Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe
Resource
win7-20240903-en
General
-
Target
8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe
-
Size
64KB
-
MD5
a36d3b9fbe4e5f29220b5d4566c47790
-
SHA1
41736eb9e71d5808278e306522cfc8e56d01615f
-
SHA256
8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8
-
SHA512
71b18f5ac4925c4ee2764f0d68ba082cdb11f397a544e3cd0d9fba5c28b82a7c0cb24e7d4a83e216ab5d7f4d4cee423f97b26ffadd61901067956353da5ddac5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxiP:ymb3NkkiQ3mdBjF0y7kbK
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2656-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/680-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2204 tntbtb.exe 2760 hbnthn.exe 2964 5rllflx.exe 2592 tnhtbn.exe 2676 thhttn.exe 2684 lfrflrf.exe 2580 fflfxxl.exe 1580 dvpjp.exe 2652 ppdjd.exe 2872 5lxxxfl.exe 2940 ttttbb.exe 2464 7vppv.exe 680 5jvvd.exe 1932 lllrllx.exe 2632 xxlxffl.exe 1616 5bnntt.exe 2192 1jvvv.exe 3020 dvpjj.exe 2544 xfxxrff.exe 2324 ttbhtb.exe 1988 htntbn.exe 692 vvjpv.exe 2528 xrfrxfr.exe 2956 1rfxfxr.exe 788 tthbbt.exe 2376 3bbnbb.exe 2476 7pjdj.exe 1240 lfflxrf.exe 2068 hbhnbh.exe 1940 5pjdj.exe 2720 xflffrl.exe 2772 5nbbhn.exe 2760 hbttbb.exe 2588 pjjdp.exe 2732 3fxrxxf.exe 2560 ffrflrf.exe 2676 hnhhhh.exe 1860 7tthtb.exe 2612 dvpvp.exe 1228 vjdvv.exe 1580 xxrxlfx.exe 1220 rrfrxfx.exe 2320 7nhhnn.exe 2948 3jpdp.exe 800 vvpdd.exe 1904 fffxffl.exe 2008 llrxfrl.exe 3044 tnthtb.exe 1224 ttbnnb.exe 2888 pvppd.exe 1520 jdppd.exe 1584 xxlllrx.exe 2440 ffrfrxf.exe 844 nbbbtt.exe 1736 nntnnb.exe 2548 jpdjd.exe 1124 7pjvv.exe 1196 llxrfrl.exe 804 fxrrlrr.exe 1648 thhnnb.exe 316 3nbtnn.exe 1688 vpvdp.exe 2028 pdppp.exe 352 fxrrrxl.exe -
resource yara_rule behavioral1/memory/2656-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/680-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2204 2656 8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe 31 PID 2656 wrote to memory of 2204 2656 8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe 31 PID 2656 wrote to memory of 2204 2656 8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe 31 PID 2656 wrote to memory of 2204 2656 8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe 31 PID 2204 wrote to memory of 2760 2204 tntbtb.exe 32 PID 2204 wrote to memory of 2760 2204 tntbtb.exe 32 PID 2204 wrote to memory of 2760 2204 tntbtb.exe 32 PID 2204 wrote to memory of 2760 2204 tntbtb.exe 32 PID 2760 wrote to memory of 2964 2760 hbnthn.exe 33 PID 2760 wrote to memory of 2964 2760 hbnthn.exe 33 PID 2760 wrote to memory of 2964 2760 hbnthn.exe 33 PID 2760 wrote to memory of 2964 2760 hbnthn.exe 33 PID 2964 wrote to memory of 2592 2964 5rllflx.exe 34 PID 2964 wrote to memory of 2592 2964 5rllflx.exe 34 PID 2964 wrote to memory of 2592 2964 5rllflx.exe 34 PID 2964 wrote to memory of 2592 2964 5rllflx.exe 34 PID 2592 wrote to memory of 2676 2592 tnhtbn.exe 35 PID 2592 wrote to memory of 2676 2592 tnhtbn.exe 35 PID 2592 wrote to memory of 2676 2592 tnhtbn.exe 35 PID 2592 wrote to memory of 2676 2592 tnhtbn.exe 35 PID 2676 wrote to memory of 2684 2676 thhttn.exe 36 PID 2676 wrote to memory of 2684 2676 thhttn.exe 36 PID 2676 wrote to memory of 2684 2676 thhttn.exe 36 PID 2676 wrote to memory of 2684 2676 thhttn.exe 36 PID 2684 wrote to memory of 2580 2684 lfrflrf.exe 37 PID 2684 wrote to memory of 2580 2684 lfrflrf.exe 37 PID 2684 wrote to memory of 2580 2684 lfrflrf.exe 37 PID 2684 wrote to memory of 2580 2684 lfrflrf.exe 37 PID 2580 wrote to memory of 1580 2580 fflfxxl.exe 38 PID 2580 wrote to memory of 1580 2580 fflfxxl.exe 38 PID 2580 wrote to memory of 1580 2580 fflfxxl.exe 38 PID 2580 wrote to memory of 1580 2580 fflfxxl.exe 38 PID 1580 wrote to memory of 2652 1580 dvpjp.exe 39 PID 1580 wrote to memory of 2652 1580 dvpjp.exe 39 PID 1580 wrote to memory of 2652 1580 dvpjp.exe 39 PID 1580 wrote to memory of 2652 1580 dvpjp.exe 39 PID 2652 wrote to memory of 2872 2652 ppdjd.exe 40 PID 2652 wrote to memory of 2872 2652 ppdjd.exe 40 PID 2652 wrote to memory of 2872 2652 ppdjd.exe 40 PID 2652 wrote to memory of 2872 2652 ppdjd.exe 40 PID 2872 wrote to memory of 2940 2872 5lxxxfl.exe 41 PID 2872 wrote to memory of 2940 2872 5lxxxfl.exe 41 PID 2872 wrote to memory of 2940 2872 5lxxxfl.exe 41 PID 2872 wrote to memory of 2940 2872 5lxxxfl.exe 41 PID 2940 wrote to memory of 2464 2940 ttttbb.exe 42 PID 2940 wrote to memory of 2464 2940 ttttbb.exe 42 PID 2940 wrote to memory of 2464 2940 ttttbb.exe 42 PID 2940 wrote to memory of 2464 2940 ttttbb.exe 42 PID 2464 wrote to memory of 680 2464 7vppv.exe 43 PID 2464 wrote to memory of 680 2464 7vppv.exe 43 PID 2464 wrote to memory of 680 2464 7vppv.exe 43 PID 2464 wrote to memory of 680 2464 7vppv.exe 43 PID 680 wrote to memory of 1932 680 5jvvd.exe 44 PID 680 wrote to memory of 1932 680 5jvvd.exe 44 PID 680 wrote to memory of 1932 680 5jvvd.exe 44 PID 680 wrote to memory of 1932 680 5jvvd.exe 44 PID 1932 wrote to memory of 2632 1932 lllrllx.exe 45 PID 1932 wrote to memory of 2632 1932 lllrllx.exe 45 PID 1932 wrote to memory of 2632 1932 lllrllx.exe 45 PID 1932 wrote to memory of 2632 1932 lllrllx.exe 45 PID 2632 wrote to memory of 1616 2632 xxlxffl.exe 46 PID 2632 wrote to memory of 1616 2632 xxlxffl.exe 46 PID 2632 wrote to memory of 1616 2632 xxlxffl.exe 46 PID 2632 wrote to memory of 1616 2632 xxlxffl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe"C:\Users\Admin\AppData\Local\Temp\8202cac402db2a20ef7787012659180a20f126c76438cb7a3fea95298a91a5f8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tntbtb.exec:\tntbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\hbnthn.exec:\hbnthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\5rllflx.exec:\5rllflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\tnhtbn.exec:\tnhtbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\thhttn.exec:\thhttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lfrflrf.exec:\lfrflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\fflfxxl.exec:\fflfxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dvpjp.exec:\dvpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\ppdjd.exec:\ppdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5lxxxfl.exec:\5lxxxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ttttbb.exec:\ttttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\7vppv.exec:\7vppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\5jvvd.exec:\5jvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\lllrllx.exec:\lllrllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\xxlxffl.exec:\xxlxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5bnntt.exec:\5bnntt.exe17⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1jvvv.exec:\1jvvv.exe18⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dvpjj.exec:\dvpjj.exe19⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xfxxrff.exec:\xfxxrff.exe20⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ttbhtb.exec:\ttbhtb.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\htntbn.exec:\htntbn.exe22⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vvjpv.exec:\vvjpv.exe23⤵
- Executes dropped EXE
PID:692 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe24⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1rfxfxr.exec:\1rfxfxr.exe25⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tthbbt.exec:\tthbbt.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\3bbnbb.exec:\3bbnbb.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7pjdj.exec:\7pjdj.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lfflxrf.exec:\lfflxrf.exe29⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hbhnbh.exec:\hbhnbh.exe30⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5pjdj.exec:\5pjdj.exe31⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xflffrl.exec:\xflffrl.exe32⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5nbbhn.exec:\5nbbhn.exe33⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hbttbb.exec:\hbttbb.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pjjdp.exec:\pjjdp.exe35⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3fxrxxf.exec:\3fxrxxf.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ffrflrf.exec:\ffrflrf.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hnhhhh.exec:\hnhhhh.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7tthtb.exec:\7tthtb.exe39⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dvpvp.exec:\dvpvp.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vjdvv.exec:\vjdvv.exe41⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xxrxlfx.exec:\xxrxlfx.exe42⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rrfrxfx.exec:\rrfrxfx.exe43⤵
- Executes dropped EXE
PID:1220 -
\??\c:\7nhhnn.exec:\7nhhnn.exe44⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3jpdp.exec:\3jpdp.exe45⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vvpdd.exec:\vvpdd.exe46⤵
- Executes dropped EXE
PID:800 -
\??\c:\fffxffl.exec:\fffxffl.exe47⤵
- Executes dropped EXE
PID:1904 -
\??\c:\llrxfrl.exec:\llrxfrl.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tnthtb.exec:\tnthtb.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ttbnnb.exec:\ttbnnb.exe50⤵
- Executes dropped EXE
PID:1224 -
\??\c:\pvppd.exec:\pvppd.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdppd.exec:\jdppd.exe52⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xxlllrx.exec:\xxlllrx.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nbbbtt.exec:\nbbbtt.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\nntnnb.exec:\nntnnb.exe56⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jpdjd.exec:\jpdjd.exe57⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7pjvv.exec:\7pjvv.exe58⤵
- Executes dropped EXE
PID:1124 -
\??\c:\llxrfrl.exec:\llxrfrl.exe59⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxrrlrr.exec:\fxrrlrr.exe60⤵
- Executes dropped EXE
PID:804 -
\??\c:\thhnnb.exec:\thhnnb.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3nbtnn.exec:\3nbtnn.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpvdp.exec:\vpvdp.exe63⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pdppp.exec:\pdppp.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxrrrxl.exec:\fxrrrxl.exe65⤵
- Executes dropped EXE
PID:352 -
\??\c:\9llrxrf.exec:\9llrxrf.exe66⤵PID:2476
-
\??\c:\nbthht.exec:\nbthht.exe67⤵PID:1008
-
\??\c:\nhbhtt.exec:\nhbhtt.exe68⤵PID:2284
-
\??\c:\1ddpv.exec:\1ddpv.exe69⤵PID:2812
-
\??\c:\jdpvd.exec:\jdpvd.exe70⤵PID:2768
-
\??\c:\3rlrflx.exec:\3rlrflx.exe71⤵PID:2680
-
\??\c:\tnthtt.exec:\tnthtt.exe72⤵PID:2808
-
\??\c:\hntbnt.exec:\hntbnt.exe73⤵PID:2084
-
\??\c:\dvpvd.exec:\dvpvd.exe74⤵PID:2780
-
\??\c:\jdvpd.exec:\jdvpd.exe75⤵PID:2568
-
\??\c:\3lxxxxl.exec:\3lxxxxl.exe76⤵PID:2832
-
\??\c:\lflflrl.exec:\lflflrl.exe77⤵PID:2628
-
\??\c:\tnbthn.exec:\tnbthn.exe78⤵PID:2012
-
\??\c:\nnhhhh.exec:\nnhhhh.exe79⤵PID:2580
-
\??\c:\jpdvp.exec:\jpdvp.exe80⤵PID:2552
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe81⤵PID:2784
-
\??\c:\7xlrlrr.exec:\7xlrlrr.exe82⤵PID:1640
-
\??\c:\1nhbnb.exec:\1nhbnb.exe83⤵PID:2872
-
\??\c:\bnhhhn.exec:\bnhhhn.exe84⤵PID:1556
-
\??\c:\jvjpv.exec:\jvjpv.exe85⤵PID:764
-
\??\c:\jddpj.exec:\jddpj.exe86⤵PID:272
-
\??\c:\llfrxfl.exec:\llfrxfl.exe87⤵PID:2624
-
\??\c:\lflrxlr.exec:\lflrxlr.exe88⤵PID:2000
-
\??\c:\nntbhn.exec:\nntbhn.exe89⤵PID:1516
-
\??\c:\1nnbbn.exec:\1nnbbn.exe90⤵PID:2384
-
\??\c:\vpdjp.exec:\vpdjp.exe91⤵PID:1692
-
\??\c:\vdvjd.exec:\vdvjd.exe92⤵PID:2136
-
\??\c:\xfffllr.exec:\xfffllr.exe93⤵PID:2228
-
\??\c:\lxlrflr.exec:\lxlrflr.exe94⤵PID:2996
-
\??\c:\tttnth.exec:\tttnth.exe95⤵PID:448
-
\??\c:\htbhth.exec:\htbhth.exe96⤵PID:2076
-
\??\c:\vvdjp.exec:\vvdjp.exe97⤵PID:968
-
\??\c:\vdjjp.exec:\vdjjp.exe98⤵PID:332
-
\??\c:\flxrlrx.exec:\flxrlrx.exe99⤵PID:1644
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe100⤵
- System Location Discovery: System Language Discovery
PID:1460 -
\??\c:\9btthn.exec:\9btthn.exe101⤵
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\3nhntn.exec:\3nhntn.exe102⤵PID:2096
-
\??\c:\5pjjv.exec:\5pjjv.exe103⤵PID:2032
-
\??\c:\7xllxlr.exec:\7xllxlr.exe104⤵PID:2356
-
\??\c:\xrfrflr.exec:\xrfrflr.exe105⤵PID:2260
-
\??\c:\hbhnbb.exec:\hbhnbb.exe106⤵PID:2064
-
\??\c:\htnnbb.exec:\htnnbb.exe107⤵PID:1652
-
\??\c:\jdpdp.exec:\jdpdp.exe108⤵
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\vddvp.exec:\vddvp.exe109⤵PID:2792
-
\??\c:\llfrxxx.exec:\llfrxxx.exe110⤵PID:2716
-
\??\c:\fflflff.exec:\fflflff.exe111⤵PID:2724
-
\??\c:\hnnhhn.exec:\hnnhhn.exe112⤵PID:2728
-
\??\c:\pdvdp.exec:\pdvdp.exe113⤵PID:2564
-
\??\c:\frllllx.exec:\frllllx.exe114⤵PID:2736
-
\??\c:\rlrxfrx.exec:\rlrxfrx.exe115⤵PID:2616
-
\??\c:\bnhhnn.exec:\bnhhnn.exe116⤵PID:3064
-
\??\c:\ttntbb.exec:\ttntbb.exe117⤵PID:3060
-
\??\c:\ddvpv.exec:\ddvpv.exe118⤵PID:2856
-
\??\c:\dpjdv.exec:\dpjdv.exe119⤵PID:2916
-
\??\c:\fxlxrrx.exec:\fxlxrrx.exe120⤵PID:2784
-
\??\c:\ffxfllr.exec:\ffxfllr.exe121⤵PID:2932
-
\??\c:\nnhtbn.exec:\nnhtbn.exe122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-