Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe
Resource
win7-20240903-en
General
-
Target
90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe
-
Size
81KB
-
MD5
d2b4f6f679f26d1c45f59bc6ddfe0258
-
SHA1
310c393478aee3411b866c49861b17787e27e736
-
SHA256
90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b
-
SHA512
087e3ac22285a33527cf975a86442837e9e371826a2594e3d562dc1eebcc72b6113db98c338eb8aafd53bc3b5115224f8ee7c54432647a8943804511cef5cfcf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqT:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2424-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-84-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 9vvdj.exe 2800 pjvvv.exe 2560 20446.exe 2896 08068.exe 2608 rlllrxf.exe 2596 042846.exe 2848 jdvpv.exe 576 1nbbht.exe 2908 08068.exe 3044 nhnnnb.exe 2368 nhbhtb.exe 1796 bbnhtt.exe 2440 c468444.exe 1516 nhttnb.exe 2872 82620.exe 2272 3xrfffx.exe 264 20840.exe 2964 868888.exe 2024 486806.exe 2364 tnttnb.exe 2212 pjvvd.exe 2984 26064.exe 1984 08662.exe 1812 q64682.exe 1752 26408.exe 616 xrffrrf.exe 760 bthntt.exe 2344 g6844.exe 996 fxrxllx.exe 900 5jpvj.exe 2864 4866280.exe 2288 a2244.exe 2756 g8624.exe 1600 7lfflfl.exe 2796 5frxlfr.exe 2392 c466828.exe 2920 lfxfxrf.exe 2668 0466880.exe 2564 2684602.exe 2676 tnhtht.exe 2196 pdvvd.exe 1672 420624.exe 2820 c800228.exe 3004 86840.exe 3044 0460062.exe 2828 jdjvp.exe 328 jdppj.exe 1496 2088884.exe 1640 w00688.exe 2868 hbhhhb.exe 2832 04680.exe 1484 08628.exe 1048 7pdjj.exe 2356 5rxfffl.exe 2964 0424222.exe 1156 rrlrxxf.exe 2096 rfxxffl.exe 1064 480628.exe 2044 btnntn.exe 1056 862628.exe 1320 tnnhhh.exe 2940 868888.exe 1728 a2064.exe 1248 pjjjj.exe -
resource yara_rule behavioral1/memory/2424-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k66828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6422842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8280068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w40666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0466880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g0840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4206622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6466228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4244062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2696 2424 90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe 30 PID 2424 wrote to memory of 2696 2424 90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe 30 PID 2424 wrote to memory of 2696 2424 90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe 30 PID 2424 wrote to memory of 2696 2424 90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe 30 PID 2696 wrote to memory of 2800 2696 9vvdj.exe 31 PID 2696 wrote to memory of 2800 2696 9vvdj.exe 31 PID 2696 wrote to memory of 2800 2696 9vvdj.exe 31 PID 2696 wrote to memory of 2800 2696 9vvdj.exe 31 PID 2800 wrote to memory of 2560 2800 pjvvv.exe 32 PID 2800 wrote to memory of 2560 2800 pjvvv.exe 32 PID 2800 wrote to memory of 2560 2800 pjvvv.exe 32 PID 2800 wrote to memory of 2560 2800 pjvvv.exe 32 PID 2560 wrote to memory of 2896 2560 20446.exe 33 PID 2560 wrote to memory of 2896 2560 20446.exe 33 PID 2560 wrote to memory of 2896 2560 20446.exe 33 PID 2560 wrote to memory of 2896 2560 20446.exe 33 PID 2896 wrote to memory of 2608 2896 08068.exe 34 PID 2896 wrote to memory of 2608 2896 08068.exe 34 PID 2896 wrote to memory of 2608 2896 08068.exe 34 PID 2896 wrote to memory of 2608 2896 08068.exe 34 PID 2608 wrote to memory of 2596 2608 rlllrxf.exe 35 PID 2608 wrote to memory of 2596 2608 rlllrxf.exe 35 PID 2608 wrote to memory of 2596 2608 rlllrxf.exe 35 PID 2608 wrote to memory of 2596 2608 rlllrxf.exe 35 PID 2596 wrote to memory of 2848 2596 042846.exe 36 PID 2596 wrote to memory of 2848 2596 042846.exe 36 PID 2596 wrote to memory of 2848 2596 042846.exe 36 PID 2596 wrote to memory of 2848 2596 042846.exe 36 PID 2848 wrote to memory of 576 2848 jdvpv.exe 37 PID 2848 wrote to memory of 576 2848 jdvpv.exe 37 PID 2848 wrote to memory of 576 2848 jdvpv.exe 37 PID 2848 wrote to memory of 576 2848 jdvpv.exe 37 PID 576 wrote to memory of 2908 576 1nbbht.exe 38 PID 576 wrote to memory of 2908 576 1nbbht.exe 38 PID 576 wrote to memory of 2908 576 1nbbht.exe 38 PID 576 wrote to memory of 2908 576 1nbbht.exe 38 PID 2908 wrote to memory of 3044 2908 08068.exe 39 PID 2908 wrote to memory of 3044 2908 08068.exe 39 PID 2908 wrote to memory of 3044 2908 08068.exe 39 PID 2908 wrote to memory of 3044 2908 08068.exe 39 PID 3044 wrote to memory of 2368 3044 nhnnnb.exe 40 PID 3044 wrote to memory of 2368 3044 nhnnnb.exe 40 PID 3044 wrote to memory of 2368 3044 nhnnnb.exe 40 PID 3044 wrote to memory of 2368 3044 nhnnnb.exe 40 PID 2368 wrote to memory of 1796 2368 nhbhtb.exe 41 PID 2368 wrote to memory of 1796 2368 nhbhtb.exe 41 PID 2368 wrote to memory of 1796 2368 nhbhtb.exe 41 PID 2368 wrote to memory of 1796 2368 nhbhtb.exe 41 PID 1796 wrote to memory of 2440 1796 bbnhtt.exe 42 PID 1796 wrote to memory of 2440 1796 bbnhtt.exe 42 PID 1796 wrote to memory of 2440 1796 bbnhtt.exe 42 PID 1796 wrote to memory of 2440 1796 bbnhtt.exe 42 PID 2440 wrote to memory of 1516 2440 c468444.exe 43 PID 2440 wrote to memory of 1516 2440 c468444.exe 43 PID 2440 wrote to memory of 1516 2440 c468444.exe 43 PID 2440 wrote to memory of 1516 2440 c468444.exe 43 PID 1516 wrote to memory of 2872 1516 nhttnb.exe 44 PID 1516 wrote to memory of 2872 1516 nhttnb.exe 44 PID 1516 wrote to memory of 2872 1516 nhttnb.exe 44 PID 1516 wrote to memory of 2872 1516 nhttnb.exe 44 PID 2872 wrote to memory of 2272 2872 82620.exe 45 PID 2872 wrote to memory of 2272 2872 82620.exe 45 PID 2872 wrote to memory of 2272 2872 82620.exe 45 PID 2872 wrote to memory of 2272 2872 82620.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe"C:\Users\Admin\AppData\Local\Temp\90cca53dda68a2defa24dedfb9e313c9b1e4a59bf1eb9cc29c051913bf2b4e9b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\9vvdj.exec:\9vvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjvvv.exec:\pjvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\20446.exec:\20446.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\08068.exec:\08068.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\rlllrxf.exec:\rlllrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\042846.exec:\042846.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jdvpv.exec:\jdvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1nbbht.exec:\1nbbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\08068.exec:\08068.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nhnnnb.exec:\nhnnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\nhbhtb.exec:\nhbhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\bbnhtt.exec:\bbnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\c468444.exec:\c468444.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nhttnb.exec:\nhttnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\82620.exec:\82620.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\3xrfffx.exec:\3xrfffx.exe17⤵
- Executes dropped EXE
PID:2272 -
\??\c:\20840.exec:\20840.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\868888.exec:\868888.exe19⤵
- Executes dropped EXE
PID:2964 -
\??\c:\486806.exec:\486806.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnttnb.exec:\tnttnb.exe21⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pjvvd.exec:\pjvvd.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\26064.exec:\26064.exe23⤵
- Executes dropped EXE
PID:2984 -
\??\c:\08662.exec:\08662.exe24⤵
- Executes dropped EXE
PID:1984 -
\??\c:\q64682.exec:\q64682.exe25⤵
- Executes dropped EXE
PID:1812 -
\??\c:\26408.exec:\26408.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xrffrrf.exec:\xrffrrf.exe27⤵
- Executes dropped EXE
PID:616 -
\??\c:\bthntt.exec:\bthntt.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\g6844.exec:\g6844.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxrxllx.exec:\fxrxllx.exe30⤵
- Executes dropped EXE
PID:996 -
\??\c:\5jpvj.exec:\5jpvj.exe31⤵
- Executes dropped EXE
PID:900 -
\??\c:\4866280.exec:\4866280.exe32⤵
- Executes dropped EXE
PID:2864 -
\??\c:\a2244.exec:\a2244.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\g8624.exec:\g8624.exe34⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7lfflfl.exec:\7lfflfl.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5frxlfr.exec:\5frxlfr.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\c466828.exec:\c466828.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lfxfxrf.exec:\lfxfxrf.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\0466880.exec:\0466880.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668 -
\??\c:\2684602.exec:\2684602.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\tnhtht.exec:\tnhtht.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pdvvd.exec:\pdvvd.exe42⤵
- Executes dropped EXE
PID:2196 -
\??\c:\420624.exec:\420624.exe43⤵
- Executes dropped EXE
PID:1672 -
\??\c:\c800228.exec:\c800228.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\86840.exec:\86840.exe45⤵
- Executes dropped EXE
PID:3004 -
\??\c:\0460062.exec:\0460062.exe46⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jdjvp.exec:\jdjvp.exe47⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jdppj.exec:\jdppj.exe48⤵
- Executes dropped EXE
PID:328 -
\??\c:\2088884.exec:\2088884.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\w00688.exec:\w00688.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbhhhb.exec:\hbhhhb.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\04680.exec:\04680.exe52⤵
- Executes dropped EXE
PID:2832 -
\??\c:\08628.exec:\08628.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7pdjj.exec:\7pdjj.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5rxfffl.exec:\5rxfffl.exe55⤵
- Executes dropped EXE
PID:2356 -
\??\c:\0424222.exec:\0424222.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rfxxffl.exec:\rfxxffl.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\480628.exec:\480628.exe59⤵
- Executes dropped EXE
PID:1064 -
\??\c:\btnntn.exec:\btnntn.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\862628.exec:\862628.exe61⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tnnhhh.exec:\tnnhhh.exe62⤵
- Executes dropped EXE
PID:1320 -
\??\c:\868888.exec:\868888.exe63⤵
- Executes dropped EXE
PID:2940 -
\??\c:\a2064.exec:\a2064.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pjjjj.exec:\pjjjj.exe65⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jvjjp.exec:\jvjjp.exe66⤵PID:2100
-
\??\c:\lrrfrfr.exec:\lrrfrfr.exe67⤵PID:2000
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe68⤵PID:2344
-
\??\c:\xlfflfr.exec:\xlfflfr.exe69⤵PID:2084
-
\??\c:\20668.exec:\20668.exe70⤵PID:996
-
\??\c:\1dpvd.exec:\1dpvd.exe71⤵PID:2076
-
\??\c:\4684068.exec:\4684068.exe72⤵PID:2664
-
\??\c:\pjpjp.exec:\pjpjp.exe73⤵PID:2456
-
\??\c:\dvpvd.exec:\dvpvd.exe74⤵PID:2776
-
\??\c:\2688488.exec:\2688488.exe75⤵PID:2772
-
\??\c:\0206264.exec:\0206264.exe76⤵PID:2748
-
\??\c:\00602.exec:\00602.exe77⤵PID:2580
-
\??\c:\446284.exec:\446284.exe78⤵PID:2588
-
\??\c:\c420062.exec:\c420062.exe79⤵PID:2556
-
\??\c:\xlxflll.exec:\xlxflll.exe80⤵PID:2584
-
\??\c:\268022.exec:\268022.exe81⤵PID:3028
-
\??\c:\xlffrlr.exec:\xlffrlr.exe82⤵PID:1532
-
\??\c:\828060.exec:\828060.exe83⤵PID:2892
-
\??\c:\7btbhn.exec:\7btbhn.exe84⤵PID:2912
-
\??\c:\242286.exec:\242286.exe85⤵
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\c800242.exec:\c800242.exe86⤵PID:484
-
\??\c:\ntbbbh.exec:\ntbbbh.exe87⤵PID:1168
-
\??\c:\rlxxfrx.exec:\rlxxfrx.exe88⤵PID:1632
-
\??\c:\1pjvd.exec:\1pjvd.exe89⤵PID:1244
-
\??\c:\a8000.exec:\a8000.exe90⤵PID:2072
-
\??\c:\5lfffrx.exec:\5lfffrx.exe91⤵PID:1516
-
\??\c:\rfxrflr.exec:\rfxrflr.exe92⤵PID:820
-
\??\c:\hbhntt.exec:\hbhntt.exe93⤵PID:1636
-
\??\c:\thttbn.exec:\thttbn.exe94⤵PID:2016
-
\??\c:\tnhhbb.exec:\tnhhbb.exe95⤵PID:1048
-
\??\c:\44804.exec:\44804.exe96⤵PID:2268
-
\??\c:\820622.exec:\820622.exe97⤵PID:1256
-
\??\c:\pdppv.exec:\pdppv.exe98⤵PID:2364
-
\??\c:\fxllrlr.exec:\fxllrlr.exe99⤵PID:1944
-
\??\c:\828464.exec:\828464.exe100⤵PID:2176
-
\??\c:\rflxffl.exec:\rflxffl.exe101⤵PID:1896
-
\??\c:\6866222.exec:\6866222.exe102⤵PID:1972
-
\??\c:\0804062.exec:\0804062.exe103⤵PID:1312
-
\??\c:\i400222.exec:\i400222.exe104⤵PID:1920
-
\??\c:\dvjjp.exec:\dvjjp.exe105⤵PID:2300
-
\??\c:\u666006.exec:\u666006.exe106⤵PID:2412
-
\??\c:\u084046.exec:\u084046.exe107⤵PID:1784
-
\??\c:\9rfffff.exec:\9rfffff.exe108⤵PID:2104
-
\??\c:\vpddp.exec:\vpddp.exe109⤵PID:1976
-
\??\c:\fxlrxxx.exec:\fxlrxxx.exe110⤵PID:888
-
\??\c:\5frxflx.exec:\5frxflx.exe111⤵PID:1968
-
\??\c:\2068806.exec:\2068806.exe112⤵PID:2864
-
\??\c:\btntbh.exec:\btntbh.exe113⤵PID:2456
-
\??\c:\6426246.exec:\6426246.exe114⤵PID:1588
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe115⤵PID:1716
-
\??\c:\lfrfffl.exec:\lfrfffl.exe116⤵PID:2852
-
\??\c:\9btntn.exec:\9btntn.exe117⤵PID:2116
-
\??\c:\pjjpp.exec:\pjjpp.exe118⤵PID:2780
-
\??\c:\nbbbhb.exec:\nbbbhb.exe119⤵PID:2668
-
\??\c:\6426884.exec:\6426884.exe120⤵PID:2608
-
\??\c:\8684062.exec:\8684062.exe121⤵PID:812
-
\??\c:\e86682.exec:\e86682.exe122⤵PID:1360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-