Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe
Resource
win7-20240729-en
General
-
Target
f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe
-
Size
71KB
-
MD5
55096184828f3eed2f75fa05d41decd0
-
SHA1
a1ecd7da441e09e9ae04d933c32a6904f6143be9
-
SHA256
f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615
-
SHA512
7aaf51ebcb372889a80ad0d41d415294177a25814cd6baca5dbcdf960fe066e7f47f46c5584ce9c01d45a0dea3986119910e966b8d43ea494cb89c2fca4b567a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjX:ymb3NkkiQ3mdBjFI4Vn
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2296-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 300 1xlffff.exe 2228 1nhttt.exe 2920 jdppd.exe 2168 bbtbhn.exe 2900 nhnhhb.exe 2344 lfrxfrx.exe 2664 rfrxflr.exe 1948 djppp.exe 940 vpddj.exe 2424 rrflxlx.exe 1452 nhnbhn.exe 2628 3pjdp.exe 1072 vjjdj.exe 2976 lfrxffr.exe 1524 hthbhh.exe 2996 tbbhbh.exe 1124 jdjjj.exe 348 xlfrffx.exe 2496 lfffllr.exe 2184 hthhhb.exe 2144 jdpvv.exe 1924 jdpvj.exe 812 fxfxrrr.exe 1488 rlflffr.exe 2360 3nhhhn.exe 1984 jdvvd.exe 1952 pvddj.exe 2096 llffllx.exe 1620 thhnnn.exe 2372 hhnnbn.exe 300 3dpdp.exe 1612 lfxlxfr.exe 2928 7xrfrrl.exe 3060 9bntbh.exe 2912 hthhbb.exe 2812 dpjdd.exe 2988 jvvpj.exe 2956 lfrxffr.exe 2648 3xrrrrl.exe 2772 1thnbt.exe 2668 tnbttt.exe 1088 9ppvv.exe 2108 vjvpp.exe 2748 frfxlrr.exe 2284 7xrllrx.exe 3024 fxlrrxx.exe 3068 5nthbn.exe 2628 dvjjp.exe 2896 1xfllrr.exe 2264 1lrrrrx.exe 2752 tnbnnb.exe 608 nntntn.exe 1728 vpdpj.exe 2220 1ppjp.exe 348 9frllfl.exe 2196 xrffrrf.exe 2164 7lfxrxf.exe 2364 hbnbhn.exe 1060 pjddp.exe 2552 9jjvj.exe 2012 rlxlrrx.exe 1052 fxllrxf.exe 304 httbbb.exe 1980 tbbttt.exe -
resource yara_rule behavioral1/memory/2296-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 300 2296 f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe 30 PID 2296 wrote to memory of 300 2296 f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe 30 PID 2296 wrote to memory of 300 2296 f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe 30 PID 2296 wrote to memory of 300 2296 f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe 30 PID 300 wrote to memory of 2228 300 1xlffff.exe 31 PID 300 wrote to memory of 2228 300 1xlffff.exe 31 PID 300 wrote to memory of 2228 300 1xlffff.exe 31 PID 300 wrote to memory of 2228 300 1xlffff.exe 31 PID 2228 wrote to memory of 2920 2228 1nhttt.exe 32 PID 2228 wrote to memory of 2920 2228 1nhttt.exe 32 PID 2228 wrote to memory of 2920 2228 1nhttt.exe 32 PID 2228 wrote to memory of 2920 2228 1nhttt.exe 32 PID 2920 wrote to memory of 2168 2920 jdppd.exe 33 PID 2920 wrote to memory of 2168 2920 jdppd.exe 33 PID 2920 wrote to memory of 2168 2920 jdppd.exe 33 PID 2920 wrote to memory of 2168 2920 jdppd.exe 33 PID 2168 wrote to memory of 2900 2168 bbtbhn.exe 34 PID 2168 wrote to memory of 2900 2168 bbtbhn.exe 34 PID 2168 wrote to memory of 2900 2168 bbtbhn.exe 34 PID 2168 wrote to memory of 2900 2168 bbtbhn.exe 34 PID 2900 wrote to memory of 2344 2900 nhnhhb.exe 35 PID 2900 wrote to memory of 2344 2900 nhnhhb.exe 35 PID 2900 wrote to memory of 2344 2900 nhnhhb.exe 35 PID 2900 wrote to memory of 2344 2900 nhnhhb.exe 35 PID 2344 wrote to memory of 2664 2344 lfrxfrx.exe 36 PID 2344 wrote to memory of 2664 2344 lfrxfrx.exe 36 PID 2344 wrote to memory of 2664 2344 lfrxfrx.exe 36 PID 2344 wrote to memory of 2664 2344 lfrxfrx.exe 36 PID 2664 wrote to memory of 1948 2664 rfrxflr.exe 37 PID 2664 wrote to memory of 1948 2664 rfrxflr.exe 37 PID 2664 wrote to memory of 1948 2664 rfrxflr.exe 37 PID 2664 wrote to memory of 1948 2664 rfrxflr.exe 37 PID 1948 wrote to memory of 940 1948 djppp.exe 38 PID 1948 wrote to memory of 940 1948 djppp.exe 38 PID 1948 wrote to memory of 940 1948 djppp.exe 38 PID 1948 wrote to memory of 940 1948 djppp.exe 38 PID 940 wrote to memory of 2424 940 vpddj.exe 39 PID 940 wrote to memory of 2424 940 vpddj.exe 39 PID 940 wrote to memory of 2424 940 vpddj.exe 39 PID 940 wrote to memory of 2424 940 vpddj.exe 39 PID 2424 wrote to memory of 1452 2424 rrflxlx.exe 40 PID 2424 wrote to memory of 1452 2424 rrflxlx.exe 40 PID 2424 wrote to memory of 1452 2424 rrflxlx.exe 40 PID 2424 wrote to memory of 1452 2424 rrflxlx.exe 40 PID 1452 wrote to memory of 2628 1452 nhnbhn.exe 41 PID 1452 wrote to memory of 2628 1452 nhnbhn.exe 41 PID 1452 wrote to memory of 2628 1452 nhnbhn.exe 41 PID 1452 wrote to memory of 2628 1452 nhnbhn.exe 41 PID 2628 wrote to memory of 1072 2628 3pjdp.exe 42 PID 2628 wrote to memory of 1072 2628 3pjdp.exe 42 PID 2628 wrote to memory of 1072 2628 3pjdp.exe 42 PID 2628 wrote to memory of 1072 2628 3pjdp.exe 42 PID 1072 wrote to memory of 2976 1072 vjjdj.exe 43 PID 1072 wrote to memory of 2976 1072 vjjdj.exe 43 PID 1072 wrote to memory of 2976 1072 vjjdj.exe 43 PID 1072 wrote to memory of 2976 1072 vjjdj.exe 43 PID 2976 wrote to memory of 1524 2976 lfrxffr.exe 44 PID 2976 wrote to memory of 1524 2976 lfrxffr.exe 44 PID 2976 wrote to memory of 1524 2976 lfrxffr.exe 44 PID 2976 wrote to memory of 1524 2976 lfrxffr.exe 44 PID 1524 wrote to memory of 2996 1524 hthbhh.exe 45 PID 1524 wrote to memory of 2996 1524 hthbhh.exe 45 PID 1524 wrote to memory of 2996 1524 hthbhh.exe 45 PID 1524 wrote to memory of 2996 1524 hthbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe"C:\Users\Admin\AppData\Local\Temp\f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\1xlffff.exec:\1xlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\1nhttt.exec:\1nhttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\jdppd.exec:\jdppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\bbtbhn.exec:\bbtbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nhnhhb.exec:\nhnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\rfrxflr.exec:\rfrxflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\djppp.exec:\djppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\vpddj.exec:\vpddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\rrflxlx.exec:\rrflxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\nhnbhn.exec:\nhnbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\3pjdp.exec:\3pjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vjjdj.exec:\vjjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\lfrxffr.exec:\lfrxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hthbhh.exec:\hthbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\tbbhbh.exec:\tbbhbh.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jdjjj.exec:\jdjjj.exe18⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xlfrffx.exec:\xlfrffx.exe19⤵
- Executes dropped EXE
PID:348 -
\??\c:\lfffllr.exec:\lfffllr.exe20⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hthhhb.exec:\hthhhb.exe21⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jdpvv.exec:\jdpvv.exe22⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jdpvj.exec:\jdpvj.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe24⤵
- Executes dropped EXE
PID:812 -
\??\c:\rlflffr.exec:\rlflffr.exe25⤵
- Executes dropped EXE
PID:1488 -
\??\c:\3nhhhn.exec:\3nhhhn.exe26⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jdvvd.exec:\jdvvd.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pvddj.exec:\pvddj.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\llffllx.exec:\llffllx.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\thhnnn.exec:\thhnnn.exe30⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hhnnbn.exec:\hhnnbn.exe31⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3dpdp.exec:\3dpdp.exe32⤵
- Executes dropped EXE
PID:300 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe33⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7xrfrrl.exec:\7xrfrrl.exe34⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9bntbh.exec:\9bntbh.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hthhbb.exec:\hthhbb.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dpjdd.exec:\dpjdd.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jvvpj.exec:\jvvpj.exe38⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lfrxffr.exec:\lfrxffr.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\3xrrrrl.exec:\3xrrrrl.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1thnbt.exec:\1thnbt.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnbttt.exec:\tnbttt.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9ppvv.exec:\9ppvv.exe43⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vjvpp.exec:\vjvpp.exe44⤵
- Executes dropped EXE
PID:2108 -
\??\c:\frfxlrr.exec:\frfxlrr.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7xrllrx.exec:\7xrllrx.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5nthbn.exec:\5nthbn.exe48⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dvjjp.exec:\dvjjp.exe49⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1xfllrr.exec:\1xfllrr.exe50⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1lrrrrx.exec:\1lrrrrx.exe51⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tnbnnb.exec:\tnbnnb.exe52⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nntntn.exec:\nntntn.exe53⤵
- Executes dropped EXE
PID:608 -
\??\c:\vpdpj.exec:\vpdpj.exe54⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1ppjp.exec:\1ppjp.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9frllfl.exec:\9frllfl.exe56⤵
- Executes dropped EXE
PID:348 -
\??\c:\xrffrrf.exec:\xrffrrf.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7lfxrxf.exec:\7lfxrxf.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbnbhn.exec:\hbnbhn.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pjddp.exec:\pjddp.exe60⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9jjvj.exec:\9jjvj.exe61⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rlxlrrx.exec:\rlxlrrx.exe62⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fxllrxf.exec:\fxllrxf.exe63⤵
- Executes dropped EXE
PID:1052 -
\??\c:\httbbb.exec:\httbbb.exe64⤵
- Executes dropped EXE
PID:304 -
\??\c:\tbbttt.exec:\tbbttt.exe65⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9vjpp.exec:\9vjpp.exe66⤵PID:2480
-
\??\c:\1jdpd.exec:\1jdpd.exe67⤵PID:2380
-
\??\c:\3fxlflr.exec:\3fxlflr.exe68⤵PID:680
-
\??\c:\llfrxfr.exec:\llfrxfr.exe69⤵PID:1600
-
\??\c:\hbbbnb.exec:\hbbbnb.exe70⤵PID:2280
-
\??\c:\7hnbht.exec:\7hnbht.exe71⤵PID:3036
-
\??\c:\jdjjp.exec:\jdjjp.exe72⤵PID:2368
-
\??\c:\jdjjd.exec:\jdjjd.exe73⤵PID:2604
-
\??\c:\rlxrlll.exec:\rlxrlll.exe74⤵PID:2924
-
\??\c:\7fllflr.exec:\7fllflr.exe75⤵PID:2928
-
\??\c:\nbhnnh.exec:\nbhnnh.exe76⤵PID:3060
-
\??\c:\jjddj.exec:\jjddj.exe77⤵PID:2912
-
\??\c:\pddjv.exec:\pddjv.exe78⤵PID:1836
-
\??\c:\lrfxflx.exec:\lrfxflx.exe79⤵PID:2988
-
\??\c:\lllxlrf.exec:\lllxlrf.exe80⤵PID:2700
-
\??\c:\hhbnbh.exec:\hhbnbh.exe81⤵PID:2672
-
\??\c:\5bhhnn.exec:\5bhhnn.exe82⤵PID:2232
-
\??\c:\pjvvp.exec:\pjvvp.exe83⤵
- System Location Discovery: System Language Discovery
PID:2668 -
\??\c:\3jpjp.exec:\3jpjp.exe84⤵PID:2636
-
\??\c:\lxxrxlr.exec:\lxxrxlr.exe85⤵PID:2108
-
\??\c:\rlflrxf.exec:\rlflrxf.exe86⤵PID:2748
-
\??\c:\1tnbbn.exec:\1tnbbn.exe87⤵PID:2284
-
\??\c:\hbbtnt.exec:\hbbtnt.exe88⤵PID:2868
-
\??\c:\vvjvd.exec:\vvjvd.exe89⤵PID:3068
-
\??\c:\3ddpp.exec:\3ddpp.exe90⤵PID:1596
-
\??\c:\9xrlffr.exec:\9xrlffr.exe91⤵PID:2896
-
\??\c:\3lffrrf.exec:\3lffrrf.exe92⤵PID:3000
-
\??\c:\7thntb.exec:\7thntb.exe93⤵PID:3028
-
\??\c:\nnhbhb.exec:\nnhbhb.exe94⤵PID:2444
-
\??\c:\jjjvv.exec:\jjjvv.exe95⤵PID:1728
-
\??\c:\jvvvv.exec:\jvvvv.exe96⤵PID:2832
-
\??\c:\3xlrrfr.exec:\3xlrrfr.exe97⤵PID:348
-
\??\c:\fxxrfxf.exec:\fxxrfxf.exe98⤵PID:2116
-
\??\c:\7rrxffl.exec:\7rrxffl.exe99⤵PID:2164
-
\??\c:\9tnhtn.exec:\9tnhtn.exe100⤵PID:1040
-
\??\c:\bbhhbn.exec:\bbhhbn.exe101⤵PID:2144
-
\??\c:\1pvdd.exec:\1pvdd.exe102⤵PID:2552
-
\??\c:\jdvdv.exec:\jdvdv.exe103⤵PID:2012
-
\??\c:\xxxfllx.exec:\xxxfllx.exe104⤵PID:1052
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe105⤵PID:304
-
\??\c:\bnttbh.exec:\bnttbh.exe106⤵PID:1372
-
\??\c:\thtbhh.exec:\thtbhh.exe107⤵PID:2480
-
\??\c:\nbhhnt.exec:\nbhhnt.exe108⤵PID:2096
-
\??\c:\vvvdd.exec:\vvvdd.exe109⤵PID:1748
-
\??\c:\pdpvv.exec:\pdpvv.exe110⤵PID:1100
-
\??\c:\9xrlrrl.exec:\9xrlrrl.exe111⤵PID:484
-
\??\c:\5frlllr.exec:\5frlllr.exe112⤵PID:300
-
\??\c:\hbntnn.exec:\hbntnn.exe113⤵PID:1616
-
\??\c:\htbhbh.exec:\htbhbh.exe114⤵PID:1580
-
\??\c:\dpdvd.exec:\dpdvd.exe115⤵PID:2916
-
\??\c:\jvdvp.exec:\jvdvp.exe116⤵PID:580
-
\??\c:\1lflrfl.exec:\1lflrfl.exe117⤵PID:2740
-
\??\c:\ffxxllf.exec:\ffxxllf.exe118⤵PID:2932
-
\??\c:\7ttbth.exec:\7ttbth.exe119⤵PID:2816
-
\??\c:\1nbntn.exec:\1nbntn.exe120⤵PID:1852
-
\??\c:\vppjp.exec:\vppjp.exe121⤵PID:2728
-
\??\c:\vjppp.exec:\vjppp.exe122⤵PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-