Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 04:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b251ce76f743ddb46f67a3170e1d97d0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
b251ce76f743ddb46f67a3170e1d97d0N.exe
-
Size
61KB
-
MD5
b251ce76f743ddb46f67a3170e1d97d0
-
SHA1
264a037acd641fd612c7e7e09c0c50e50a05ccb4
-
SHA256
6419c4a3e02b93443720fc09ec19483a534c64832a3cff5434a46b77496837dd
-
SHA512
264b6dca71043d05bff8ac41704b5d071e81883f73082901913bc237e137a4f752dc0de04ad8a5fa94821c690d12965ac0dc529c1f014e1d76982c9f5b514808
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKE0:ymb3NkkiQ3mdBjFII9ZvHKE0
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1080-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/680-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 nhttbh.exe 2756 vpdjd.exe 2904 5rxfrrl.exe 2788 5nhhhh.exe 2876 dvpvj.exe 884 7xrflrl.exe 2736 bnthhh.exe 2600 3nbnbt.exe 1708 vvdvd.exe 2620 vjpvj.exe 2568 lxllrrx.exe 2204 hbtntb.exe 2996 3bnbhn.exe 3004 jdpjj.exe 2980 ppdpd.exe 448 lfxlxfl.exe 680 thbhbh.exe 2644 ttbhnt.exe 1344 jdjjj.exe 2212 rlrlrxl.exe 2216 hbtthh.exe 332 tthtbb.exe 560 5dvvd.exe 2624 9djpp.exe 1400 lfrxfll.exe 2632 nhtttt.exe 1496 9btbnh.exe 1488 dvpvj.exe 2248 xxlrffr.exe 2544 1llrrxr.exe 2000 1nnnbh.exe 3000 9bnhnb.exe 1912 ddvjp.exe 2076 7dvjj.exe 2780 rrxlfll.exe 2788 lxflrrr.exe 2872 tnnthb.exe 2660 htbbhn.exe 2884 3pdjp.exe 280 vpvdp.exe 2928 7lxxrxf.exe 2600 lxlxxlr.exe 2064 tnhnbh.exe 2604 ttbttt.exe 1504 5vpdp.exe 2724 dpvjd.exe 3064 lfxxfxx.exe 3044 lflfrfl.exe 3056 1bthhh.exe 2508 tntbhn.exe 1660 jvjvv.exe 1724 jvpvd.exe 2840 3rlrrxx.exe 2052 xrxrfll.exe 2096 bthnnn.exe 2144 bnnhtt.exe 2128 ddddv.exe 2216 vppdj.exe 2468 xlxxxrf.exe 2428 lfxxffr.exe 1648 tnhttb.exe 1780 5hthhn.exe 2304 7dppv.exe 1984 5jdjp.exe -
resource yara_rule behavioral1/memory/1080-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/680-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 1996 1080 b251ce76f743ddb46f67a3170e1d97d0N.exe 30 PID 1080 wrote to memory of 1996 1080 b251ce76f743ddb46f67a3170e1d97d0N.exe 30 PID 1080 wrote to memory of 1996 1080 b251ce76f743ddb46f67a3170e1d97d0N.exe 30 PID 1080 wrote to memory of 1996 1080 b251ce76f743ddb46f67a3170e1d97d0N.exe 30 PID 1996 wrote to memory of 2756 1996 nhttbh.exe 31 PID 1996 wrote to memory of 2756 1996 nhttbh.exe 31 PID 1996 wrote to memory of 2756 1996 nhttbh.exe 31 PID 1996 wrote to memory of 2756 1996 nhttbh.exe 31 PID 2756 wrote to memory of 2904 2756 vpdjd.exe 32 PID 2756 wrote to memory of 2904 2756 vpdjd.exe 32 PID 2756 wrote to memory of 2904 2756 vpdjd.exe 32 PID 2756 wrote to memory of 2904 2756 vpdjd.exe 32 PID 2904 wrote to memory of 2788 2904 5rxfrrl.exe 33 PID 2904 wrote to memory of 2788 2904 5rxfrrl.exe 33 PID 2904 wrote to memory of 2788 2904 5rxfrrl.exe 33 PID 2904 wrote to memory of 2788 2904 5rxfrrl.exe 33 PID 2788 wrote to memory of 2876 2788 5nhhhh.exe 34 PID 2788 wrote to memory of 2876 2788 5nhhhh.exe 34 PID 2788 wrote to memory of 2876 2788 5nhhhh.exe 34 PID 2788 wrote to memory of 2876 2788 5nhhhh.exe 34 PID 2876 wrote to memory of 884 2876 dvpvj.exe 35 PID 2876 wrote to memory of 884 2876 dvpvj.exe 35 PID 2876 wrote to memory of 884 2876 dvpvj.exe 35 PID 2876 wrote to memory of 884 2876 dvpvj.exe 35 PID 884 wrote to memory of 2736 884 7xrflrl.exe 36 PID 884 wrote to memory of 2736 884 7xrflrl.exe 36 PID 884 wrote to memory of 2736 884 7xrflrl.exe 36 PID 884 wrote to memory of 2736 884 7xrflrl.exe 36 PID 2736 wrote to memory of 2600 2736 bnthhh.exe 37 PID 2736 wrote to memory of 2600 2736 bnthhh.exe 37 PID 2736 wrote to memory of 2600 2736 bnthhh.exe 37 PID 2736 wrote to memory of 2600 2736 bnthhh.exe 37 PID 2600 wrote to memory of 1708 2600 3nbnbt.exe 38 PID 2600 wrote to memory of 1708 2600 3nbnbt.exe 38 PID 2600 wrote to memory of 1708 2600 3nbnbt.exe 38 PID 2600 wrote to memory of 1708 2600 3nbnbt.exe 38 PID 1708 wrote to memory of 2620 1708 vvdvd.exe 39 PID 1708 wrote to memory of 2620 1708 vvdvd.exe 39 PID 1708 wrote to memory of 2620 1708 vvdvd.exe 39 PID 1708 wrote to memory of 2620 1708 vvdvd.exe 39 PID 2620 wrote to memory of 2568 2620 vjpvj.exe 40 PID 2620 wrote to memory of 2568 2620 vjpvj.exe 40 PID 2620 wrote to memory of 2568 2620 vjpvj.exe 40 PID 2620 wrote to memory of 2568 2620 vjpvj.exe 40 PID 2568 wrote to memory of 2204 2568 lxllrrx.exe 41 PID 2568 wrote to memory of 2204 2568 lxllrrx.exe 41 PID 2568 wrote to memory of 2204 2568 lxllrrx.exe 41 PID 2568 wrote to memory of 2204 2568 lxllrrx.exe 41 PID 2204 wrote to memory of 2996 2204 hbtntb.exe 42 PID 2204 wrote to memory of 2996 2204 hbtntb.exe 42 PID 2204 wrote to memory of 2996 2204 hbtntb.exe 42 PID 2204 wrote to memory of 2996 2204 hbtntb.exe 42 PID 2996 wrote to memory of 3004 2996 3bnbhn.exe 43 PID 2996 wrote to memory of 3004 2996 3bnbhn.exe 43 PID 2996 wrote to memory of 3004 2996 3bnbhn.exe 43 PID 2996 wrote to memory of 3004 2996 3bnbhn.exe 43 PID 3004 wrote to memory of 2980 3004 jdpjj.exe 44 PID 3004 wrote to memory of 2980 3004 jdpjj.exe 44 PID 3004 wrote to memory of 2980 3004 jdpjj.exe 44 PID 3004 wrote to memory of 2980 3004 jdpjj.exe 44 PID 2980 wrote to memory of 448 2980 ppdpd.exe 45 PID 2980 wrote to memory of 448 2980 ppdpd.exe 45 PID 2980 wrote to memory of 448 2980 ppdpd.exe 45 PID 2980 wrote to memory of 448 2980 ppdpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b251ce76f743ddb46f67a3170e1d97d0N.exe"C:\Users\Admin\AppData\Local\Temp\b251ce76f743ddb46f67a3170e1d97d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\nhttbh.exec:\nhttbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\vpdjd.exec:\vpdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\5rxfrrl.exec:\5rxfrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\5nhhhh.exec:\5nhhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dvpvj.exec:\dvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7xrflrl.exec:\7xrflrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\bnthhh.exec:\bnthhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3nbnbt.exec:\3nbnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vvdvd.exec:\vvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\vjpvj.exec:\vjpvj.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lxllrrx.exec:\lxllrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hbtntb.exec:\hbtntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\3bnbhn.exec:\3bnbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jdpjj.exec:\jdpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\ppdpd.exec:\ppdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe17⤵
- Executes dropped EXE
PID:448 -
\??\c:\thbhbh.exec:\thbhbh.exe18⤵
- Executes dropped EXE
PID:680 -
\??\c:\ttbhnt.exec:\ttbhnt.exe19⤵
- Executes dropped EXE
PID:2644 -
\??\c:\jdjjj.exec:\jdjjj.exe20⤵
- Executes dropped EXE
PID:1344 -
\??\c:\rlrlrxl.exec:\rlrlrxl.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hbtthh.exec:\hbtthh.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tthtbb.exec:\tthtbb.exe23⤵
- Executes dropped EXE
PID:332 -
\??\c:\5dvvd.exec:\5dvvd.exe24⤵
- Executes dropped EXE
PID:560 -
\??\c:\9djpp.exec:\9djpp.exe25⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lfrxfll.exec:\lfrxfll.exe26⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nhtttt.exec:\nhtttt.exe27⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9btbnh.exec:\9btbnh.exe28⤵
- Executes dropped EXE
PID:1496 -
\??\c:\dvpvj.exec:\dvpvj.exe29⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xxlrffr.exec:\xxlrffr.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1llrrxr.exec:\1llrrxr.exe31⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1nnnbh.exec:\1nnnbh.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9bnhnb.exec:\9bnhnb.exe33⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ddvjp.exec:\ddvjp.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\7dvjj.exec:\7dvjj.exe35⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rrxlfll.exec:\rrxlfll.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lxflrrr.exec:\lxflrrr.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tnnthb.exec:\tnnthb.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\htbbhn.exec:\htbbhn.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3pdjp.exec:\3pdjp.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vpvdp.exec:\vpvdp.exe41⤵
- Executes dropped EXE
PID:280 -
\??\c:\7lxxrxf.exec:\7lxxrxf.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lxlxxlr.exec:\lxlxxlr.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tnhnbh.exec:\tnhnbh.exe44⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ttbttt.exec:\ttbttt.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5vpdp.exec:\5vpdp.exe46⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dpvjd.exec:\dpvjd.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lfxxfxx.exec:\lfxxfxx.exe48⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lflfrfl.exec:\lflfrfl.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1bthhh.exec:\1bthhh.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tntbhn.exec:\tntbhn.exe51⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvjvv.exec:\jvjvv.exe52⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jvpvd.exec:\jvpvd.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3rlrrxx.exec:\3rlrrxx.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xrxrfll.exec:\xrxrfll.exe55⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bthnnn.exec:\bthnnn.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bnnhtt.exec:\bnnhtt.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ddddv.exec:\ddddv.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vppdj.exec:\vppdj.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xlxxxrf.exec:\xlxxxrf.exe60⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lfxxffr.exec:\lfxxffr.exe61⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tnhttb.exec:\tnhttb.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5hthhn.exec:\5hthhn.exe63⤵
- Executes dropped EXE
PID:1780 -
\??\c:\7dppv.exec:\7dppv.exe64⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5jdjp.exec:\5jdjp.exe65⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrrxxfr.exec:\xrrxxfr.exe66⤵PID:2512
-
\??\c:\3xrlxfl.exec:\3xrlxfl.exe67⤵PID:2060
-
\??\c:\thnnbh.exec:\thnnbh.exe68⤵PID:304
-
\??\c:\hbtbnb.exec:\hbtbnb.exe69⤵
- System Location Discovery: System Language Discovery
PID:1584 -
\??\c:\dvvjd.exec:\dvvjd.exe70⤵PID:2860
-
\??\c:\vpvjd.exec:\vpvjd.exe71⤵PID:2772
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe72⤵PID:2896
-
\??\c:\rrfrrxf.exec:\rrfrrxf.exe73⤵PID:1912
-
\??\c:\bhhhnn.exec:\bhhhnn.exe74⤵PID:2904
-
\??\c:\9ttbhb.exec:\9ttbhb.exe75⤵PID:2696
-
\??\c:\vdjpv.exec:\vdjpv.exe76⤵PID:2684
-
\??\c:\9vjjj.exec:\9vjjj.exe77⤵PID:3012
-
\??\c:\xxllflr.exec:\xxllflr.exe78⤵PID:2692
-
\??\c:\rffxlll.exec:\rffxlll.exe79⤵PID:1536
-
\??\c:\htthhn.exec:\htthhn.exe80⤵PID:884
-
\??\c:\tnnntb.exec:\tnnntb.exe81⤵PID:1356
-
\??\c:\9jjjd.exec:\9jjjd.exe82⤵PID:2504
-
\??\c:\9jjjv.exec:\9jjjv.exe83⤵PID:1708
-
\??\c:\3frrflr.exec:\3frrflr.exe84⤵PID:2620
-
\??\c:\fxxlxll.exec:\fxxlxll.exe85⤵PID:2760
-
\??\c:\thbbbb.exec:\thbbbb.exe86⤵PID:2960
-
\??\c:\bbhhnn.exec:\bbhhnn.exe87⤵PID:2332
-
\??\c:\5jpvp.exec:\5jpvp.exe88⤵PID:3024
-
\??\c:\pjjpp.exec:\pjjpp.exe89⤵PID:876
-
\??\c:\xlffllx.exec:\xlffllx.exe90⤵PID:852
-
\??\c:\rffxlrx.exec:\rffxlrx.exe91⤵PID:1552
-
\??\c:\3tnnnn.exec:\3tnnnn.exe92⤵PID:1444
-
\??\c:\jjvpp.exec:\jjvpp.exe93⤵PID:1896
-
\??\c:\pdpvd.exec:\pdpvd.exe94⤵PID:2364
-
\??\c:\vdvpj.exec:\vdvpj.exe95⤵PID:2856
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe96⤵PID:264
-
\??\c:\rlfflrx.exec:\rlfflrx.exe97⤵PID:904
-
\??\c:\9bhnht.exec:\9bhnht.exe98⤵PID:692
-
\??\c:\9ddvd.exec:\9ddvd.exe99⤵PID:2552
-
\??\c:\dvpvd.exec:\dvpvd.exe100⤵PID:492
-
\??\c:\vjppv.exec:\vjppv.exe101⤵PID:2136
-
\??\c:\7rrflxx.exec:\7rrflxx.exe102⤵PID:2492
-
\??\c:\rlrfxfr.exec:\rlrfxfr.exe103⤵PID:1468
-
\??\c:\3httbh.exec:\3httbh.exe104⤵PID:1448
-
\??\c:\nnbnbt.exec:\nnbnbt.exe105⤵PID:2156
-
\??\c:\7ppdp.exec:\7ppdp.exe106⤵PID:2512
-
\??\c:\3jddj.exec:\3jddj.exe107⤵PID:688
-
\??\c:\llrxfff.exec:\llrxfff.exe108⤵PID:1588
-
\??\c:\lfflxfl.exec:\lfflxfl.exe109⤵PID:2584
-
\??\c:\5lxlrxr.exec:\5lxlrxr.exe110⤵PID:2768
-
\??\c:\nhthnt.exec:\nhthnt.exe111⤵PID:2092
-
\??\c:\hbtntb.exec:\hbtntb.exe112⤵PID:2668
-
\??\c:\1vjjj.exec:\1vjjj.exe113⤵PID:2976
-
\??\c:\vjvpv.exec:\vjvpv.exe114⤵PID:2880
-
\??\c:\9xrxfrr.exec:\9xrxfrr.exe115⤵PID:2708
-
\??\c:\fxrxxlf.exec:\fxrxxlf.exe116⤵PID:2688
-
\??\c:\tnbttn.exec:\tnbttn.exe117⤵PID:2660
-
\??\c:\ttnbbh.exec:\ttnbbh.exe118⤵PID:1916
-
\??\c:\dvpjj.exec:\dvpjj.exe119⤵PID:944
-
\??\c:\7jdjp.exec:\7jdjp.exe120⤵PID:2516
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe121⤵PID:2068
-
\??\c:\9rlffxf.exec:\9rlffxf.exe122⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-