Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe
Resource
win7-20240704-en
General
-
Target
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe
-
Size
230KB
-
MD5
18ddcc606a221e8d20834287a92fe100
-
SHA1
57cd8c7f9e5f2ad12d0dbd37b3e263e03284ccfe
-
SHA256
f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873
-
SHA512
217d3a43f88b5dad180cb85dcd9a72476a2caf8f0115c0bbf16e26c568a026291d7860cc506d0486478f1e3d29875633c3e5422b13ec8844f3c52406df5e6d45
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1fE:n3C9BRo7MlrWKo+lxKk1fE
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2824-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/528-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/372-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 lfxlxxf.exe 2624 rxxlxfr.exe 2724 i680624.exe 2592 ppjvj.exe 2008 o028040.exe 528 0488446.exe 1516 rffffxf.exe 3056 1thbhb.exe 2228 08062.exe 1764 4628040.exe 2536 2640606.exe 1112 8646828.exe 2876 rlrrfrx.exe 1864 xffffff.exe 372 xrrllfr.exe 628 20262.exe 2168 vjvpd.exe 2488 hthttb.exe 1032 fxlfrlx.exe 1956 7ntbbb.exe 2564 640444.exe 980 e64400.exe 1528 nbnhhh.exe 808 1djdd.exe 900 nnnbnb.exe 2512 thtttb.exe 2360 602848.exe 1012 u088440.exe 2856 rlxxllr.exe 2736 g0220.exe 2744 rflrxff.exe 2716 llfrflf.exe 2880 dpddj.exe 2700 6084224.exe 1600 4206880.exe 2636 rllxllr.exe 2592 thnnnt.exe 2268 9nhnnn.exe 3024 4242286.exe 320 4228668.exe 1380 pjvvd.exe 652 60688.exe 2240 fxlrxxf.exe 836 086288.exe 2936 btntnn.exe 2928 88804.exe 1824 tbhbbb.exe 2888 ttnbtb.exe 2916 ffxrxfx.exe 3052 64066.exe 2932 0882288.exe 1228 tnnhhb.exe 1768 xrxxrxx.exe 2980 pvppd.exe 2328 w22844.exe 2324 dpjvp.exe 1944 lxxxxxx.exe 1956 868428.exe 2444 xrffffl.exe 1080 446284.exe 1784 pjppv.exe 3000 thtbnh.exe 1740 826248.exe 776 3ffrxxf.exe -
resource yara_rule behavioral1/memory/2824-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1112-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/372-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6028668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2422484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s2248.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6024602.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4802224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2692 2824 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 30 PID 2824 wrote to memory of 2692 2824 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 30 PID 2824 wrote to memory of 2692 2824 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 30 PID 2824 wrote to memory of 2692 2824 f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe 30 PID 2692 wrote to memory of 2624 2692 lfxlxxf.exe 31 PID 2692 wrote to memory of 2624 2692 lfxlxxf.exe 31 PID 2692 wrote to memory of 2624 2692 lfxlxxf.exe 31 PID 2692 wrote to memory of 2624 2692 lfxlxxf.exe 31 PID 2624 wrote to memory of 2724 2624 rxxlxfr.exe 32 PID 2624 wrote to memory of 2724 2624 rxxlxfr.exe 32 PID 2624 wrote to memory of 2724 2624 rxxlxfr.exe 32 PID 2624 wrote to memory of 2724 2624 rxxlxfr.exe 32 PID 2724 wrote to memory of 2592 2724 i680624.exe 33 PID 2724 wrote to memory of 2592 2724 i680624.exe 33 PID 2724 wrote to memory of 2592 2724 i680624.exe 33 PID 2724 wrote to memory of 2592 2724 i680624.exe 33 PID 2592 wrote to memory of 2008 2592 ppjvj.exe 34 PID 2592 wrote to memory of 2008 2592 ppjvj.exe 34 PID 2592 wrote to memory of 2008 2592 ppjvj.exe 34 PID 2592 wrote to memory of 2008 2592 ppjvj.exe 34 PID 2008 wrote to memory of 528 2008 o028040.exe 35 PID 2008 wrote to memory of 528 2008 o028040.exe 35 PID 2008 wrote to memory of 528 2008 o028040.exe 35 PID 2008 wrote to memory of 528 2008 o028040.exe 35 PID 528 wrote to memory of 1516 528 0488446.exe 36 PID 528 wrote to memory of 1516 528 0488446.exe 36 PID 528 wrote to memory of 1516 528 0488446.exe 36 PID 528 wrote to memory of 1516 528 0488446.exe 36 PID 1516 wrote to memory of 3056 1516 rffffxf.exe 37 PID 1516 wrote to memory of 3056 1516 rffffxf.exe 37 PID 1516 wrote to memory of 3056 1516 rffffxf.exe 37 PID 1516 wrote to memory of 3056 1516 rffffxf.exe 37 PID 3056 wrote to memory of 2228 3056 1thbhb.exe 38 PID 3056 wrote to memory of 2228 3056 1thbhb.exe 38 PID 3056 wrote to memory of 2228 3056 1thbhb.exe 38 PID 3056 wrote to memory of 2228 3056 1thbhb.exe 38 PID 2228 wrote to memory of 1764 2228 08062.exe 39 PID 2228 wrote to memory of 1764 2228 08062.exe 39 PID 2228 wrote to memory of 1764 2228 08062.exe 39 PID 2228 wrote to memory of 1764 2228 08062.exe 39 PID 1764 wrote to memory of 2536 1764 4628040.exe 40 PID 1764 wrote to memory of 2536 1764 4628040.exe 40 PID 1764 wrote to memory of 2536 1764 4628040.exe 40 PID 1764 wrote to memory of 2536 1764 4628040.exe 40 PID 2536 wrote to memory of 1112 2536 2640606.exe 41 PID 2536 wrote to memory of 1112 2536 2640606.exe 41 PID 2536 wrote to memory of 1112 2536 2640606.exe 41 PID 2536 wrote to memory of 1112 2536 2640606.exe 41 PID 1112 wrote to memory of 2876 1112 8646828.exe 42 PID 1112 wrote to memory of 2876 1112 8646828.exe 42 PID 1112 wrote to memory of 2876 1112 8646828.exe 42 PID 1112 wrote to memory of 2876 1112 8646828.exe 42 PID 2876 wrote to memory of 1864 2876 rlrrfrx.exe 43 PID 2876 wrote to memory of 1864 2876 rlrrfrx.exe 43 PID 2876 wrote to memory of 1864 2876 rlrrfrx.exe 43 PID 2876 wrote to memory of 1864 2876 rlrrfrx.exe 43 PID 1864 wrote to memory of 372 1864 xffffff.exe 44 PID 1864 wrote to memory of 372 1864 xffffff.exe 44 PID 1864 wrote to memory of 372 1864 xffffff.exe 44 PID 1864 wrote to memory of 372 1864 xffffff.exe 44 PID 372 wrote to memory of 628 372 xrrllfr.exe 45 PID 372 wrote to memory of 628 372 xrrllfr.exe 45 PID 372 wrote to memory of 628 372 xrrllfr.exe 45 PID 372 wrote to memory of 628 372 xrrllfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe"C:\Users\Admin\AppData\Local\Temp\f9d4e338c995cff706c9def5d931d627093355f513b4439de4f82aa69c187873N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lfxlxxf.exec:\lfxlxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rxxlxfr.exec:\rxxlxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\i680624.exec:\i680624.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\ppjvj.exec:\ppjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\o028040.exec:\o028040.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\0488446.exec:\0488446.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\rffffxf.exec:\rffffxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\1thbhb.exec:\1thbhb.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\08062.exec:\08062.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\4628040.exec:\4628040.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\2640606.exec:\2640606.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\8646828.exec:\8646828.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\rlrrfrx.exec:\rlrrfrx.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xffffff.exec:\xffffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\xrrllfr.exec:\xrrllfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\20262.exec:\20262.exe17⤵
- Executes dropped EXE
PID:628 -
\??\c:\vjvpd.exec:\vjvpd.exe18⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hthttb.exec:\hthttb.exe19⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxlfrlx.exec:\fxlfrlx.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1032 -
\??\c:\7ntbbb.exec:\7ntbbb.exe21⤵
- Executes dropped EXE
PID:1956 -
\??\c:\640444.exec:\640444.exe22⤵
- Executes dropped EXE
PID:2564 -
\??\c:\e64400.exec:\e64400.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\nbnhhh.exec:\nbnhhh.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1djdd.exec:\1djdd.exe25⤵
- Executes dropped EXE
PID:808 -
\??\c:\nnnbnb.exec:\nnnbnb.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\thtttb.exec:\thtttb.exe27⤵
- Executes dropped EXE
PID:2512 -
\??\c:\602848.exec:\602848.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\u088440.exec:\u088440.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\rlxxllr.exec:\rlxxllr.exe30⤵
- Executes dropped EXE
PID:2856 -
\??\c:\g0220.exec:\g0220.exe31⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rflrxff.exec:\rflrxff.exe32⤵
- Executes dropped EXE
PID:2744 -
\??\c:\llfrflf.exec:\llfrflf.exe33⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dpddj.exec:\dpddj.exe34⤵
- Executes dropped EXE
PID:2880 -
\??\c:\6084224.exec:\6084224.exe35⤵
- Executes dropped EXE
PID:2700 -
\??\c:\4206880.exec:\4206880.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rllxllr.exec:\rllxllr.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\thnnnt.exec:\thnnnt.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9nhnnn.exec:\9nhnnn.exe39⤵
- Executes dropped EXE
PID:2268 -
\??\c:\4242286.exec:\4242286.exe40⤵
- Executes dropped EXE
PID:3024 -
\??\c:\4228668.exec:\4228668.exe41⤵
- Executes dropped EXE
PID:320 -
\??\c:\pjvvd.exec:\pjvvd.exe42⤵
- Executes dropped EXE
PID:1380 -
\??\c:\60688.exec:\60688.exe43⤵
- Executes dropped EXE
PID:652 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\086288.exec:\086288.exe45⤵
- Executes dropped EXE
PID:836 -
\??\c:\btntnn.exec:\btntnn.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\88804.exec:\88804.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tbhbbb.exec:\tbhbbb.exe48⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ttnbtb.exec:\ttnbtb.exe49⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ffxrxfx.exec:\ffxrxfx.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\64066.exec:\64066.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\0882288.exec:\0882288.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnnhhb.exec:\tnnhhb.exe53⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe54⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pvppd.exec:\pvppd.exe55⤵
- Executes dropped EXE
PID:2980 -
\??\c:\w22844.exec:\w22844.exe56⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dpjvp.exec:\dpjvp.exe57⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe58⤵
- Executes dropped EXE
PID:1944 -
\??\c:\868428.exec:\868428.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xrffffl.exec:\xrffffl.exe60⤵
- Executes dropped EXE
PID:2444 -
\??\c:\446284.exec:\446284.exe61⤵
- Executes dropped EXE
PID:1080 -
\??\c:\pjppv.exec:\pjppv.exe62⤵
- Executes dropped EXE
PID:1784 -
\??\c:\thtbnh.exec:\thtbnh.exe63⤵
- Executes dropped EXE
PID:3000 -
\??\c:\826248.exec:\826248.exe64⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3ffrxxf.exec:\3ffrxxf.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\26628.exec:\26628.exe66⤵PID:2396
-
\??\c:\64882.exec:\64882.exe67⤵PID:3012
-
\??\c:\pjddp.exec:\pjddp.exe68⤵PID:2360
-
\??\c:\xlfrxrx.exec:\xlfrxrx.exe69⤵PID:2996
-
\??\c:\7jjvd.exec:\7jjvd.exe70⤵PID:2728
-
\??\c:\w40628.exec:\w40628.exe71⤵PID:2816
-
\??\c:\248400.exec:\248400.exe72⤵PID:2308
-
\??\c:\rfrllfl.exec:\rfrllfl.exe73⤵PID:2912
-
\??\c:\0848888.exec:\0848888.exe74⤵PID:2624
-
\??\c:\pddjd.exec:\pddjd.exe75⤵PID:2704
-
\??\c:\0282228.exec:\0282228.exe76⤵PID:2700
-
\??\c:\48062.exec:\48062.exe77⤵PID:2644
-
\??\c:\80228.exec:\80228.exe78⤵PID:2584
-
\??\c:\tnhhtb.exec:\tnhhtb.exe79⤵PID:2708
-
\??\c:\m4284.exec:\m4284.exe80⤵PID:2268
-
\??\c:\hbthnt.exec:\hbthnt.exe81⤵
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\btbntb.exec:\btbntb.exe82⤵PID:320
-
\??\c:\642204.exec:\642204.exe83⤵PID:1036
-
\??\c:\3vdpv.exec:\3vdpv.exe84⤵PID:2096
-
\??\c:\2040068.exec:\2040068.exe85⤵PID:2208
-
\??\c:\httnhb.exec:\httnhb.exe86⤵PID:836
-
\??\c:\5jdvj.exec:\5jdvj.exe87⤵PID:2212
-
\??\c:\tnhhhn.exec:\tnhhhn.exe88⤵PID:2928
-
\??\c:\084844.exec:\084844.exe89⤵PID:1824
-
\??\c:\64440.exec:\64440.exe90⤵PID:2888
-
\??\c:\btbhhn.exec:\btbhhn.exe91⤵PID:2916
-
\??\c:\0406884.exec:\0406884.exe92⤵PID:2056
-
\??\c:\042284.exec:\042284.exe93⤵PID:1524
-
\??\c:\jdpvj.exec:\jdpvj.exe94⤵PID:1228
-
\??\c:\o462884.exec:\o462884.exe95⤵PID:2960
-
\??\c:\dpjdj.exec:\dpjdj.exe96⤵PID:2296
-
\??\c:\04424.exec:\04424.exe97⤵PID:2328
-
\??\c:\lfxfflr.exec:\lfxfflr.exe98⤵PID:1448
-
\??\c:\u262446.exec:\u262446.exe99⤵PID:1944
-
\??\c:\lxlrlrf.exec:\lxlrlrf.exe100⤵PID:2424
-
\??\c:\680446.exec:\680446.exe101⤵PID:1872
-
\??\c:\3tthtt.exec:\3tthtt.exe102⤵PID:980
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe103⤵PID:1784
-
\??\c:\bbntth.exec:\bbntth.exe104⤵PID:3000
-
\??\c:\bbntbb.exec:\bbntbb.exe105⤵PID:1740
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe106⤵PID:2516
-
\??\c:\7lxxlfl.exec:\7lxxlfl.exe107⤵PID:1512
-
\??\c:\jdvjd.exec:\jdvjd.exe108⤵PID:2532
-
\??\c:\0206620.exec:\0206620.exe109⤵PID:2360
-
\??\c:\04624.exec:\04624.exe110⤵PID:352
-
\??\c:\9jjpd.exec:\9jjpd.exe111⤵PID:2728
-
\??\c:\fxflffr.exec:\fxflffr.exe112⤵PID:2948
-
\??\c:\608844.exec:\608844.exe113⤵PID:2616
-
\??\c:\pjvdd.exec:\pjvdd.exe114⤵PID:2692
-
\??\c:\s8682.exec:\s8682.exe115⤵PID:2624
-
\??\c:\9pvdv.exec:\9pvdv.exe116⤵PID:2704
-
\??\c:\26802.exec:\26802.exe117⤵PID:2700
-
\??\c:\9lffllf.exec:\9lffllf.exe118⤵PID:2756
-
\??\c:\tnbhth.exec:\tnbhth.exe119⤵PID:2584
-
\??\c:\602862.exec:\602862.exe120⤵PID:596
-
\??\c:\djvjj.exec:\djvjj.exe121⤵PID:2268
-
\??\c:\60620.exec:\60620.exe122⤵PID:2008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-