644 9pdvd.exe 36 PID 1644 wrote to memory of 2576 1644 9pdvd.exe 36 PID 1644 wrote to memory of 2576 1644 9pdvd.exe 36 PID 1644 wrote to memory of 2576 1644 9pdvd.exe 36 PID 2576 wrote to memory of 2548 2576 flllrlr.exe 37 PID 2576 wrote to memory of 2548 2576 flllrlr.exe 37 PID 2576 wrote to memory of 2548 2576 flllrlr.exe 37 PID 2576 wrote to memory of 2548 2576 flllrlr.exe 37 PID 2548 wrote to memory of 2988 2548 bthhhh.exe 38 PID 2548 wrote to memory of 2988 2548 bthhhh.exe 38 PID 2548 wrote to memory of 2988 2548 bthhhh.exe 38 PID 2548 wrote to memory of 2988 2548 bthhhh.exe 38 PID 2988 wrote to memory of 276 2988 pdjjj.exe 39 PID 2988 wrote to memory of 276 2988 pdjjj.exe 39 PID 2988 wrote to memory of 276 2988 pdjjj.exe 39 PID 2988 wrote to memory of 276 2988 pdjjj.exe 39 PID 276 wrote to memory of 264 276 rxfxrlr.exe 40 PID 276 wrote to memory of 264 276 rxfxrlr.exe 40 PID 276 wrote to memory of 264 276 rxfxrlr.exe 40 PID 276 wrote to memory of 264 276 rxfxrlr.exe 40 PID 264 wrote to memory of 1760 264 3rfxxxx.exe 41 PID 264 wrote to memory of 1760 264 3rfxxxx.exe 41 PID 264 wrote to memory of 1760 264 3rfxxxx.exe 41 PID 264 wrote to memory of 1760 264 3rfxxxx.exe 41 PID 1760 wrote to memory of 2360 1760 3hbnhb.exe 42 PID 1760 wrote to memory of 2360 1760 3hbnhb.exe 42 PID 1760 wrote to memory of 2360 1760 3hbnhb.exe 42 PID 1760 wrote to memory of 2360 1760 3hbnhb.exe 42 PID 2360 wrote to memory of 2040 2360 nhnthn.exe 43 PID 2360 wrote to memory of 2040 2360 nhnthn.exe 43 PID 2360 wrote to memory of 2040 2360 nhnthn.exe 43 PID 2360 wrote to memory of 2040 2360 nhnthn.exe 43 PID 2040 wrote to memory of 1780 2040 vjjjj.exe 44 PID 2040 wrote to memory of 1780 2040 vjjjj.exe 44 PID 2040 wrote to memory of 1780 2040 vjjjj.exe 44 PID 2040 wrote to memory of 1780 2040 vjjjj.exe 44 PID 1780 wrote to memory of 1488 1780 jvjjj.exe 45 PID 1780 wrote to memory of 1488 1780 jvjjj.exe 45 PID 1780 wrote to memory of 1488 1780 jvjjj.exe 45 PID 1780 wrote to memory of 1488 1780 jvjjj.exe 45 PID 1488 wrote to memory of 816 1488 frrfxxr.exe 46 PID 1488 wrote to memory of 816 1488 frrfxxr.exe 46 PID 1488 wrote to memory of 816 1488 frrfxxr.exe 46 PID 1488 wrote to memory of 816 1488 frrfxxr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe"C:\Users\Admin\AppData\Local\Temp\9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\vdpdp.exec:\vdpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\9rrlxfx.exec:\9rrlxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1bbbbn.exec:\1bbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nbnbbh.exec:\nbnbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\9pdvd.exec:\9pdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\flllrlr.exec:\flllrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\bthhhh.exec:\bthhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\pdjjj.exec:\pdjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rxfxrlr.exec:\rxfxrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\3rfxxxx.exec:\3rfxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\3hbnhb.exec:\3hbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\nhnthn.exec:\nhnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\vjjjj.exec:\vjjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jvjjj.exec:\jvjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\frrfxxr.exec:\frrfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\nnbnbh.exec:\nnbnbh.exe17⤵
- Executes dropped EXE
PID:816 -
\??\c:\nbtbbb.exec:\nbtbbb.exe18⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jvddd.exec:\jvddd.exe19⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jpvdj.exec:\jpvdj.exe20⤵
- Executes dropped EXE
PID:1120 -
\??\c:\lxfffll.exec:\lxfffll.exe21⤵
- Executes dropped EXE
PID:280 -
\??\c:\thbhhn.exec:\thbhhn.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\httnnn.exec:\httnnn.exe23⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7jvvp.exec:\7jvvp.exe24⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1frrlxr.exec:\1frrlxr.exe25⤵
- Executes dropped EXE
PID:1000 -
\??\c:\9lfrxrr.exec:\9lfrxrr.exe26⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bnttnh.exec:\bnttnh.exe27⤵
- Executes dropped EXE
PID:3052 -
\??\c:\htbbbb.exec:\htbbbb.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vjpjj.exec:\vjpjj.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\jvjdv.exec:\jvjdv.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rfrllxf.exec:\rfrllxf.exe31⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7nbbth.exec:\7nbbth.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\thnbth.exec:\thnbth.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dpvpv.exec:\dpvpv.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vjppj.exec:\vjppj.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\lxrrlrf.exec:\lxrrlrf.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rxffxxx.exec:\rxffxxx.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nbbbtt.exec:\nbbbtt.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hnhhhb.exec:\hnhhhb.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dvddv.exec:\dvddv.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vjjdv.exec:\vjjdv.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3lxxxll.exec:\3lxxxll.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe43⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hthhtt.exec:\hthhtt.exe44⤵
- Executes dropped EXE
PID:276 -
\??\c:\tntttn.exec:\tntttn.exe45⤵
- Executes dropped EXE
PID:580 -
\??\c:\pdjdd.exec:\pdjdd.exe46⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jdjjd.exec:\jdjjd.exe47⤵
- Executes dropped EXE
PID:592 -
\??\c:\jvppv.exec:\jvppv.exe48⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1rlrxll.exec:\1rlrxll.exe49⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lffflfl.exec:\lffflfl.exe50⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5httbb.exec:\5httbb.exe51⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9tbbbb.exec:\9tbbbb.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1dppp.exec:\1dppp.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pdpjp.exec:\pdpjp.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3frlffl.exec:\3frlffl.exe55⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xxrrxll.exec:\xxrrxll.exe56⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hnthhn.exec:\hnthhn.exe57⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vpvvv.exec:\vpvvv.exe58⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lffflrx.exec:\lffflrx.exe59⤵
- Executes dropped EXE
PID:316 -
\??\c:\rfllrrx.exec:\rfllrrx.exe60⤵
- Executes dropped EXE
PID:1588 -
\??\c:\frxxxxl.exec:\frxxxxl.exe61⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nhnbhh.exec:\nhnbhh.exe62⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vjjdj.exec:\vjjdj.exe63⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjpvd.exec:\vjpvd.exe64⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjddd.exec:\pjddd.exe65⤵
- Executes dropped EXE
PID:3052 -
\??\c:\fxfllff.exec:\fxfllff.exe66⤵PID:676
-
\??\c:\5rffxxl.exec:\5rffxxl.exe67⤵PID:2116
-
\??\c:\tnhtbh.exec:\tnhtbh.exe68⤵PID:2296
-
\??\c:\9bbhtb.exec:\9bbhtb.exe69⤵PID:2288
-
\??\c:\hbntbt.exec:\hbntbt.exe70⤵PID:2324
-
\??\c:\dvjvd.exec:\dvjvd.exe71⤵PID:2088
-
\??\c:\jpdvv.exec:\jpdvv.exe72⤵PID:2700
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe73⤵PID:2680
-
\??\c:\7lxflxf.exec:\7lxflxf.exe74⤵PID:2764
-
\??\c:\5nhnnh.exec:\5nhnnh.exe75⤵PID:2708
-
\??\c:\nbbbnh.exec:\nbbbnh.exe76⤵PID:2728
-
\??\c:\vjppp.exec:\vjppp.exe77⤵PID:2768
-
\??\c:\7pppv.exec:\7pppv.exe78⤵PID:2572
-
\??\c:\xrrxfff.exec:\xrrxfff.exe79⤵PID:2628
-
\??\c:\xrflllr.exec:\xrflllr.exe80⤵PID:1244
-
\??\c:\nbtbbb.exec:\nbtbbb.exe81⤵PID:3036
-
\??\c:\hhtnbb.exec:\hhtnbb.exe82⤵PID:1512
-
\??\c:\htbhtt.exec:\htbhtt.exe83⤵PID:1224
-
\??\c:\9vppp.exec:\9vppp.exe84⤵PID:1612
-
\??\c:\vjdjp.exec:\vjdjp.exe85⤵PID:2520
-
\??\c:\rlllxfl.exec:\rlllxfl.exe86⤵PID:2360
-
\??\c:\5xrffxx.exec:\5xrffxx.exe87⤵PID:1688
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe88⤵PID:1228
-
\??\c:\thntbb.exec:\thntbb.exe89⤵PID:808
-
\??\c:\1btthh.exec:\1btthh.exe90⤵PID:2876
-
\??\c:\dpvpv.exec:\dpvpv.exe91⤵PID:2612
-
\??\c:\jdpjv.exec:\jdpjv.exe92⤵PID:1496
-
\??\c:\5lllllr.exec:\5lllllr.exe93⤵PID:2196
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe94⤵PID:1296
-
\??\c:\7hbhnn.exec:\7hbhnn.exe95⤵PID:1168
-
\??\c:\9thnbb.exec:\9thnbb.exe96⤵PID:2016
-
\??\c:\pdjdj.exec:\pdjdj.exe97⤵PID:840
-
\??\c:\1vppv.exec:\1vppv.exe98⤵PID:1672
-
\??\c:\xxxxfxx.exec:\xxxxfxx.exe99⤵PID:912
-
\??\c:\lxrrxrx.exec:\lxrrxrx.exe100⤵PID:620
-
\??\c:\hthnnh.exec:\hthnnh.exe101⤵PID:1284
-
\??\c:\9htttn.exec:\9htttn.exe102⤵PID:1468
-
\??\c:\pdjjp.exec:\pdjjp.exe103⤵PID:2032
-
\??\c:\7dvpp.exec:\7dvpp.exe104⤵PID:1460
-
\??\c:\fllrfrf.exec:\fllrfrf.exe105⤵PID:2008
-
\??\c:\lxrrffl.exec:\lxrrffl.exe106⤵PID:1036
-
\??\c:\lfrrfll.exec:\lfrrfll.exe107⤵PID:1116
-
\??\c:\nhthnn.exec:\nhthnn.exe108⤵PID:2172
-
\??\c:\tnhhbn.exec:\tnhhbn.exe109⤵PID:1552
-
\??\c:\1tnntn.exec:\1tnntn.exe110⤵PID:2660
-
\??\c:\9pdvd.exec:\9pdvd.exe111⤵PID:2812
-
\??\c:\ppvdv.exec:\ppvdv.exe112⤵PID:2800
-
\??\c:\frxfrxx.exec:\frxfrxx.exe113⤵PID:2428
-
\??\c:\frlllxf.exec:\frlllxf.exe114⤵PID:2820
-
\??\c:\1thhhb.exec:\1thhhb.exe115⤵PID:2688
-
\??\c:\3tnnnn.exec:\3tnnnn.exe116⤵PID:2596
-
\??\c:\hbhnnn.exec:\hbhnnn.exe117⤵PID:2616
-
\??\c:\3pdjj.exec:\3pdjj.exe118⤵
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\pdppd.exec:\pdppd.exe119⤵PID:1664
-
\??\c:\frlrxfl.exec:\frlrxfl.exe120⤵PID:1068
-
\??\c:\fxlrxrr.exec:\fxlrxrr.exe121⤵PID:2448
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe122⤵PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-