Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe
Resource
win7-20240903-en
General
-
Target
83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe
-
Size
230KB
-
MD5
206d60f3a0dcf6796c167b145e8561b0
-
SHA1
af7bef0f3026a8850b1531afdfd3538d73e4437a
-
SHA256
83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3
-
SHA512
5a2f9fc274b8b049afd58e476752e99607fc07f15963d606d498d22d64c7715a57650e1ca4e589e2cac043b1fa13b1ee79dbb724d69ec036e686218e2c0c55d2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG+4:n3C9BRo7MlrWKo+lxKf
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1092-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-900-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 pjvvj.exe 2228 rlxllll.exe 2928 5nbnhb.exe 2744 fffxllr.exe 2952 hbnbhb.exe 1276 jdddp.exe 2852 1rrrfrf.exe 2772 fxrxfll.exe 2624 btbbnh.exe 3060 rllrllf.exe 1740 5hbhnn.exe 2140 1jdvj.exe 2424 llxlrrx.exe 2356 hhtbhh.exe 2428 nnhhtb.exe 2416 dddpv.exe 1768 llflrxf.exe 2784 xxrflrx.exe 2672 3hhnbh.exe 2168 ddpvp.exe 1488 llfflrf.exe 2588 nhbhnb.exe 444 9ntbnt.exe 2032 rrlrxrx.exe 2500 7xrxffl.exe 2964 btntbn.exe 792 3vjjj.exe 2948 xxlxrrl.exe 1628 hhhhnh.exe 2216 1vjpv.exe 1092 rlflrxl.exe 3008 tnbhhn.exe 2092 jdpdd.exe 1632 vppvp.exe 2492 hbtbhn.exe 2864 tnbtbb.exe 2756 dvjpp.exe 2856 pdpvd.exe 2808 5lxxxrx.exe 2780 thtttt.exe 2788 httntn.exe 2768 pdpvj.exe 2600 vpddv.exe 3016 lllfflf.exe 1252 7fffflx.exe 2024 5thntb.exe 2132 1tnbbt.exe 2008 vpdpv.exe 1960 9ddjp.exe 1616 9fffrrr.exe 1932 nnhnhn.exe 632 btntbb.exe 1980 3vvdv.exe 1900 fxrrxlf.exe 2920 xrfflrf.exe 2672 5bthbh.exe 2820 hbtbtb.exe 1624 vjpvd.exe 2444 dppvd.exe 2664 3flrrrf.exe 960 lfxfxfl.exe 2688 nhtntb.exe 1808 jdjvj.exe 2248 vpjpd.exe -
resource yara_rule behavioral1/memory/1092-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-900-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 3004 1092 83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe 30 PID 1092 wrote to memory of 3004 1092 83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe 30 PID 1092 wrote to memory of 3004 1092 83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe 30 PID 1092 wrote to memory of 3004 1092 83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe 30 PID 3004 wrote to memory of 2228 3004 pjvvj.exe 31 PID 3004 wrote to memory of 2228 3004 pjvvj.exe 31 PID 3004 wrote to memory of 2228 3004 pjvvj.exe 31 PID 3004 wrote to memory of 2228 3004 pjvvj.exe 31 PID 2228 wrote to memory of 2928 2228 rlxllll.exe 32 PID 2228 wrote to memory of 2928 2228 rlxllll.exe 32 PID 2228 wrote to memory of 2928 2228 rlxllll.exe 32 PID 2228 wrote to memory of 2928 2228 rlxllll.exe 32 PID 2928 wrote to memory of 2744 2928 5nbnhb.exe 33 PID 2928 wrote to memory of 2744 2928 5nbnhb.exe 33 PID 2928 wrote to memory of 2744 2928 5nbnhb.exe 33 PID 2928 wrote to memory of 2744 2928 5nbnhb.exe 33 PID 2744 wrote to memory of 2952 2744 fffxllr.exe 34 PID 2744 wrote to memory of 2952 2744 fffxllr.exe 34 PID 2744 wrote to memory of 2952 2744 fffxllr.exe 34 PID 2744 wrote to memory of 2952 2744 fffxllr.exe 34 PID 2952 wrote to memory of 1276 2952 hbnbhb.exe 35 PID 2952 wrote to memory of 1276 2952 hbnbhb.exe 35 PID 2952 wrote to memory of 1276 2952 hbnbhb.exe 35 PID 2952 wrote to memory of 1276 2952 hbnbhb.exe 35 PID 1276 wrote to memory of 2852 1276 jdddp.exe 36 PID 1276 wrote to memory of 2852 1276 jdddp.exe 36 PID 1276 wrote to memory of 2852 1276 jdddp.exe 36 PID 1276 wrote to memory of 2852 1276 jdddp.exe 36 PID 2852 wrote to memory of 2772 2852 1rrrfrf.exe 37 PID 2852 wrote to memory of 2772 2852 1rrrfrf.exe 37 PID 2852 wrote to memory of 2772 2852 1rrrfrf.exe 37 PID 2852 wrote to memory of 2772 2852 1rrrfrf.exe 37 PID 2772 wrote to memory of 2624 2772 fxrxfll.exe 38 PID 2772 wrote to memory of 2624 2772 fxrxfll.exe 38 PID 2772 wrote to memory of 2624 2772 fxrxfll.exe 38 PID 2772 wrote to memory of 2624 2772 fxrxfll.exe 38 PID 2624 wrote to memory of 3060 2624 btbbnh.exe 39 PID 2624 wrote to memory of 3060 2624 btbbnh.exe 39 PID 2624 wrote to memory of 3060 2624 btbbnh.exe 39 PID 2624 wrote to memory of 3060 2624 btbbnh.exe 39 PID 3060 wrote to memory of 1740 3060 rllrllf.exe 40 PID 3060 wrote to memory of 1740 3060 rllrllf.exe 40 PID 3060 wrote to memory of 1740 3060 rllrllf.exe 40 PID 3060 wrote to memory of 1740 3060 rllrllf.exe 40 PID 1740 wrote to memory of 2140 1740 5hbhnn.exe 41 PID 1740 wrote to memory of 2140 1740 5hbhnn.exe 41 PID 1740 wrote to memory of 2140 1740 5hbhnn.exe 41 PID 1740 wrote to memory of 2140 1740 5hbhnn.exe 41 PID 2140 wrote to memory of 2424 2140 1jdvj.exe 42 PID 2140 wrote to memory of 2424 2140 1jdvj.exe 42 PID 2140 wrote to memory of 2424 2140 1jdvj.exe 42 PID 2140 wrote to memory of 2424 2140 1jdvj.exe 42 PID 2424 wrote to memory of 2356 2424 llxlrrx.exe 43 PID 2424 wrote to memory of 2356 2424 llxlrrx.exe 43 PID 2424 wrote to memory of 2356 2424 llxlrrx.exe 43 PID 2424 wrote to memory of 2356 2424 llxlrrx.exe 43 PID 2356 wrote to memory of 2428 2356 hhtbhh.exe 44 PID 2356 wrote to memory of 2428 2356 hhtbhh.exe 44 PID 2356 wrote to memory of 2428 2356 hhtbhh.exe 44 PID 2356 wrote to memory of 2428 2356 hhtbhh.exe 44 PID 2428 wrote to memory of 2416 2428 nnhhtb.exe 45 PID 2428 wrote to memory of 2416 2428 nnhhtb.exe 45 PID 2428 wrote to memory of 2416 2428 nnhhtb.exe 45 PID 2428 wrote to memory of 2416 2428 nnhhtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe"C:\Users\Admin\AppData\Local\Temp\83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\pjvvj.exec:\pjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rlxllll.exec:\rlxllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\5nbnhb.exec:\5nbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\fffxllr.exec:\fffxllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hbnbhb.exec:\hbnbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jdddp.exec:\jdddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\1rrrfrf.exec:\1rrrfrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fxrxfll.exec:\fxrxfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\btbbnh.exec:\btbbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\rllrllf.exec:\rllrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\5hbhnn.exec:\5hbhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\1jdvj.exec:\1jdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\llxlrrx.exec:\llxlrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\hhtbhh.exec:\hhtbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\nnhhtb.exec:\nnhhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\dddpv.exec:\dddpv.exe17⤵
- Executes dropped EXE
PID:2416 -
\??\c:\llflrxf.exec:\llflrxf.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xxrflrx.exec:\xxrflrx.exe19⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3hhnbh.exec:\3hhnbh.exe20⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ddpvp.exec:\ddpvp.exe21⤵
- Executes dropped EXE
PID:2168 -
\??\c:\llfflrf.exec:\llfflrf.exe22⤵
- Executes dropped EXE
PID:1488 -
\??\c:\nhbhnb.exec:\nhbhnb.exe23⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9ntbnt.exec:\9ntbnt.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\rrlrxrx.exec:\rrlrxrx.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7xrxffl.exec:\7xrxffl.exe26⤵
- Executes dropped EXE
PID:2500 -
\??\c:\btntbn.exec:\btntbn.exe27⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3vjjj.exec:\3vjjj.exe28⤵
- Executes dropped EXE
PID:792 -
\??\c:\xxlxrrl.exec:\xxlxrrl.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hhhhnh.exec:\hhhhnh.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1vjpv.exec:\1vjpv.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlflrxl.exec:\rlflrxl.exe32⤵
- Executes dropped EXE
PID:1092 -
\??\c:\tnbhhn.exec:\tnbhhn.exe33⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jdpdd.exec:\jdpdd.exe34⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vppvp.exec:\vppvp.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hbtbhn.exec:\hbtbhn.exe36⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnbtbb.exec:\tnbtbb.exe37⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dvjpp.exec:\dvjpp.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pdpvd.exec:\pdpvd.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5lxxxrx.exec:\5lxxxrx.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\thtttt.exec:\thtttt.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\httntn.exec:\httntn.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pdpvj.exec:\pdpvj.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpddv.exec:\vpddv.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lllfflf.exec:\lllfflf.exe45⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7fffflx.exec:\7fffflx.exe46⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5thntb.exec:\5thntb.exe47⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1tnbbt.exec:\1tnbbt.exe48⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpdpv.exec:\vpdpv.exe49⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9ddjp.exec:\9ddjp.exe50⤵
- Executes dropped EXE
PID:1960 -
\??\c:\9fffrrr.exec:\9fffrrr.exe51⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nnhnhn.exec:\nnhnhn.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\btntbb.exec:\btntbb.exe53⤵
- Executes dropped EXE
PID:632 -
\??\c:\3vvdv.exec:\3vvdv.exe54⤵
- Executes dropped EXE
PID:1980 -
\??\c:\fxrrxlf.exec:\fxrrxlf.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrfflrf.exec:\xrfflrf.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5bthbh.exec:\5bthbh.exe57⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbtbtb.exec:\hbtbtb.exe58⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vjpvd.exec:\vjpvd.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dppvd.exec:\dppvd.exe60⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3flrrrf.exec:\3flrrrf.exe61⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfxfxfl.exec:\lfxfxfl.exe62⤵
- Executes dropped EXE
PID:960 -
\??\c:\nhtntb.exec:\nhtntb.exe63⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdjvj.exec:\jdjvj.exe64⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vpjpd.exec:\vpjpd.exe65⤵
- Executes dropped EXE
PID:2248 -
\??\c:\llflxxl.exec:\llflxxl.exe66⤵PID:2512
-
\??\c:\fxlxxrx.exec:\fxlxxrx.exe67⤵PID:792
-
\??\c:\nhttbh.exec:\nhttbh.exe68⤵PID:2948
-
\??\c:\nhbthn.exec:\nhbthn.exe69⤵PID:768
-
\??\c:\jdvvj.exec:\jdvvj.exe70⤵PID:1332
-
\??\c:\1rlrxxf.exec:\1rlrxxf.exe71⤵PID:2232
-
\??\c:\lfxxffr.exec:\lfxxffr.exe72⤵PID:3052
-
\??\c:\ttnntt.exec:\ttnntt.exe73⤵PID:2104
-
\??\c:\3nbbht.exec:\3nbbht.exe74⤵PID:2092
-
\??\c:\pjddp.exec:\pjddp.exe75⤵PID:2196
-
\??\c:\1pjdd.exec:\1pjdd.exe76⤵PID:2220
-
\??\c:\llffrrx.exec:\llffrrx.exe77⤵PID:2344
-
\??\c:\tnntnt.exec:\tnntnt.exe78⤵PID:2720
-
\??\c:\bthnth.exec:\bthnth.exe79⤵PID:2900
-
\??\c:\9dpjp.exec:\9dpjp.exe80⤵PID:3056
-
\??\c:\pjvjp.exec:\pjvjp.exe81⤵PID:2628
-
\??\c:\lfxxflr.exec:\lfxxflr.exe82⤵
- System Location Discovery: System Language Discovery
PID:2616 -
\??\c:\xrllxff.exec:\xrllxff.exe83⤵PID:2772
-
\??\c:\bnhnbh.exec:\bnhnbh.exe84⤵PID:1104
-
\??\c:\1nnbnn.exec:\1nnbnn.exe85⤵PID:2296
-
\??\c:\dvjvd.exec:\dvjvd.exe86⤵PID:1964
-
\??\c:\dvpvv.exec:\dvpvv.exe87⤵PID:1732
-
\??\c:\7lxrlll.exec:\7lxrlll.exe88⤵PID:1956
-
\??\c:\flxxffl.exec:\flxxffl.exe89⤵PID:1928
-
\??\c:\nnhhbh.exec:\nnhhbh.exe90⤵PID:1796
-
\??\c:\pjdvv.exec:\pjdvv.exe91⤵PID:696
-
\??\c:\vpdjv.exec:\vpdjv.exe92⤵PID:1680
-
\??\c:\llrrffl.exec:\llrrffl.exe93⤵PID:276
-
\??\c:\rlfrrrx.exec:\rlfrrrx.exe94⤵PID:556
-
\??\c:\hbnthn.exec:\hbnthn.exe95⤵PID:2368
-
\??\c:\5bnhnt.exec:\5bnhnt.exe96⤵PID:2812
-
\??\c:\pppvd.exec:\pppvd.exe97⤵PID:2824
-
\??\c:\vpddp.exec:\vpddp.exe98⤵PID:2960
-
\??\c:\rrrxxfr.exec:\rrrxxfr.exe99⤵PID:2460
-
\??\c:\7nhtbn.exec:\7nhtbn.exe100⤵PID:868
-
\??\c:\5hhhbn.exec:\5hhhbn.exe101⤵PID:1012
-
\??\c:\vvddj.exec:\vvddj.exe102⤵PID:1064
-
\??\c:\jvpvv.exec:\jvpvv.exe103⤵PID:1688
-
\??\c:\xllrxxr.exec:\xllrxxr.exe104⤵PID:2964
-
\??\c:\3frxffr.exec:\3frxffr.exe105⤵PID:2164
-
\??\c:\bnhnbh.exec:\bnhnbh.exe106⤵PID:2484
-
\??\c:\hbthnh.exec:\hbthnh.exe107⤵PID:2276
-
\??\c:\9pjvv.exec:\9pjvv.exe108⤵PID:932
-
\??\c:\vjvjv.exec:\vjvjv.exe109⤵PID:896
-
\??\c:\lflrflx.exec:\lflrflx.exe110⤵PID:2988
-
\??\c:\frxfflr.exec:\frxfflr.exe111⤵PID:1576
-
\??\c:\9btttn.exec:\9btttn.exe112⤵PID:1604
-
\??\c:\dvvdv.exec:\dvvdv.exe113⤵PID:580
-
\??\c:\pjddd.exec:\pjddd.exe114⤵PID:2556
-
\??\c:\3xxxxxl.exec:\3xxxxxl.exe115⤵PID:2492
-
\??\c:\xrlrllx.exec:\xrlrllx.exe116⤵PID:2268
-
\??\c:\hbnbhb.exec:\hbnbhb.exe117⤵PID:2864
-
\??\c:\3hnnnt.exec:\3hnnnt.exe118⤵PID:1276
-
\??\c:\3jdjp.exec:\3jdjp.exe119⤵PID:2856
-
\??\c:\dvjvd.exec:\dvjvd.exe120⤵PID:2940
-
\??\c:\1xrxfll.exec:\1xrxfll.exe121⤵PID:2628
-
\??\c:\xxrxllf.exec:\xxrxllf.exe122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-