Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe
Resource
win7-20240903-en
General
-
Target
8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe
-
Size
67KB
-
MD5
df8b88fb741ef858f4868d7e64e878d5
-
SHA1
89abebe428318bdc93cafae3f4696da2ed37e873
-
SHA256
8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9
-
SHA512
f98dd9a45af3ce11ae87b70bba0aff668ce62beeca6168703c6847fd84f5bbb3ceac88b16389257efd315eeef66d332513e1778e37e587941df814ce30ef8e6e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxeu:ymb3NkkiQ3mdBjF0y7kbUu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3032 pvvdd.exe 2404 rlxxflr.exe 2876 7nbhnh.exe 2772 3vjpj.exe 2720 frxllll.exe 2084 bnbbhn.exe 1924 7nhtnn.exe 2672 pjvpj.exe 2692 frxlrrf.exe 2664 rlrxxxl.exe 3048 hbnthb.exe 792 7pddv.exe 1200 pjvdd.exe 2880 lxrxfxf.exe 1532 3lxffxf.exe 764 7tnttt.exe 2368 vvddj.exe 1152 pjpjp.exe 2356 xlxrrrx.exe 1520 xlxxxrx.exe 1840 bntbhh.exe 416 dvvpd.exe 3016 1jvjj.exe 960 xlxrllr.exe 1096 lfxfffl.exe 2272 1bhtbb.exe 2080 9jdjd.exe 2228 vpvdv.exe 1768 lxfxflr.exe 1872 3tnnnb.exe 1468 9hntth.exe 1980 jppvv.exe 2200 7pvpp.exe 2708 3flffxf.exe 2832 rfrrlll.exe 2436 7bbttt.exe 1736 tbhtnb.exe 2820 jdpvd.exe 2864 3vjvv.exe 2904 xrxrrll.exe 2628 xlrllff.exe 2492 htttnh.exe 2340 ttbhbb.exe 2736 jvvjd.exe 1644 1vdvp.exe 1256 3flxxrr.exe 1028 1lrrrrx.exe 2948 fxlrxrx.exe 2956 htttnb.exe 1440 5bhhhn.exe 2900 jppvv.exe 1684 vpjdj.exe 2256 rlxxxrx.exe 2372 fxfxrxr.exe 2920 bthhnh.exe 2356 nbhbbt.exe 316 jvpdd.exe 2464 dpjvp.exe 2572 vjpjp.exe 796 lxxrrlr.exe 2148 rflffxr.exe 2196 hbbttn.exe 1040 hthbtn.exe 1640 jvppv.exe -
resource yara_rule behavioral1/memory/1984-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 3032 1984 8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe 30 PID 1984 wrote to memory of 3032 1984 8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe 30 PID 1984 wrote to memory of 3032 1984 8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe 30 PID 1984 wrote to memory of 3032 1984 8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe 30 PID 3032 wrote to memory of 2404 3032 pvvdd.exe 31 PID 3032 wrote to memory of 2404 3032 pvvdd.exe 31 PID 3032 wrote to memory of 2404 3032 pvvdd.exe 31 PID 3032 wrote to memory of 2404 3032 pvvdd.exe 31 PID 2404 wrote to memory of 2876 2404 rlxxflr.exe 32 PID 2404 wrote to memory of 2876 2404 rlxxflr.exe 32 PID 2404 wrote to memory of 2876 2404 rlxxflr.exe 32 PID 2404 wrote to memory of 2876 2404 rlxxflr.exe 32 PID 2876 wrote to memory of 2772 2876 7nbhnh.exe 33 PID 2876 wrote to memory of 2772 2876 7nbhnh.exe 33 PID 2876 wrote to memory of 2772 2876 7nbhnh.exe 33 PID 2876 wrote to memory of 2772 2876 7nbhnh.exe 33 PID 2772 wrote to memory of 2720 2772 3vjpj.exe 34 PID 2772 wrote to memory of 2720 2772 3vjpj.exe 34 PID 2772 wrote to memory of 2720 2772 3vjpj.exe 34 PID 2772 wrote to memory of 2720 2772 3vjpj.exe 34 PID 2720 wrote to memory of 2084 2720 frxllll.exe 35 PID 2720 wrote to memory of 2084 2720 frxllll.exe 35 PID 2720 wrote to memory of 2084 2720 frxllll.exe 35 PID 2720 wrote to memory of 2084 2720 frxllll.exe 35 PID 2084 wrote to memory of 1924 2084 bnbbhn.exe 36 PID 2084 wrote to memory of 1924 2084 bnbbhn.exe 36 PID 2084 wrote to memory of 1924 2084 bnbbhn.exe 36 PID 2084 wrote to memory of 1924 2084 bnbbhn.exe 36 PID 1924 wrote to memory of 2672 1924 7nhtnn.exe 37 PID 1924 wrote to memory of 2672 1924 7nhtnn.exe 37 PID 1924 wrote to memory of 2672 1924 7nhtnn.exe 37 PID 1924 wrote to memory of 2672 1924 7nhtnn.exe 37 PID 2672 wrote to memory of 2692 2672 pjvpj.exe 38 PID 2672 wrote to memory of 2692 2672 pjvpj.exe 38 PID 2672 wrote to memory of 2692 2672 pjvpj.exe 38 PID 2672 wrote to memory of 2692 2672 pjvpj.exe 38 PID 2692 wrote to memory of 2664 2692 frxlrrf.exe 39 PID 2692 wrote to memory of 2664 2692 frxlrrf.exe 39 PID 2692 wrote to memory of 2664 2692 frxlrrf.exe 39 PID 2692 wrote to memory of 2664 2692 frxlrrf.exe 39 PID 2664 wrote to memory of 3048 2664 rlrxxxl.exe 40 PID 2664 wrote to memory of 3048 2664 rlrxxxl.exe 40 PID 2664 wrote to memory of 3048 2664 rlrxxxl.exe 40 PID 2664 wrote to memory of 3048 2664 rlrxxxl.exe 40 PID 3048 wrote to memory of 792 3048 hbnthb.exe 41 PID 3048 wrote to memory of 792 3048 hbnthb.exe 41 PID 3048 wrote to memory of 792 3048 hbnthb.exe 41 PID 3048 wrote to memory of 792 3048 hbnthb.exe 41 PID 792 wrote to memory of 1200 792 7pddv.exe 42 PID 792 wrote to memory of 1200 792 7pddv.exe 42 PID 792 wrote to memory of 1200 792 7pddv.exe 42 PID 792 wrote to memory of 1200 792 7pddv.exe 42 PID 1200 wrote to memory of 2880 1200 pjvdd.exe 43 PID 1200 wrote to memory of 2880 1200 pjvdd.exe 43 PID 1200 wrote to memory of 2880 1200 pjvdd.exe 43 PID 1200 wrote to memory of 2880 1200 pjvdd.exe 43 PID 2880 wrote to memory of 1532 2880 lxrxfxf.exe 44 PID 2880 wrote to memory of 1532 2880 lxrxfxf.exe 44 PID 2880 wrote to memory of 1532 2880 lxrxfxf.exe 44 PID 2880 wrote to memory of 1532 2880 lxrxfxf.exe 44 PID 1532 wrote to memory of 764 1532 3lxffxf.exe 45 PID 1532 wrote to memory of 764 1532 3lxffxf.exe 45 PID 1532 wrote to memory of 764 1532 3lxffxf.exe 45 PID 1532 wrote to memory of 764 1532 3lxffxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe"C:\Users\Admin\AppData\Local\Temp\8d790afbd7117dc2db7f59df25ede17212526262896ed873968f67f9ce596af9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\pvvdd.exec:\pvvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rlxxflr.exec:\rlxxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\7nbhnh.exec:\7nbhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\3vjpj.exec:\3vjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\frxllll.exec:\frxllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bnbbhn.exec:\bnbbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\7nhtnn.exec:\7nhtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\pjvpj.exec:\pjvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\frxlrrf.exec:\frxlrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\hbnthb.exec:\hbnthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\7pddv.exec:\7pddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\pjvdd.exec:\pjvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\3lxffxf.exec:\3lxffxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\7tnttt.exec:\7tnttt.exe17⤵
- Executes dropped EXE
PID:764 -
\??\c:\vvddj.exec:\vvddj.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjpjp.exec:\pjpjp.exe19⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe21⤵
- Executes dropped EXE
PID:1520 -
\??\c:\bntbhh.exec:\bntbhh.exe22⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dvvpd.exec:\dvvpd.exe23⤵
- Executes dropped EXE
PID:416 -
\??\c:\1jvjj.exec:\1jvjj.exe24⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xlxrllr.exec:\xlxrllr.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\lfxfffl.exec:\lfxfffl.exe26⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1bhtbb.exec:\1bhtbb.exe27⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9jdjd.exec:\9jdjd.exe28⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vpvdv.exec:\vpvdv.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lxfxflr.exec:\lxfxflr.exe30⤵
- Executes dropped EXE
PID:1768 -
\??\c:\3tnnnb.exec:\3tnnnb.exe31⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9hntth.exec:\9hntth.exe32⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jppvv.exec:\jppvv.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7pvpp.exec:\7pvpp.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3flffxf.exec:\3flffxf.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rfrrlll.exec:\rfrrlll.exe36⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7bbttt.exec:\7bbttt.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tbhtnb.exec:\tbhtnb.exe38⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jdpvd.exec:\jdpvd.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3vjvv.exec:\3vjvv.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xrxrrll.exec:\xrxrrll.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xlrllff.exec:\xlrllff.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\htttnh.exec:\htttnh.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ttbhbb.exec:\ttbhbb.exe44⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jvvjd.exec:\jvvjd.exe45⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1vdvp.exec:\1vdvp.exe46⤵
- Executes dropped EXE
PID:1644 -
\??\c:\3flxxrr.exec:\3flxxrr.exe47⤵
- Executes dropped EXE
PID:1256 -
\??\c:\1lrrrrx.exec:\1lrrrrx.exe48⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe49⤵
- Executes dropped EXE
PID:2948 -
\??\c:\htttnb.exec:\htttnb.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5bhhhn.exec:\5bhhhn.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jppvv.exec:\jppvv.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vpjdj.exec:\vpjdj.exe53⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe54⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe55⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bthhnh.exec:\bthhnh.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nbhbbt.exec:\nbhbbt.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jvpdd.exec:\jvpdd.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\dpjvp.exec:\dpjvp.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\vjpjp.exec:\vjpjp.exe60⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lxxrrlr.exec:\lxxrrlr.exe61⤵
- Executes dropped EXE
PID:796 -
\??\c:\rflffxr.exec:\rflffxr.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbbttn.exec:\hbbttn.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hthbtn.exec:\hthbtn.exe64⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jvppv.exec:\jvppv.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9vpvp.exec:\9vpvp.exe66⤵PID:1808
-
\??\c:\pdjjv.exec:\pdjjv.exe67⤵PID:2080
-
\??\c:\lxrrrrl.exec:\lxrrrrl.exe68⤵PID:308
-
\??\c:\7rfxrrr.exec:\7rfxrrr.exe69⤵PID:2508
-
\??\c:\1bbbtt.exec:\1bbbtt.exe70⤵PID:1984
-
\??\c:\3djpp.exec:\3djpp.exe71⤵PID:1720
-
\??\c:\5djjp.exec:\5djjp.exe72⤵PID:2012
-
\??\c:\vpvdv.exec:\vpvdv.exe73⤵PID:2328
-
\??\c:\rxxllxx.exec:\rxxllxx.exe74⤵PID:2404
-
\??\c:\rllxfxr.exec:\rllxfxr.exe75⤵PID:2244
-
\??\c:\hnntnh.exec:\hnntnh.exe76⤵PID:2944
-
\??\c:\bnthbt.exec:\bnthbt.exe77⤵PID:2744
-
\??\c:\ppjjd.exec:\ppjjd.exe78⤵PID:2748
-
\??\c:\jdjdv.exec:\jdjdv.exe79⤵PID:2768
-
\??\c:\vjpdd.exec:\vjpdd.exe80⤵PID:2644
-
\??\c:\5flxxlr.exec:\5flxxlr.exe81⤵PID:2660
-
\??\c:\lflrffl.exec:\lflrffl.exe82⤵PID:2788
-
\??\c:\nhtbnh.exec:\nhtbnh.exe83⤵PID:2140
-
\??\c:\thnbtn.exec:\thnbtn.exe84⤵PID:344
-
\??\c:\vjjvj.exec:\vjjvj.exe85⤵PID:444
-
\??\c:\3pjpp.exec:\3pjpp.exe86⤵PID:2664
-
\??\c:\7pvdj.exec:\7pvdj.exe87⤵PID:3048
-
\??\c:\rflfxxf.exec:\rflfxxf.exe88⤵PID:380
-
\??\c:\9frllxl.exec:\9frllxl.exe89⤵PID:320
-
\??\c:\tbntnh.exec:\tbntnh.exe90⤵PID:2796
-
\??\c:\tntnhh.exec:\tntnhh.exe91⤵PID:2336
-
\??\c:\vjpjj.exec:\vjpjj.exe92⤵PID:840
-
\??\c:\pdjvp.exec:\pdjvp.exe93⤵PID:2212
-
\??\c:\7xlflxl.exec:\7xlflxl.exe94⤵PID:2656
-
\??\c:\rlxxxll.exec:\rlxxxll.exe95⤵PID:2164
-
\??\c:\thhbbt.exec:\thhbbt.exe96⤵PID:2372
-
\??\c:\7thhnt.exec:\7thhnt.exe97⤵PID:1700
-
\??\c:\dvjvd.exec:\dvjvd.exe98⤵PID:1564
-
\??\c:\3vjdd.exec:\3vjdd.exe99⤵PID:316
-
\??\c:\vdjdj.exec:\vdjdj.exe100⤵PID:948
-
\??\c:\5xrrlrr.exec:\5xrrlrr.exe101⤵PID:1868
-
\??\c:\1ffxxrx.exec:\1ffxxrx.exe102⤵PID:3008
-
\??\c:\htnbhh.exec:\htnbhh.exe103⤵PID:1412
-
\??\c:\3thttn.exec:\3thttn.exe104⤵PID:2196
-
\??\c:\3djdd.exec:\3djdd.exe105⤵PID:1040
-
\??\c:\5jddd.exec:\5jddd.exe106⤵PID:2280
-
\??\c:\3xllfxl.exec:\3xllfxl.exe107⤵PID:1080
-
\??\c:\xfrlfxr.exec:\xfrlfxr.exe108⤵PID:2228
-
\??\c:\9nntbh.exec:\9nntbh.exe109⤵PID:1764
-
\??\c:\tbnnhh.exec:\tbnnhh.exe110⤵PID:1604
-
\??\c:\bnnnnn.exec:\bnnnnn.exe111⤵PID:1148
-
\??\c:\1pjdd.exec:\1pjdd.exe112⤵PID:2696
-
\??\c:\ppvdv.exec:\ppvdv.exe113⤵PID:2480
-
\??\c:\lxlfffr.exec:\lxlfffr.exe114⤵PID:2876
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe115⤵PID:1252
-
\??\c:\9htbtn.exec:\9htbtn.exe116⤵PID:2872
-
\??\c:\nbbbbt.exec:\nbbbbt.exe117⤵PID:2772
-
\??\c:\pdppj.exec:\pdppj.exe118⤵PID:2740
-
\??\c:\vjdvd.exec:\vjdvd.exe119⤵PID:2652
-
\??\c:\vdjjv.exec:\vdjjv.exe120⤵PID:2428
-
\??\c:\1rrlfxx.exec:\1rrlfxx.exe121⤵PID:2620
-
\??\c:\rflfffr.exec:\rflfffr.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-