Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe
Resource
win7-20240729-en
General
-
Target
cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe
-
Size
62KB
-
MD5
fe788810050ecfc9a0276eedd413e320
-
SHA1
f2de6793dbe79b21c1c30ecdf7e1caa5a2bb5d6a
-
SHA256
cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9
-
SHA512
65a2f7204861aa3c4a4ad09d48afa2e8e49f9d834872cac3dd3d7f80c8f6fd3d7e41b8ac91b38ae9e8463190b018e8596ba3e7f309d2117a33520c69ad566f01
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKES+:ymb3NkkiQ3mdBjFII9ZvHKET
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2188-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 3lfrlxr.exe 2792 lfxrllr.exe 2588 tthhtb.exe 2864 hbtbnh.exe 2868 9pppv.exe 2624 pjdpj.exe 1776 rxxlfxl.exe 2416 lfrflxf.exe 2080 nhttnt.exe 1052 5pvdv.exe 1820 dvddp.exe 2640 rlfrfrf.exe 1496 nnthtt.exe 1020 nhtbht.exe 2096 jjjpd.exe 1548 jppvj.exe 1392 rlrfrxf.exe 1648 9llxrfl.exe 1632 xxxlxrl.exe 2024 7btbth.exe 1752 tntnbb.exe 1276 ddvvv.exe 892 dvjvd.exe 1732 3flxfrx.exe 2912 frlfxlx.exe 1592 rrlrxff.exe 988 5tnbnh.exe 1220 tthbtn.exe 316 dvjvv.exe 2264 9vvdp.exe 1880 fxlfxxx.exe 2896 3fxxllr.exe 2176 5tbhbh.exe 1480 1ntnhn.exe 2808 ppjpd.exe 2696 vvjpv.exe 2756 pjvvp.exe 2612 ffllfrr.exe 1776 5lflxlx.exe 2116 rrrflrx.exe 2596 ntthnb.exe 2052 1nhtnn.exe 1052 hbnntt.exe 1820 dvvdp.exe 2680 djpjj.exe 2592 9hhntb.exe 2364 tnhnth.exe 2940 thbhnn.exe 2096 3nhhnb.exe 2136 pjvjj.exe 772 jvpdj.exe 2420 frrxxfr.exe 884 rfxlfrl.exe 1784 xrflfll.exe 2024 5tnhnt.exe 576 tnhhnh.exe 1012 3hhntb.exe 3016 5dpdp.exe 1432 ppddv.exe 1700 jpjjp.exe 2912 rrxlrff.exe 1284 fffrrfx.exe 776 bthbtt.exe 2428 btbhnb.exe -
resource yara_rule behavioral1/memory/2188-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxlrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2532 2188 cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe 30 PID 2188 wrote to memory of 2532 2188 cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe 30 PID 2188 wrote to memory of 2532 2188 cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe 30 PID 2188 wrote to memory of 2532 2188 cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe 30 PID 2532 wrote to memory of 2792 2532 3lfrlxr.exe 31 PID 2532 wrote to memory of 2792 2532 3lfrlxr.exe 31 PID 2532 wrote to memory of 2792 2532 3lfrlxr.exe 31 PID 2532 wrote to memory of 2792 2532 3lfrlxr.exe 31 PID 2792 wrote to memory of 2588 2792 lfxrllr.exe 32 PID 2792 wrote to memory of 2588 2792 lfxrllr.exe 32 PID 2792 wrote to memory of 2588 2792 lfxrllr.exe 32 PID 2792 wrote to memory of 2588 2792 lfxrllr.exe 32 PID 2588 wrote to memory of 2864 2588 tthhtb.exe 181 PID 2588 wrote to memory of 2864 2588 tthhtb.exe 181 PID 2588 wrote to memory of 2864 2588 tthhtb.exe 181 PID 2588 wrote to memory of 2864 2588 tthhtb.exe 181 PID 2864 wrote to memory of 2868 2864 hbtbnh.exe 34 PID 2864 wrote to memory of 2868 2864 hbtbnh.exe 34 PID 2864 wrote to memory of 2868 2864 hbtbnh.exe 34 PID 2864 wrote to memory of 2868 2864 hbtbnh.exe 34 PID 2868 wrote to memory of 2624 2868 9pppv.exe 106 PID 2868 wrote to memory of 2624 2868 9pppv.exe 106 PID 2868 wrote to memory of 2624 2868 9pppv.exe 106 PID 2868 wrote to memory of 2624 2868 9pppv.exe 106 PID 2624 wrote to memory of 1776 2624 pjdpj.exe 36 PID 2624 wrote to memory of 1776 2624 pjdpj.exe 36 PID 2624 wrote to memory of 1776 2624 pjdpj.exe 36 PID 2624 wrote to memory of 1776 2624 pjdpj.exe 36 PID 1776 wrote to memory of 2416 1776 rxxlfxl.exe 37 PID 1776 wrote to memory of 2416 1776 rxxlfxl.exe 37 PID 1776 wrote to memory of 2416 1776 rxxlfxl.exe 37 PID 1776 wrote to memory of 2416 1776 rxxlfxl.exe 37 PID 2416 wrote to memory of 2080 2416 lfrflxf.exe 38 PID 2416 wrote to memory of 2080 2416 lfrflxf.exe 38 PID 2416 wrote to memory of 2080 2416 lfrflxf.exe 38 PID 2416 wrote to memory of 2080 2416 lfrflxf.exe 38 PID 2080 wrote to memory of 1052 2080 nhttnt.exe 39 PID 2080 wrote to memory of 1052 2080 nhttnt.exe 39 PID 2080 wrote to memory of 1052 2080 nhttnt.exe 39 PID 2080 wrote to memory of 1052 2080 nhttnt.exe 39 PID 1052 wrote to memory of 1820 1052 5pvdv.exe 40 PID 1052 wrote to memory of 1820 1052 5pvdv.exe 40 PID 1052 wrote to memory of 1820 1052 5pvdv.exe 40 PID 1052 wrote to memory of 1820 1052 5pvdv.exe 40 PID 1820 wrote to memory of 2640 1820 dvddp.exe 191 PID 1820 wrote to memory of 2640 1820 dvddp.exe 191 PID 1820 wrote to memory of 2640 1820 dvddp.exe 191 PID 1820 wrote to memory of 2640 1820 dvddp.exe 191 PID 2640 wrote to memory of 1496 2640 rlfrfrf.exe 42 PID 2640 wrote to memory of 1496 2640 rlfrfrf.exe 42 PID 2640 wrote to memory of 1496 2640 rlfrfrf.exe 42 PID 2640 wrote to memory of 1496 2640 rlfrfrf.exe 42 PID 1496 wrote to memory of 1020 1496 nnthtt.exe 43 PID 1496 wrote to memory of 1020 1496 nnthtt.exe 43 PID 1496 wrote to memory of 1020 1496 nnthtt.exe 43 PID 1496 wrote to memory of 1020 1496 nnthtt.exe 43 PID 1020 wrote to memory of 2096 1020 nhtbht.exe 44 PID 1020 wrote to memory of 2096 1020 nhtbht.exe 44 PID 1020 wrote to memory of 2096 1020 nhtbht.exe 44 PID 1020 wrote to memory of 2096 1020 nhtbht.exe 44 PID 2096 wrote to memory of 1548 2096 jjjpd.exe 45 PID 2096 wrote to memory of 1548 2096 jjjpd.exe 45 PID 2096 wrote to memory of 1548 2096 jjjpd.exe 45 PID 2096 wrote to memory of 1548 2096 jjjpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe"C:\Users\Admin\AppData\Local\Temp\cdb0d51c81abc4fddb3bec96dd7e3d081ead54f5f72e47cf4b538098cac8ede9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\3lfrlxr.exec:\3lfrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lfxrllr.exec:\lfxrllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tthhtb.exec:\tthhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbtbnh.exec:\hbtbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\9pppv.exec:\9pppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pjdpj.exec:\pjdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\rxxlfxl.exec:\rxxlfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\lfrflxf.exec:\lfrflxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\nhttnt.exec:\nhttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\5pvdv.exec:\5pvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\dvddp.exec:\dvddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nnthtt.exec:\nnthtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\nhtbht.exec:\nhtbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\jjjpd.exec:\jjjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\jppvj.exec:\jppvj.exe17⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rlrfrxf.exec:\rlrfrxf.exe18⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9llxrfl.exec:\9llxrfl.exe19⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe20⤵
- Executes dropped EXE
PID:1632 -
\??\c:\7btbth.exec:\7btbth.exe21⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tntnbb.exec:\tntnbb.exe22⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ddvvv.exec:\ddvvv.exe23⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dvjvd.exec:\dvjvd.exe24⤵
- Executes dropped EXE
PID:892 -
\??\c:\3flxfrx.exec:\3flxfrx.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\frlfxlx.exec:\frlfxlx.exe26⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrlrxff.exec:\rrlrxff.exe27⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5tnbnh.exec:\5tnbnh.exe28⤵
- Executes dropped EXE
PID:988 -
\??\c:\tthbtn.exec:\tthbtn.exe29⤵
- Executes dropped EXE
PID:1220 -
\??\c:\dvjvv.exec:\dvjvv.exe30⤵
- Executes dropped EXE
PID:316 -
\??\c:\9vvdp.exec:\9vvdp.exe31⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe32⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3fxxllr.exec:\3fxxllr.exe33⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5tbhbh.exec:\5tbhbh.exe34⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1ntnhn.exec:\1ntnhn.exe35⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ppjpd.exec:\ppjpd.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vvjpv.exec:\vvjpv.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjvvp.exec:\pjvvp.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ffllfrr.exec:\ffllfrr.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5lflxlx.exec:\5lflxlx.exe40⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrrflrx.exec:\rrrflrx.exe41⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ntthnb.exec:\ntthnb.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1nhtnn.exec:\1nhtnn.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hbnntt.exec:\hbnntt.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dvvdp.exec:\dvvdp.exe45⤵
- Executes dropped EXE
PID:1820 -
\??\c:\djpjj.exec:\djpjj.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9hhntb.exec:\9hhntb.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnhnth.exec:\tnhnth.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\thbhnn.exec:\thbhnn.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3nhhnb.exec:\3nhhnb.exe50⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjvjj.exec:\pjvjj.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jvpdj.exec:\jvpdj.exe52⤵
- Executes dropped EXE
PID:772 -
\??\c:\frrxxfr.exec:\frrxxfr.exe53⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rfxlfrl.exec:\rfxlfrl.exe54⤵
- Executes dropped EXE
PID:884 -
\??\c:\xrflfll.exec:\xrflfll.exe55⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5tnhnt.exec:\5tnhnt.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnhhnh.exec:\tnhhnh.exe57⤵
- Executes dropped EXE
PID:576 -
\??\c:\3hhntb.exec:\3hhntb.exe58⤵
- Executes dropped EXE
PID:1012 -
\??\c:\5dpdp.exec:\5dpdp.exe59⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ppddv.exec:\ppddv.exe60⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jpjjp.exec:\jpjjp.exe61⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrxlrff.exec:\rrxlrff.exe62⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fffrrfx.exec:\fffrrfx.exe63⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bthbtt.exec:\bthbtt.exe64⤵
- Executes dropped EXE
PID:776 -
\??\c:\btbhnb.exec:\btbhnb.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hnbthh.exec:\hnbthh.exe66⤵PID:876
-
\??\c:\pppjp.exec:\pppjp.exe67⤵PID:2672
-
\??\c:\pjpvp.exec:\pjpvp.exe68⤵PID:2068
-
\??\c:\fxlrlxf.exec:\fxlrlxf.exe69⤵PID:3048
-
\??\c:\rlxlfrx.exec:\rlxlfrx.exe70⤵PID:2700
-
\??\c:\7fllrlr.exec:\7fllrlr.exe71⤵PID:2896
-
\??\c:\tnnnhh.exec:\tnnnhh.exe72⤵PID:1492
-
\??\c:\thbnbh.exec:\thbnbh.exe73⤵PID:2776
-
\??\c:\7nbttt.exec:\7nbttt.exe74⤵PID:2636
-
\??\c:\jddvp.exec:\jddvp.exe75⤵PID:2740
-
\??\c:\pdpdp.exec:\pdpdp.exe76⤵PID:2268
-
\??\c:\xxfrrfl.exec:\xxfrrfl.exe77⤵PID:2280
-
\??\c:\fxffxxl.exec:\fxffxxl.exe78⤵PID:2624
-
\??\c:\xrxrfxl.exec:\xrxrfxl.exe79⤵PID:2436
-
\??\c:\hbtbtt.exec:\hbtbtt.exe80⤵PID:2828
-
\??\c:\nnbbbh.exec:\nnbbbh.exe81⤵PID:1980
-
\??\c:\thtntn.exec:\thtntn.exe82⤵PID:1564
-
\??\c:\jdvvv.exec:\jdvvv.exe83⤵PID:2444
-
\??\c:\vvdjv.exec:\vvdjv.exe84⤵PID:2820
-
\??\c:\5lffrxf.exec:\5lffrxf.exe85⤵PID:1800
-
\??\c:\rfllrrf.exec:\rfllrrf.exe86⤵PID:1140
-
\??\c:\lfxxrrx.exec:\lfxxrrx.exe87⤵
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\btthnn.exec:\btthnn.exe88⤵PID:2100
-
\??\c:\nhbbnn.exec:\nhbbnn.exe89⤵PID:948
-
\??\c:\ntnhth.exec:\ntnhth.exe90⤵PID:1548
-
\??\c:\1vvvp.exec:\1vvvp.exe91⤵PID:2136
-
\??\c:\jdjvp.exec:\jdjvp.exe92⤵PID:2328
-
\??\c:\djvdj.exec:\djvdj.exe93⤵PID:1920
-
\??\c:\7xlrxff.exec:\7xlrxff.exe94⤵PID:1908
-
\??\c:\lflrxfr.exec:\lflrxfr.exe95⤵PID:1756
-
\??\c:\xrfllrf.exec:\xrfllrf.exe96⤵PID:1860
-
\??\c:\tntbnn.exec:\tntbnn.exe97⤵PID:576
-
\??\c:\bthbbb.exec:\bthbbb.exe98⤵PID:1012
-
\??\c:\1vjvj.exec:\1vjvj.exe99⤵PID:1616
-
\??\c:\jvjdp.exec:\jvjdp.exe100⤵PID:1732
-
\??\c:\dpppv.exec:\dpppv.exe101⤵PID:1536
-
\??\c:\xlflllr.exec:\xlflllr.exe102⤵PID:2468
-
\??\c:\fxflrxr.exec:\fxflrxr.exe103⤵PID:2212
-
\??\c:\lxxlllf.exec:\lxxlllf.exe104⤵PID:1144
-
\??\c:\3rxxxxf.exec:\3rxxxxf.exe105⤵PID:1460
-
\??\c:\hbhhnb.exec:\hbhhnb.exe106⤵PID:288
-
\??\c:\1hbbhn.exec:\1hbbhn.exe107⤵PID:2732
-
\??\c:\1vjdd.exec:\1vjdd.exe108⤵PID:2880
-
\??\c:\7pjjp.exec:\7pjjp.exe109⤵PID:2120
-
\??\c:\vpvvv.exec:\vpvvv.exe110⤵PID:2800
-
\??\c:\7xxxlxr.exec:\7xxxlxr.exe111⤵PID:2996
-
\??\c:\rrfrfxf.exec:\rrfrfxf.exe112⤵PID:2148
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe113⤵PID:2628
-
\??\c:\nhbntb.exec:\nhbntb.exe114⤵PID:2644
-
\??\c:\hhhbnh.exec:\hhhbnh.exe115⤵PID:2892
-
\??\c:\btbhtt.exec:\btbhtt.exe116⤵PID:2756
-
\??\c:\5vppj.exec:\5vppj.exe117⤵
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\9vppd.exec:\9vppd.exe118⤵PID:3064
-
\??\c:\5jpvv.exec:\5jpvv.exe119⤵PID:2720
-
\??\c:\1lxflfr.exec:\1lxflfr.exe120⤵PID:2080
-
\??\c:\lfxrllr.exec:\lfxrllr.exe121⤵PID:904
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe122⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-