Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 03:41
Static task
static1
Behavioral task
behavioral1
Sample
31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe
Resource
win7-20240903-en
General
-
Target
31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe
-
Size
71KB
-
MD5
66fa6c1fb1547424cebaef7242860150
-
SHA1
1c1dd06ff332fe1220277b6d065360582719cfc6
-
SHA256
31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871da
-
SHA512
4ab5bb1d0665d717954d87eafc4b2672add840c52452bbc077f06236a06c6c3fc2554c6709469d30a9b56de934b0713f05f6e93703c6a2441781b0e1405e2473
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3A89:ymb3NkkiQ3mdBjFI46TQ89
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2944-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3012 9pdpv.exe 1792 xlrrxfr.exe 2712 7htbnn.exe 2780 lllrlrl.exe 2840 rrxrxrf.exe 2652 9hnbnt.exe 3032 nhbhhn.exe 2536 jjdjp.exe 3036 fxlrflx.exe 1540 nbtnbh.exe 1984 5dvvd.exe 1940 9jdvv.exe 2088 flfrxlr.exe 1928 nnttbh.exe 484 bbbntb.exe 1908 3vjvj.exe 2972 flrffxr.exe 2572 rrlrrxr.exe 2428 7btntb.exe 3000 pjvdj.exe 1084 pdjdv.exe 1604 xfrxxxl.exe 944 3tnnnn.exe 2268 btthnn.exe 396 jdvdj.exe 1000 fxxxffr.exe 2168 5flrxfr.exe 876 7tthnn.exe 2944 jdpdp.exe 2444 rflrffr.exe 3008 1fxrfrx.exe 3064 nhnbhn.exe 1292 1jpvd.exe 2684 vjvdj.exe 2808 llflxxf.exe 2788 llxrxfr.exe 1276 nhnntb.exe 2636 hbnthb.exe 2588 vvvpd.exe 2552 ddjpj.exe 2988 fxxfrrl.exe 2992 frrrrrf.exe 1808 hbntbb.exe 1540 bbnbnn.exe 1984 1vppv.exe 1796 1jvdj.exe 2592 7rxxxfr.exe 1236 lllrxxl.exe 1928 btbhnt.exe 484 nhhbhh.exe 2876 1jvpp.exe 2404 ddppj.exe 2112 3fxllrx.exe 2412 llxxlfr.exe 2032 1hbhtb.exe 1656 nhhhtt.exe 672 1dvdj.exe 1596 vppvj.exe 372 frxfllf.exe 1992 xrflrxf.exe 1532 9bnthn.exe 904 ttbhnt.exe 860 vpvvv.exe 2484 vvjjd.exe -
resource yara_rule behavioral1/memory/2944-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-307-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 3012 2944 31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe 31 PID 2944 wrote to memory of 3012 2944 31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe 31 PID 2944 wrote to memory of 3012 2944 31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe 31 PID 2944 wrote to memory of 3012 2944 31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe 31 PID 3012 wrote to memory of 1792 3012 9pdpv.exe 32 PID 3012 wrote to memory of 1792 3012 9pdpv.exe 32 PID 3012 wrote to memory of 1792 3012 9pdpv.exe 32 PID 3012 wrote to memory of 1792 3012 9pdpv.exe 32 PID 1792 wrote to memory of 2712 1792 xlrrxfr.exe 33 PID 1792 wrote to memory of 2712 1792 xlrrxfr.exe 33 PID 1792 wrote to memory of 2712 1792 xlrrxfr.exe 33 PID 1792 wrote to memory of 2712 1792 xlrrxfr.exe 33 PID 2712 wrote to memory of 2780 2712 7htbnn.exe 34 PID 2712 wrote to memory of 2780 2712 7htbnn.exe 34 PID 2712 wrote to memory of 2780 2712 7htbnn.exe 34 PID 2712 wrote to memory of 2780 2712 7htbnn.exe 34 PID 2780 wrote to memory of 2840 2780 lllrlrl.exe 35 PID 2780 wrote to memory of 2840 2780 lllrlrl.exe 35 PID 2780 wrote to memory of 2840 2780 lllrlrl.exe 35 PID 2780 wrote to memory of 2840 2780 lllrlrl.exe 35 PID 2840 wrote to memory of 2652 2840 rrxrxrf.exe 36 PID 2840 wrote to memory of 2652 2840 rrxrxrf.exe 36 PID 2840 wrote to memory of 2652 2840 rrxrxrf.exe 36 PID 2840 wrote to memory of 2652 2840 rrxrxrf.exe 36 PID 2652 wrote to memory of 3032 2652 9hnbnt.exe 37 PID 2652 wrote to memory of 3032 2652 9hnbnt.exe 37 PID 2652 wrote to memory of 3032 2652 9hnbnt.exe 37 PID 2652 wrote to memory of 3032 2652 9hnbnt.exe 37 PID 3032 wrote to memory of 2536 3032 nhbhhn.exe 38 PID 3032 wrote to memory of 2536 3032 nhbhhn.exe 38 PID 3032 wrote to memory of 2536 3032 nhbhhn.exe 38 PID 3032 wrote to memory of 2536 3032 nhbhhn.exe 38 PID 2536 wrote to memory of 3036 2536 jjdjp.exe 39 PID 2536 wrote to memory of 3036 2536 jjdjp.exe 39 PID 2536 wrote to memory of 3036 2536 jjdjp.exe 39 PID 2536 wrote to memory of 3036 2536 jjdjp.exe 39 PID 3036 wrote to memory of 1540 3036 fxlrflx.exe 40 PID 3036 wrote to memory of 1540 3036 fxlrflx.exe 40 PID 3036 wrote to memory of 1540 3036 fxlrflx.exe 40 PID 3036 wrote to memory of 1540 3036 fxlrflx.exe 40 PID 1540 wrote to memory of 1984 1540 nbtnbh.exe 41 PID 1540 wrote to memory of 1984 1540 nbtnbh.exe 41 PID 1540 wrote to memory of 1984 1540 nbtnbh.exe 41 PID 1540 wrote to memory of 1984 1540 nbtnbh.exe 41 PID 1984 wrote to memory of 1940 1984 5dvvd.exe 42 PID 1984 wrote to memory of 1940 1984 5dvvd.exe 42 PID 1984 wrote to memory of 1940 1984 5dvvd.exe 42 PID 1984 wrote to memory of 1940 1984 5dvvd.exe 42 PID 1940 wrote to memory of 2088 1940 9jdvv.exe 43 PID 1940 wrote to memory of 2088 1940 9jdvv.exe 43 PID 1940 wrote to memory of 2088 1940 9jdvv.exe 43 PID 1940 wrote to memory of 2088 1940 9jdvv.exe 43 PID 2088 wrote to memory of 1928 2088 flfrxlr.exe 44 PID 2088 wrote to memory of 1928 2088 flfrxlr.exe 44 PID 2088 wrote to memory of 1928 2088 flfrxlr.exe 44 PID 2088 wrote to memory of 1928 2088 flfrxlr.exe 44 PID 1928 wrote to memory of 484 1928 nnttbh.exe 45 PID 1928 wrote to memory of 484 1928 nnttbh.exe 45 PID 1928 wrote to memory of 484 1928 nnttbh.exe 45 PID 1928 wrote to memory of 484 1928 nnttbh.exe 45 PID 484 wrote to memory of 1908 484 bbbntb.exe 46 PID 484 wrote to memory of 1908 484 bbbntb.exe 46 PID 484 wrote to memory of 1908 484 bbbntb.exe 46 PID 484 wrote to memory of 1908 484 bbbntb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe"C:\Users\Admin\AppData\Local\Temp\31fb62663d933be51a04f0a6d6f54e0b7288404babf7c27e12f7b4bcb56871daN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\9pdpv.exec:\9pdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xlrrxfr.exec:\xlrrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\7htbnn.exec:\7htbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\lllrlrl.exec:\lllrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rrxrxrf.exec:\rrxrxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\9hnbnt.exec:\9hnbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\nhbhhn.exec:\nhbhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jjdjp.exec:\jjdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\fxlrflx.exec:\fxlrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\nbtnbh.exec:\nbtnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\5dvvd.exec:\5dvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\9jdvv.exec:\9jdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\flfrxlr.exec:\flfrxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\nnttbh.exec:\nnttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\bbbntb.exec:\bbbntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\3vjvj.exec:\3vjvj.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\flrffxr.exec:\flrffxr.exe18⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe19⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7btntb.exec:\7btntb.exe20⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pjvdj.exec:\pjvdj.exe21⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pdjdv.exec:\pdjdv.exe22⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xfrxxxl.exec:\xfrxxxl.exe23⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3tnnnn.exec:\3tnnnn.exe24⤵
- Executes dropped EXE
PID:944 -
\??\c:\btthnn.exec:\btthnn.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdvdj.exec:\jdvdj.exe26⤵
- Executes dropped EXE
PID:396 -
\??\c:\fxxxffr.exec:\fxxxffr.exe27⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5flrxfr.exec:\5flrxfr.exe28⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7tthnn.exec:\7tthnn.exe29⤵
- Executes dropped EXE
PID:876 -
\??\c:\jdpdp.exec:\jdpdp.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rflrffr.exec:\rflrffr.exe31⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1fxrfrx.exec:\1fxrfrx.exe32⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nhnbhn.exec:\nhnbhn.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1jpvd.exec:\1jpvd.exe34⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vjvdj.exec:\vjvdj.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\llflxxf.exec:\llflxxf.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\llxrxfr.exec:\llxrxfr.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nhnntb.exec:\nhnntb.exe38⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbnthb.exec:\hbnthb.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vvvpd.exec:\vvvpd.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ddjpj.exec:\ddjpj.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxxfrrl.exec:\fxxfrrl.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\frrrrrf.exec:\frrrrrf.exe43⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hbntbb.exec:\hbntbb.exe44⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bbnbnn.exec:\bbnbnn.exe45⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1vppv.exec:\1vppv.exe46⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1jvdj.exec:\1jvdj.exe47⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7rxxxfr.exec:\7rxxxfr.exe48⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lllrxxl.exec:\lllrxxl.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\btbhnt.exec:\btbhnt.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nhhbhh.exec:\nhhbhh.exe51⤵
- Executes dropped EXE
PID:484 -
\??\c:\1jvpp.exec:\1jvpp.exe52⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddppj.exec:\ddppj.exe53⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3fxllrx.exec:\3fxllrx.exe54⤵
- Executes dropped EXE
PID:2112 -
\??\c:\llxxlfr.exec:\llxxlfr.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1hbhtb.exec:\1hbhtb.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhhhtt.exec:\nhhhtt.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\1dvdj.exec:\1dvdj.exe58⤵
- Executes dropped EXE
PID:672 -
\??\c:\vppvj.exec:\vppvj.exe59⤵
- Executes dropped EXE
PID:1596 -
\??\c:\frxfllf.exec:\frxfllf.exe60⤵
- Executes dropped EXE
PID:372 -
\??\c:\xrflrxf.exec:\xrflrxf.exe61⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9bnthn.exec:\9bnthn.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ttbhnt.exec:\ttbhnt.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\vpvvv.exec:\vpvvv.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\vvjjd.exec:\vvjjd.exe65⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lfflrfl.exec:\lfflrfl.exe66⤵PID:1044
-
\??\c:\fxflxff.exec:\fxflxff.exe67⤵PID:2964
-
\??\c:\1btbnt.exec:\1btbnt.exe68⤵PID:2956
-
\??\c:\bbnbbh.exec:\bbnbbh.exe69⤵PID:1444
-
\??\c:\pjjpp.exec:\pjjpp.exe70⤵PID:2188
-
\??\c:\vpvpd.exec:\vpvpd.exe71⤵PID:2856
-
\??\c:\llxrffx.exec:\llxrffx.exe72⤵PID:3048
-
\??\c:\xrrrxfx.exec:\xrrrxfx.exe73⤵PID:2252
-
\??\c:\bhbbbh.exec:\bhbbbh.exe74⤵PID:2796
-
\??\c:\nnhhnt.exec:\nnhhnt.exe75⤵PID:2808
-
\??\c:\dvpjv.exec:\dvpjv.exe76⤵PID:2780
-
\??\c:\jdpjd.exec:\jdpjd.exe77⤵PID:1276
-
\??\c:\llxfllr.exec:\llxfllr.exe78⤵PID:2556
-
\??\c:\9fxlfll.exec:\9fxlfll.exe79⤵PID:2588
-
\??\c:\nhnhbb.exec:\nhnhbb.exe80⤵PID:2564
-
\??\c:\ttthhn.exec:\ttthhn.exe81⤵PID:2988
-
\??\c:\5vpvv.exec:\5vpvv.exe82⤵PID:2384
-
\??\c:\7jppp.exec:\7jppp.exe83⤵PID:1988
-
\??\c:\xlffffl.exec:\xlffffl.exe84⤵PID:2060
-
\??\c:\xxrlrlr.exec:\xxrlrlr.exe85⤵PID:1984
-
\??\c:\bbnhtt.exec:\bbnhtt.exe86⤵PID:2440
-
\??\c:\nhtbbb.exec:\nhtbbb.exe87⤵PID:1736
-
\??\c:\vppvj.exec:\vppvj.exe88⤵
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\vjddj.exec:\vjddj.exe89⤵PID:1928
-
\??\c:\9rxfllx.exec:\9rxfllx.exe90⤵PID:2016
-
\??\c:\rlflrxl.exec:\rlflrxl.exe91⤵PID:2876
-
\??\c:\hhnhtb.exec:\hhnhtb.exe92⤵PID:2976
-
\??\c:\bthntb.exec:\bthntb.exe93⤵
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\1jdvj.exec:\1jdvj.exe94⤵PID:956
-
\??\c:\ppdvd.exec:\ppdvd.exe95⤵PID:2032
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe96⤵PID:2400
-
\??\c:\rrlxrxf.exec:\rrlxrxf.exe97⤵PID:2224
-
\??\c:\ttntbb.exec:\ttntbb.exe98⤵PID:276
-
\??\c:\tbtbbh.exec:\tbtbbh.exe99⤵PID:372
-
\??\c:\ppdjv.exec:\ppdjv.exe100⤵PID:836
-
\??\c:\7jdvd.exec:\7jdvd.exe101⤵PID:1532
-
\??\c:\lfxrxfr.exec:\lfxrxfr.exe102⤵PID:2340
-
\??\c:\lxfxrxf.exec:\lxfxrxf.exe103⤵PID:860
-
\??\c:\tnttbt.exec:\tnttbt.exe104⤵PID:1684
-
\??\c:\nntntn.exec:\nntntn.exe105⤵PID:2612
-
\??\c:\pdjjj.exec:\pdjjj.exe106⤵PID:2276
-
\??\c:\vjddd.exec:\vjddd.exe107⤵PID:2956
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe108⤵PID:3024
-
\??\c:\ffflrxr.exec:\ffflrxr.exe109⤵PID:1712
-
\??\c:\3lxfffr.exec:\3lxfffr.exe110⤵PID:2164
-
\??\c:\nhhhtb.exec:\nhhhtb.exe111⤵PID:3048
-
\??\c:\tnbbhn.exec:\tnbbhn.exe112⤵PID:2784
-
\??\c:\ddddd.exec:\ddddd.exe113⤵PID:2684
-
\??\c:\dddjv.exec:\dddjv.exe114⤵PID:2540
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe115⤵PID:2780
-
\??\c:\ffrrxxr.exec:\ffrrxxr.exe116⤵PID:2884
-
\??\c:\nhtthb.exec:\nhtthb.exe117⤵PID:2636
-
\??\c:\5nbbbb.exec:\5nbbbb.exe118⤵PID:2532
-
\??\c:\dpvvv.exec:\dpvvv.exe119⤵PID:1316
-
\??\c:\pjvvj.exec:\pjvvj.exe120⤵PID:2508
-
\??\c:\rlxlxxr.exec:\rlxlxxr.exe121⤵PID:1808
-
\??\c:\fxfxllr.exec:\fxfxllr.exe122⤵PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-