Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
Resource
win7-20240903-en
General
-
Target
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe
-
Size
83KB
-
MD5
cc843f29569041b4c5f5cfbda3acbbba
-
SHA1
00f60f53883096623fd59c71beebb5dd172f2e03
-
SHA256
ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f
-
SHA512
95c7f249f15992a059ba2e5c43f201ffa5319267ab2563cef62ed43654f4899bc0ff2eff4040fb23d602a8b20524684c18cb8d49c2f8f2b8a915e47b6eb6ca18
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QR:ymb3NkkiQ3mdBjFIIp9L9QrrA8m
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2124-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2648 bthhnn.exe 2220 5dpvd.exe 2760 3xxfxfx.exe 2776 nbntnb.exe 2692 dvjpv.exe 2852 7jdjp.exe 2592 rlxflxf.exe 2564 7nhhnn.exe 3012 jjdpj.exe 1940 ffxfrrf.exe 2104 lllxxxl.exe 1712 tthnhn.exe 1696 vppvj.exe 672 pjjjp.exe 1096 rxrrlxf.exe 1296 3xlrxxf.exe 2008 9tnbbb.exe 1852 nbtntt.exe 2264 djdvv.exe 2420 3djvv.exe 1516 dpvdj.exe 1956 5xrxxxx.exe 1760 frxxxxl.exe 1028 9bhhnh.exe 1920 vjvdv.exe 2080 jdjjp.exe 2152 lxfxfff.exe 1932 lfxrrfx.exe 2928 bbbtth.exe 2016 5tbttt.exe 1512 dvdjv.exe 2424 pdpvj.exe 2220 llrlfrl.exe 3044 5nbbbh.exe 2724 dddpj.exe 2892 dvjpv.exe 2144 jdjdv.exe 2604 5lrfflr.exe 2852 frfrxlf.exe 2572 nbnnbt.exe 2600 1bnttb.exe 2580 5pjvj.exe 1948 pdppv.exe 2612 vpdjv.exe 1936 lrfxxxf.exe 796 9frxlll.exe 2364 httthh.exe 1788 hhnhtn.exe 1660 pjdpd.exe 1984 jvpdj.exe 1452 1rlrxfr.exe 1296 3xxfllf.exe 1144 llflrfl.exe 2088 3nnbht.exe 2656 hhnnnh.exe 1944 ddvpv.exe 2420 xxlrxxf.exe 1084 1lrrlxr.exe 1976 tnbhtb.exe 1868 vvpdp.exe 2260 ppdpd.exe 964 1ffrlrf.exe 2128 btntbb.exe 2356 btnttb.exe -
resource yara_rule behavioral1/memory/2124-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2648 2124 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 2124 wrote to memory of 2648 2124 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 2124 wrote to memory of 2648 2124 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 2124 wrote to memory of 2648 2124 ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe 31 PID 2648 wrote to memory of 2220 2648 bthhnn.exe 32 PID 2648 wrote to memory of 2220 2648 bthhnn.exe 32 PID 2648 wrote to memory of 2220 2648 bthhnn.exe 32 PID 2648 wrote to memory of 2220 2648 bthhnn.exe 32 PID 2220 wrote to memory of 2760 2220 5dpvd.exe 33 PID 2220 wrote to memory of 2760 2220 5dpvd.exe 33 PID 2220 wrote to memory of 2760 2220 5dpvd.exe 33 PID 2220 wrote to memory of 2760 2220 5dpvd.exe 33 PID 2760 wrote to memory of 2776 2760 3xxfxfx.exe 34 PID 2760 wrote to memory of 2776 2760 3xxfxfx.exe 34 PID 2760 wrote to memory of 2776 2760 3xxfxfx.exe 34 PID 2760 wrote to memory of 2776 2760 3xxfxfx.exe 34 PID 2776 wrote to memory of 2692 2776 nbntnb.exe 35 PID 2776 wrote to memory of 2692 2776 nbntnb.exe 35 PID 2776 wrote to memory of 2692 2776 nbntnb.exe 35 PID 2776 wrote to memory of 2692 2776 nbntnb.exe 35 PID 2692 wrote to memory of 2852 2692 dvjpv.exe 36 PID 2692 wrote to memory of 2852 2692 dvjpv.exe 36 PID 2692 wrote to memory of 2852 2692 dvjpv.exe 36 PID 2692 wrote to memory of 2852 2692 dvjpv.exe 36 PID 2852 wrote to memory of 2592 2852 7jdjp.exe 37 PID 2852 wrote to memory of 2592 2852 7jdjp.exe 37 PID 2852 wrote to memory of 2592 2852 7jdjp.exe 37 PID 2852 wrote to memory of 2592 2852 7jdjp.exe 37 PID 2592 wrote to memory of 2564 2592 rlxflxf.exe 38 PID 2592 wrote to memory of 2564 2592 rlxflxf.exe 38 PID 2592 wrote to memory of 2564 2592 rlxflxf.exe 38 PID 2592 wrote to memory of 2564 2592 rlxflxf.exe 38 PID 2564 wrote to memory of 3012 2564 7nhhnn.exe 39 PID 2564 wrote to memory of 3012 2564 7nhhnn.exe 39 PID 2564 wrote to memory of 3012 2564 7nhhnn.exe 39 PID 2564 wrote to memory of 3012 2564 7nhhnn.exe 39 PID 3012 wrote to memory of 1940 3012 jjdpj.exe 40 PID 3012 wrote to memory of 1940 3012 jjdpj.exe 40 PID 3012 wrote to memory of 1940 3012 jjdpj.exe 40 PID 3012 wrote to memory of 1940 3012 jjdpj.exe 40 PID 1940 wrote to memory of 2104 1940 ffxfrrf.exe 41 PID 1940 wrote to memory of 2104 1940 ffxfrrf.exe 41 PID 1940 wrote to memory of 2104 1940 ffxfrrf.exe 41 PID 1940 wrote to memory of 2104 1940 ffxfrrf.exe 41 PID 2104 wrote to memory of 1712 2104 lllxxxl.exe 42 PID 2104 wrote to memory of 1712 2104 lllxxxl.exe 42 PID 2104 wrote to memory of 1712 2104 lllxxxl.exe 42 PID 2104 wrote to memory of 1712 2104 lllxxxl.exe 42 PID 1712 wrote to memory of 1696 1712 tthnhn.exe 43 PID 1712 wrote to memory of 1696 1712 tthnhn.exe 43 PID 1712 wrote to memory of 1696 1712 tthnhn.exe 43 PID 1712 wrote to memory of 1696 1712 tthnhn.exe 43 PID 1696 wrote to memory of 672 1696 vppvj.exe 44 PID 1696 wrote to memory of 672 1696 vppvj.exe 44 PID 1696 wrote to memory of 672 1696 vppvj.exe 44 PID 1696 wrote to memory of 672 1696 vppvj.exe 44 PID 672 wrote to memory of 1096 672 pjjjp.exe 45 PID 672 wrote to memory of 1096 672 pjjjp.exe 45 PID 672 wrote to memory of 1096 672 pjjjp.exe 45 PID 672 wrote to memory of 1096 672 pjjjp.exe 45 PID 1096 wrote to memory of 1296 1096 rxrrlxf.exe 46 PID 1096 wrote to memory of 1296 1096 rxrrlxf.exe 46 PID 1096 wrote to memory of 1296 1096 rxrrlxf.exe 46 PID 1096 wrote to memory of 1296 1096 rxrrlxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"C:\Users\Admin\AppData\Local\Temp\ed7c02b0daba63b50f72c38f6885c144d5bd93fdd3eb30d04a29d4197d77164f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\bthhnn.exec:\bthhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\5dpvd.exec:\5dpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\3xxfxfx.exec:\3xxfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nbntnb.exec:\nbntnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\dvjpv.exec:\dvjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7jdjp.exec:\7jdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rlxflxf.exec:\rlxflxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\7nhhnn.exec:\7nhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jjdpj.exec:\jjdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\lllxxxl.exec:\lllxxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\tthnhn.exec:\tthnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vppvj.exec:\vppvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\pjjjp.exec:\pjjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\rxrrlxf.exec:\rxrrlxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\3xlrxxf.exec:\3xlrxxf.exe17⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9tnbbb.exec:\9tnbbb.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nbtntt.exec:\nbtntt.exe19⤵
- Executes dropped EXE
PID:1852 -
\??\c:\djdvv.exec:\djdvv.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3djvv.exec:\3djvv.exe21⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dpvdj.exec:\dpvdj.exe22⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5xrxxxx.exec:\5xrxxxx.exe23⤵
- Executes dropped EXE
PID:1956 -
\??\c:\frxxxxl.exec:\frxxxxl.exe24⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9bhhnh.exec:\9bhhnh.exe25⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vjvdv.exec:\vjvdv.exe26⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jdjjp.exec:\jdjjp.exe27⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lxfxfff.exec:\lxfxfff.exe28⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lfxrrfx.exec:\lfxrrfx.exe29⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bbbtth.exec:\bbbtth.exe30⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5tbttt.exec:\5tbttt.exe31⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvdjv.exec:\dvdjv.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\pdpvj.exec:\pdpvj.exe33⤵
- Executes dropped EXE
PID:2424 -
\??\c:\llrlfrl.exec:\llrlfrl.exe34⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5nbbbh.exec:\5nbbbh.exe35⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dddpj.exec:\dddpj.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dvjpv.exec:\dvjpv.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdjdv.exec:\jdjdv.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\5lrfflr.exec:\5lrfflr.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\frfrxlf.exec:\frfrxlf.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nbnnbt.exec:\nbnnbt.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1bnttb.exec:\1bnttb.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5pjvj.exec:\5pjvj.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pdppv.exec:\pdppv.exe44⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpdjv.exec:\vpdjv.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lrfxxxf.exec:\lrfxxxf.exe46⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9frxlll.exec:\9frxlll.exe47⤵
- Executes dropped EXE
PID:796 -
\??\c:\httthh.exec:\httthh.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhnhtn.exec:\hhnhtn.exe49⤵
- Executes dropped EXE
PID:1788 -
\??\c:\pjdpd.exec:\pjdpd.exe50⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jvpdj.exec:\jvpdj.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1rlrxfr.exec:\1rlrxfr.exe52⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3xxfllf.exec:\3xxfllf.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1296 -
\??\c:\llflrfl.exec:\llflrfl.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3nnbht.exec:\3nnbht.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hhnnnh.exec:\hhnnnh.exe56⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ddvpv.exec:\ddvpv.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\1lrrlxr.exec:\1lrrlxr.exe59⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tnbhtb.exec:\tnbhtb.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vvpdp.exec:\vvpdp.exe61⤵
- Executes dropped EXE
PID:1868 -
\??\c:\ppdpd.exec:\ppdpd.exe62⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1ffrlrf.exec:\1ffrlrf.exe63⤵
- Executes dropped EXE
PID:964 -
\??\c:\btntbb.exec:\btntbb.exe64⤵
- Executes dropped EXE
PID:2128 -
\??\c:\btnttb.exec:\btnttb.exe65⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ddjpd.exec:\ddjpd.exe66⤵PID:1844
-
\??\c:\pjjjp.exec:\pjjjp.exe67⤵PID:1916
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe68⤵PID:2124
-
\??\c:\3nbthh.exec:\3nbthh.exe69⤵PID:2928
-
\??\c:\thhnhb.exec:\thhnhb.exe70⤵PID:2116
-
\??\c:\7vjdj.exec:\7vjdj.exe71⤵PID:1692
-
\??\c:\ddpdd.exec:\ddpdd.exe72⤵PID:2268
-
\??\c:\xlrrfxf.exec:\xlrrfxf.exe73⤵PID:2444
-
\??\c:\5frxlfr.exec:\5frxlfr.exe74⤵PID:2996
-
\??\c:\1thnbn.exec:\1thnbn.exe75⤵PID:3044
-
\??\c:\7hnnnn.exec:\7hnnnn.exe76⤵
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\jddpd.exec:\jddpd.exe77⤵PID:2836
-
\??\c:\1xxllfl.exec:\1xxllfl.exe78⤵PID:2144
-
\??\c:\7rxflff.exec:\7rxflff.exe79⤵PID:2596
-
\??\c:\nhnhtb.exec:\nhnhtb.exe80⤵PID:2704
-
\??\c:\tnhnbb.exec:\tnhnbb.exe81⤵PID:2584
-
\??\c:\pdpjp.exec:\pdpjp.exe82⤵PID:2624
-
\??\c:\pjvpj.exec:\pjvpj.exe83⤵PID:2564
-
\??\c:\lflxxxl.exec:\lflxxxl.exe84⤵PID:1948
-
\??\c:\7fxflrx.exec:\7fxflrx.exe85⤵PID:2224
-
\??\c:\tnbbhh.exec:\tnbbhh.exe86⤵PID:1940
-
\??\c:\tthhtn.exec:\tthhtn.exe87⤵PID:1672
-
\??\c:\pdddd.exec:\pdddd.exe88⤵PID:1696
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe89⤵PID:1604
-
\??\c:\tnbbnt.exec:\tnbbnt.exe90⤵PID:1660
-
\??\c:\bbhnbt.exec:\bbhnbt.exe91⤵PID:1984
-
\??\c:\1pjjj.exec:\1pjjj.exe92⤵PID:1452
-
\??\c:\5dddv.exec:\5dddv.exe93⤵PID:2316
-
\??\c:\xrllllx.exec:\xrllllx.exe94⤵PID:1144
-
\??\c:\7fxflrf.exec:\7fxflrf.exe95⤵PID:2396
-
\??\c:\7bnhhn.exec:\7bnhhn.exe96⤵PID:2656
-
\??\c:\nhnhnh.exec:\nhnhnh.exe97⤵PID:2272
-
\??\c:\7djvd.exec:\7djvd.exe98⤵PID:2420
-
\??\c:\fxxxflr.exec:\fxxxflr.exe99⤵PID:1624
-
\??\c:\lxxxffl.exec:\lxxxffl.exe100⤵PID:1976
-
\??\c:\nbnbhn.exec:\nbnbhn.exe101⤵PID:1892
-
\??\c:\7bhhnt.exec:\7bhhnt.exe102⤵PID:2260
-
\??\c:\vjjvv.exec:\vjjvv.exe103⤵PID:1784
-
\??\c:\vvpvp.exec:\vvpvp.exe104⤵PID:2128
-
\??\c:\xrrxllr.exec:\xrrxllr.exe105⤵PID:1748
-
\??\c:\bbbhhb.exec:\bbbhhb.exe106⤵PID:1844
-
\??\c:\tnhbnt.exec:\tnhbnt.exe107⤵PID:2240
-
\??\c:\5dppv.exec:\5dppv.exe108⤵PID:2124
-
\??\c:\vdpjd.exec:\vdpjd.exe109⤵PID:1580
-
\??\c:\rlflrrx.exec:\rlflrrx.exe110⤵PID:2880
-
\??\c:\7tnbnt.exec:\7tnbnt.exe111⤵PID:2156
-
\??\c:\5btnnn.exec:\5btnnn.exe112⤵PID:2268
-
\??\c:\pjppj.exec:\pjppj.exe113⤵PID:2220
-
\??\c:\pjvdd.exec:\pjvdd.exe114⤵PID:2780
-
\??\c:\xrlxllr.exec:\xrlxllr.exe115⤵PID:2816
-
\??\c:\ththhn.exec:\ththhn.exe116⤵PID:2728
-
\??\c:\nbhhbn.exec:\nbhhbn.exe117⤵PID:2764
-
\??\c:\ddvdv.exec:\ddvdv.exe118⤵PID:2144
-
\??\c:\fxrfflx.exec:\fxrfflx.exe119⤵PID:2604
-
\??\c:\xxrrlfl.exec:\xxrrlfl.exe120⤵PID:2852
-
\??\c:\tnbhnh.exec:\tnbhnh.exe121⤵PID:2572
-
\??\c:\btbbtn.exec:\btbbtn.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-