Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 07:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d6a1781b35442a4b3a20eb81386f820N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
7d6a1781b35442a4b3a20eb81386f820N.exe
-
Size
296KB
-
MD5
7d6a1781b35442a4b3a20eb81386f820
-
SHA1
5de5ea6381b363b4482749d350f75dc8ec95cce9
-
SHA256
946cdbd1ab14c31846031c5158d852825ac07decf251edd9dfedee894dc34a21
-
SHA512
3c237936b7fd7bb6f8b1f073c7c564076ecaf830be30440132e405953f0bdd43e5b0aa063e2b24927f5fe79bdcf5dd19aa5d36c244b84b19540b8872825762a4
-
SSDEEP
6144:n3C9BRo/AIuuOthLmH403Pyr6UWO6jUl7sPgvh:n3C9uDVOXLmHBKWyn+Pgvh
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2132-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-93-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-6494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-7444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2208 fffrflr.exe 1844 1pdjp.exe 2800 7jvpp.exe 2756 1lxrrrx.exe 2968 nthbhh.exe 2880 vvvpd.exe 2796 rxlrfxf.exe 2728 7ttbnn.exe 2680 vvpdp.exe 544 fxfxffr.exe 1456 jdvdp.exe 1088 bnthhn.exe 1736 dvjpv.exe 1576 rlrrflr.exe 1992 7btbtt.exe 1728 vvpvp.exe 2900 fxlxrrf.exe 1848 nhtthh.exe 2140 vpdvd.exe 1556 9rlrflr.exe 2248 tntbbh.exe 1788 9vddj.exe 2988 9lxxrxx.exe 2244 hbhnth.exe 1700 rlxflrf.exe 1704 ttnbhn.exe 2360 5htbnt.exe 3008 rlxxflr.exe 1572 rrfrrxl.exe 1904 pjvvj.exe 2476 vjjjd.exe 1528 bththn.exe 2376 7dppd.exe 1280 5ddpd.exe 2892 xrflrrf.exe 2820 bnhnhh.exe 2856 tnbbhn.exe 2968 5jdjp.exe 2792 vjvdp.exe 2864 3frllrr.exe 2840 btnntn.exe 2628 hbhhtt.exe 3028 9djpp.exe 3064 3jvvj.exe 3040 lfrflll.exe 1584 rlflllr.exe 1116 bthbht.exe 1252 pdpvd.exe 1716 vpdjj.exe 1576 lrrxlxr.exe 572 rlxlrrf.exe 1956 7tntbb.exe 1872 jvjjv.exe 2900 dvjpv.exe 2912 7xlxlff.exe 1264 lxrrfxf.exe 2280 nbnhnh.exe 484 hbtbhh.exe 2980 3vpjp.exe 1788 vjjdj.exe 976 rfxlrrr.exe 900 hbtttb.exe 2176 thttbh.exe 1700 pdpvd.exe -
resource yara_rule behavioral1/memory/2132-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-7444-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2208 2132 7d6a1781b35442a4b3a20eb81386f820N.exe 30 PID 2132 wrote to memory of 2208 2132 7d6a1781b35442a4b3a20eb81386f820N.exe 30 PID 2132 wrote to memory of 2208 2132 7d6a1781b35442a4b3a20eb81386f820N.exe 30 PID 2132 wrote to memory of 2208 2132 7d6a1781b35442a4b3a20eb81386f820N.exe 30 PID 2208 wrote to memory of 1844 2208 fffrflr.exe 31 PID 2208 wrote to memory of 1844 2208 fffrflr.exe 31 PID 2208 wrote to memory of 1844 2208 fffrflr.exe 31 PID 2208 wrote to memory of 1844 2208 fffrflr.exe 31 PID 1844 wrote to memory of 2800 1844 1pdjp.exe 32 PID 1844 wrote to memory of 2800 1844 1pdjp.exe 32 PID 1844 wrote to memory of 2800 1844 1pdjp.exe 32 PID 1844 wrote to memory of 2800 1844 1pdjp.exe 32 PID 2800 wrote to memory of 2756 2800 7jvpp.exe 33 PID 2800 wrote to memory of 2756 2800 7jvpp.exe 33 PID 2800 wrote to memory of 2756 2800 7jvpp.exe 33 PID 2800 wrote to memory of 2756 2800 7jvpp.exe 33 PID 2756 wrote to memory of 2968 2756 1lxrrrx.exe 34 PID 2756 wrote to memory of 2968 2756 1lxrrrx.exe 34 PID 2756 wrote to memory of 2968 2756 1lxrrrx.exe 34 PID 2756 wrote to memory of 2968 2756 1lxrrrx.exe 34 PID 2968 wrote to memory of 2880 2968 nthbhh.exe 35 PID 2968 wrote to memory of 2880 2968 nthbhh.exe 35 PID 2968 wrote to memory of 2880 2968 nthbhh.exe 35 PID 2968 wrote to memory of 2880 2968 nthbhh.exe 35 PID 2880 wrote to memory of 2796 2880 vvvpd.exe 36 PID 2880 wrote to memory of 2796 2880 vvvpd.exe 36 PID 2880 wrote to memory of 2796 2880 vvvpd.exe 36 PID 2880 wrote to memory of 2796 2880 vvvpd.exe 36 PID 2796 wrote to memory of 2728 2796 rxlrfxf.exe 37 PID 2796 wrote to memory of 2728 2796 rxlrfxf.exe 37 PID 2796 wrote to memory of 2728 2796 rxlrfxf.exe 37 PID 2796 wrote to memory of 2728 2796 rxlrfxf.exe 37 PID 2728 wrote to memory of 2680 2728 7ttbnn.exe 38 PID 2728 wrote to memory of 2680 2728 7ttbnn.exe 38 PID 2728 wrote to memory of 2680 2728 7ttbnn.exe 38 PID 2728 wrote to memory of 2680 2728 7ttbnn.exe 38 PID 2680 wrote to memory of 544 2680 vvpdp.exe 39 PID 2680 wrote to memory of 544 2680 vvpdp.exe 39 PID 2680 wrote to memory of 544 2680 vvpdp.exe 39 PID 2680 wrote to memory of 544 2680 vvpdp.exe 39 PID 544 wrote to memory of 1456 544 fxfxffr.exe 40 PID 544 wrote to memory of 1456 544 fxfxffr.exe 40 PID 544 wrote to memory of 1456 544 fxfxffr.exe 40 PID 544 wrote to memory of 1456 544 fxfxffr.exe 40 PID 1456 wrote to memory of 1088 1456 jdvdp.exe 41 PID 1456 wrote to memory of 1088 1456 jdvdp.exe 41 PID 1456 wrote to memory of 1088 1456 jdvdp.exe 41 PID 1456 wrote to memory of 1088 1456 jdvdp.exe 41 PID 1088 wrote to memory of 1736 1088 bnthhn.exe 42 PID 1088 wrote to memory of 1736 1088 bnthhn.exe 42 PID 1088 wrote to memory of 1736 1088 bnthhn.exe 42 PID 1088 wrote to memory of 1736 1088 bnthhn.exe 42 PID 1736 wrote to memory of 1576 1736 dvjpv.exe 43 PID 1736 wrote to memory of 1576 1736 dvjpv.exe 43 PID 1736 wrote to memory of 1576 1736 dvjpv.exe 43 PID 1736 wrote to memory of 1576 1736 dvjpv.exe 43 PID 1576 wrote to memory of 1992 1576 rlrrflr.exe 44 PID 1576 wrote to memory of 1992 1576 rlrrflr.exe 44 PID 1576 wrote to memory of 1992 1576 rlrrflr.exe 44 PID 1576 wrote to memory of 1992 1576 rlrrflr.exe 44 PID 1992 wrote to memory of 1728 1992 7btbtt.exe 45 PID 1992 wrote to memory of 1728 1992 7btbtt.exe 45 PID 1992 wrote to memory of 1728 1992 7btbtt.exe 45 PID 1992 wrote to memory of 1728 1992 7btbtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d6a1781b35442a4b3a20eb81386f820N.exe"C:\Users\Admin\AppData\Local\Temp\7d6a1781b35442a4b3a20eb81386f820N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\fffrflr.exec:\fffrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\1pdjp.exec:\1pdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\7jvpp.exec:\7jvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1lxrrrx.exec:\1lxrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nthbhh.exec:\nthbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\vvvpd.exec:\vvvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rxlrfxf.exec:\rxlrfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7ttbnn.exec:\7ttbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vvpdp.exec:\vvpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fxfxffr.exec:\fxfxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\jdvdp.exec:\jdvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\bnthhn.exec:\bnthhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\dvjpv.exec:\dvjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\rlrrflr.exec:\rlrrflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\7btbtt.exec:\7btbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\vvpvp.exec:\vvpvp.exe17⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxlxrrf.exec:\fxlxrrf.exe18⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhtthh.exec:\nhtthh.exe19⤵
- Executes dropped EXE
PID:1848 -
\??\c:\vpdvd.exec:\vpdvd.exe20⤵
- Executes dropped EXE
PID:2140 -
\??\c:\9rlrflr.exec:\9rlrflr.exe21⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tntbbh.exec:\tntbbh.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9vddj.exec:\9vddj.exe23⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9lxxrxx.exec:\9lxxrxx.exe24⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hbhnth.exec:\hbhnth.exe25⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rlxflrf.exec:\rlxflrf.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ttnbhn.exec:\ttnbhn.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5htbnt.exec:\5htbnt.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rlxxflr.exec:\rlxxflr.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rrfrrxl.exec:\rrfrrxl.exe30⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pjvvj.exec:\pjvvj.exe31⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vjjjd.exec:\vjjjd.exe32⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bththn.exec:\bththn.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7dppd.exec:\7dppd.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5ddpd.exec:\5ddpd.exe35⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xrflrrf.exec:\xrflrrf.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bnhnhh.exec:\bnhnhh.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tnbbhn.exec:\tnbbhn.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5jdjp.exec:\5jdjp.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vjvdp.exec:\vjvdp.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3frllrr.exec:\3frllrr.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\btnntn.exec:\btnntn.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hbhhtt.exec:\hbhhtt.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9djpp.exec:\9djpp.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3jvvj.exec:\3jvvj.exe45⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lfrflll.exec:\lfrflll.exe46⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rlflllr.exec:\rlflllr.exe47⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bthbht.exec:\bthbht.exe48⤵
- Executes dropped EXE
PID:1116 -
\??\c:\pdpvd.exec:\pdpvd.exe49⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vpdjj.exec:\vpdjj.exe50⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lrrxlxr.exec:\lrrxlxr.exe51⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe52⤵
- Executes dropped EXE
PID:572 -
\??\c:\7tntbb.exec:\7tntbb.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\jvjjv.exec:\jvjjv.exe54⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dvjpv.exec:\dvjpv.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7xlxlff.exec:\7xlxlff.exe56⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxrrfxf.exec:\lxrrfxf.exe57⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nbnhnh.exec:\nbnhnh.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hbtbhh.exec:\hbtbhh.exe59⤵
- Executes dropped EXE
PID:484 -
\??\c:\3vpjp.exec:\3vpjp.exe60⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vjjdj.exec:\vjjdj.exe61⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rfxlrrr.exec:\rfxlrrr.exe62⤵
- Executes dropped EXE
PID:976 -
\??\c:\hbtttb.exec:\hbtttb.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\thttbh.exec:\thttbh.exe64⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pdpvd.exec:\pdpvd.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5jddd.exec:\5jddd.exe66⤵PID:2480
-
\??\c:\7lxfffl.exec:\7lxfffl.exe67⤵PID:2228
-
\??\c:\xrxflll.exec:\xrxflll.exe68⤵PID:2528
-
\??\c:\hbnnnn.exec:\hbnnnn.exe69⤵PID:2372
-
\??\c:\hbhhnn.exec:\hbhhnn.exe70⤵PID:2156
-
\??\c:\5vpvd.exec:\5vpvd.exe71⤵PID:2568
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe72⤵PID:1524
-
\??\c:\1xrxxfl.exec:\1xrxxfl.exe73⤵PID:1140
-
\??\c:\bnnnbb.exec:\bnnnbb.exe74⤵
- System Location Discovery: System Language Discovery
PID:2172 -
\??\c:\nbntbh.exec:\nbntbh.exe75⤵PID:2416
-
\??\c:\7jdjj.exec:\7jdjj.exe76⤵PID:2764
-
\??\c:\dpdvj.exec:\dpdvj.exe77⤵PID:2448
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe78⤵PID:2748
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe79⤵PID:2776
-
\??\c:\9tttnh.exec:\9tttnh.exe80⤵PID:2880
-
\??\c:\bnbttt.exec:\bnbttt.exe81⤵PID:2716
-
\??\c:\7vvvd.exec:\7vvvd.exe82⤵PID:2796
-
\??\c:\pdjdj.exec:\pdjdj.exe83⤵PID:876
-
\??\c:\1xrxxxx.exec:\1xrxxxx.exe84⤵PID:2652
-
\??\c:\1bhbbt.exec:\1bhbbt.exe85⤵PID:2680
-
\??\c:\bntntt.exec:\bntntt.exe86⤵PID:1976
-
\??\c:\dpdvd.exec:\dpdvd.exe87⤵PID:1412
-
\??\c:\dvddj.exec:\dvddj.exe88⤵PID:1088
-
\??\c:\5lxfflr.exec:\5lxfflr.exe89⤵PID:1116
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe90⤵PID:1172
-
\??\c:\hhbbnt.exec:\hhbbnt.exe91⤵PID:852
-
\??\c:\pdppv.exec:\pdppv.exe92⤵PID:1992
-
\??\c:\1jpjj.exec:\1jpjj.exe93⤵PID:1452
-
\??\c:\1ffrlff.exec:\1ffrlff.exe94⤵PID:2648
-
\??\c:\rlxxxll.exec:\rlxxxll.exe95⤵PID:2920
-
\??\c:\bthtbb.exec:\bthtbb.exe96⤵PID:2252
-
\??\c:\ppvdp.exec:\ppvdp.exe97⤵
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\ppjpd.exec:\ppjpd.exe98⤵PID:2916
-
\??\c:\llrflxl.exec:\llrflxl.exe99⤵PID:2712
-
\??\c:\xrllflx.exec:\xrllflx.exe100⤵PID:2272
-
\??\c:\nhtbhn.exec:\nhtbhn.exe101⤵PID:928
-
\??\c:\tnnbbt.exec:\tnnbbt.exe102⤵PID:2988
-
\??\c:\1jdjp.exec:\1jdjp.exe103⤵PID:356
-
\??\c:\jdpvd.exec:\jdpvd.exe104⤵PID:2236
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe105⤵PID:2164
-
\??\c:\1flrrfx.exec:\1flrrfx.exe106⤵PID:2560
-
\??\c:\3hbbnh.exec:\3hbbnh.exe107⤵PID:2128
-
\??\c:\3jddj.exec:\3jddj.exe108⤵PID:2952
-
\??\c:\7vppp.exec:\7vppp.exe109⤵PID:892
-
\??\c:\frxfflr.exec:\frxfflr.exe110⤵PID:2184
-
\??\c:\frffllr.exec:\frffllr.exe111⤵PID:2156
-
\??\c:\5fxlxlr.exec:\5fxlxlr.exe112⤵PID:2132
-
\??\c:\hhtbnn.exec:\hhtbnn.exe113⤵PID:2160
-
\??\c:\7dpvj.exec:\7dpvj.exe114⤵PID:2552
-
\??\c:\jvjdp.exec:\jvjdp.exe115⤵PID:1648
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe116⤵PID:2804
-
\??\c:\rlflllr.exec:\rlflllr.exe117⤵PID:2764
-
\??\c:\nhnntt.exec:\nhnntt.exe118⤵PID:2816
-
\??\c:\nbnhnt.exec:\nbnhnt.exe119⤵PID:2748
-
\??\c:\jjvjp.exec:\jjvjp.exe120⤵PID:1628
-
\??\c:\dvdvv.exec:\dvdvv.exe121⤵PID:2880
-
\??\c:\fxxfllx.exec:\fxxfllx.exe122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-