Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07d2bb369a31efed7f54403f8cd0a430N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
07d2bb369a31efed7f54403f8cd0a430N.exe
-
Size
73KB
-
MD5
07d2bb369a31efed7f54403f8cd0a430
-
SHA1
d704a51ba3cd67f817757d0076b042893ef72d49
-
SHA256
5e4d10c4af11c9880f84662b7e2a4ed542e276829fe6dc724180e7d7422f8991
-
SHA512
0a47359f59e56f1b04da126a2d59392bfcce6342e018af02d5134b0f714893ee4ccafa7f926c889e0a3d24d65ab5c7d88e0c8fb7ca7e4661e3d741a8d3b895c5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfeyj:ymb3NkkiQ3mdBjFIgUEBeyj
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2160-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-94-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1012-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1684 nhbhbb.exe 1800 bnbhnh.exe 2804 dvppp.exe 2772 rlxlrrx.exe 2780 nbhbbh.exe 2860 rxllrrr.exe 2932 frfxxxf.exe 2896 ntbhhh.exe 2700 jdvvj.exe 1876 lxlrrrx.exe 1520 9lfxllr.exe 2684 thntbt.exe 2008 thhhhb.exe 1540 jvjvd.exe 2108 xlrlxrx.exe 1700 nbttbt.exe 540 nhttbh.exe 3000 pvdpd.exe 2720 5vppp.exe 2080 3fxxlrr.exe 2964 frfrllr.exe 404 nhbhbn.exe 3048 vvvdv.exe 1012 vjvvv.exe 1760 lxrxlfl.exe 544 fxrxxff.exe 1832 3hbhtn.exe 1764 pjdpv.exe 1868 frxffll.exe 1108 xllflff.exe 2876 1nhnnn.exe 1256 btntnh.exe 2836 dvdpv.exe 2292 xfrrllr.exe 3036 9lfffll.exe 2760 nbhnnn.exe 2860 bnttnh.exe 1632 5pvdd.exe 2740 vjjdv.exe 2656 9xlrrxf.exe 1812 frrffxf.exe 2700 thtnhb.exe 1912 1htbtt.exe 2980 jpvjj.exe 1492 pvjdj.exe 2164 rlrxffl.exe 580 xfrlxfx.exe 1296 1nnnnn.exe 1440 bhbhhb.exe 2000 3dpjj.exe 2172 3jdvp.exe 2984 9lrrllr.exe 2996 rfxflfx.exe 2156 tnttbt.exe 1104 bntbht.exe 1792 dppjj.exe 1564 jdpvv.exe 404 9xrrxfl.exe 2812 rfrrffr.exe 988 1htbnn.exe 2516 nbhnbt.exe 480 vdppp.exe 608 7bhbbt.exe 952 tnbtbt.exe -
resource yara_rule behavioral1/memory/2160-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1684 2160 07d2bb369a31efed7f54403f8cd0a430N.exe 30 PID 2160 wrote to memory of 1684 2160 07d2bb369a31efed7f54403f8cd0a430N.exe 30 PID 2160 wrote to memory of 1684 2160 07d2bb369a31efed7f54403f8cd0a430N.exe 30 PID 2160 wrote to memory of 1684 2160 07d2bb369a31efed7f54403f8cd0a430N.exe 30 PID 1684 wrote to memory of 1800 1684 nhbhbb.exe 31 PID 1684 wrote to memory of 1800 1684 nhbhbb.exe 31 PID 1684 wrote to memory of 1800 1684 nhbhbb.exe 31 PID 1684 wrote to memory of 1800 1684 nhbhbb.exe 31 PID 1800 wrote to memory of 2804 1800 bnbhnh.exe 32 PID 1800 wrote to memory of 2804 1800 bnbhnh.exe 32 PID 1800 wrote to memory of 2804 1800 bnbhnh.exe 32 PID 1800 wrote to memory of 2804 1800 bnbhnh.exe 32 PID 2804 wrote to memory of 2772 2804 dvppp.exe 33 PID 2804 wrote to memory of 2772 2804 dvppp.exe 33 PID 2804 wrote to memory of 2772 2804 dvppp.exe 33 PID 2804 wrote to memory of 2772 2804 dvppp.exe 33 PID 2772 wrote to memory of 2780 2772 rlxlrrx.exe 34 PID 2772 wrote to memory of 2780 2772 rlxlrrx.exe 34 PID 2772 wrote to memory of 2780 2772 rlxlrrx.exe 34 PID 2772 wrote to memory of 2780 2772 rlxlrrx.exe 34 PID 2780 wrote to memory of 2860 2780 nbhbbh.exe 35 PID 2780 wrote to memory of 2860 2780 nbhbbh.exe 35 PID 2780 wrote to memory of 2860 2780 nbhbbh.exe 35 PID 2780 wrote to memory of 2860 2780 nbhbbh.exe 35 PID 2860 wrote to memory of 2932 2860 rxllrrr.exe 36 PID 2860 wrote to memory of 2932 2860 rxllrrr.exe 36 PID 2860 wrote to memory of 2932 2860 rxllrrr.exe 36 PID 2860 wrote to memory of 2932 2860 rxllrrr.exe 36 PID 2932 wrote to memory of 2896 2932 frfxxxf.exe 37 PID 2932 wrote to memory of 2896 2932 frfxxxf.exe 37 PID 2932 wrote to memory of 2896 2932 frfxxxf.exe 37 PID 2932 wrote to memory of 2896 2932 frfxxxf.exe 37 PID 2896 wrote to memory of 2700 2896 ntbhhh.exe 38 PID 2896 wrote to memory of 2700 2896 ntbhhh.exe 38 PID 2896 wrote to memory of 2700 2896 ntbhhh.exe 38 PID 2896 wrote to memory of 2700 2896 ntbhhh.exe 38 PID 2700 wrote to memory of 1876 2700 jdvvj.exe 39 PID 2700 wrote to memory of 1876 2700 jdvvj.exe 39 PID 2700 wrote to memory of 1876 2700 jdvvj.exe 39 PID 2700 wrote to memory of 1876 2700 jdvvj.exe 39 PID 1876 wrote to memory of 1520 1876 lxlrrrx.exe 40 PID 1876 wrote to memory of 1520 1876 lxlrrrx.exe 40 PID 1876 wrote to memory of 1520 1876 lxlrrrx.exe 40 PID 1876 wrote to memory of 1520 1876 lxlrrrx.exe 40 PID 1520 wrote to memory of 2684 1520 9lfxllr.exe 41 PID 1520 wrote to memory of 2684 1520 9lfxllr.exe 41 PID 1520 wrote to memory of 2684 1520 9lfxllr.exe 41 PID 1520 wrote to memory of 2684 1520 9lfxllr.exe 41 PID 2684 wrote to memory of 2008 2684 thntbt.exe 42 PID 2684 wrote to memory of 2008 2684 thntbt.exe 42 PID 2684 wrote to memory of 2008 2684 thntbt.exe 42 PID 2684 wrote to memory of 2008 2684 thntbt.exe 42 PID 2008 wrote to memory of 1540 2008 thhhhb.exe 43 PID 2008 wrote to memory of 1540 2008 thhhhb.exe 43 PID 2008 wrote to memory of 1540 2008 thhhhb.exe 43 PID 2008 wrote to memory of 1540 2008 thhhhb.exe 43 PID 1540 wrote to memory of 2108 1540 jvjvd.exe 44 PID 1540 wrote to memory of 2108 1540 jvjvd.exe 44 PID 1540 wrote to memory of 2108 1540 jvjvd.exe 44 PID 1540 wrote to memory of 2108 1540 jvjvd.exe 44 PID 2108 wrote to memory of 1700 2108 xlrlxrx.exe 45 PID 2108 wrote to memory of 1700 2108 xlrlxrx.exe 45 PID 2108 wrote to memory of 1700 2108 xlrlxrx.exe 45 PID 2108 wrote to memory of 1700 2108 xlrlxrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\07d2bb369a31efed7f54403f8cd0a430N.exe"C:\Users\Admin\AppData\Local\Temp\07d2bb369a31efed7f54403f8cd0a430N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\nhbhbb.exec:\nhbhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\bnbhnh.exec:\bnbhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\dvppp.exec:\dvppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rlxlrrx.exec:\rlxlrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nbhbbh.exec:\nbhbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rxllrrr.exec:\rxllrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\frfxxxf.exec:\frfxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\ntbhhh.exec:\ntbhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jdvvj.exec:\jdvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\9lfxllr.exec:\9lfxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\thntbt.exec:\thntbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\thhhhb.exec:\thhhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\jvjvd.exec:\jvjvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\xlrlxrx.exec:\xlrlxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\nbttbt.exec:\nbttbt.exe17⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nhttbh.exec:\nhttbh.exe18⤵
- Executes dropped EXE
PID:540 -
\??\c:\pvdpd.exec:\pvdpd.exe19⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5vppp.exec:\5vppp.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\3fxxlrr.exec:\3fxxlrr.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\frfrllr.exec:\frfrllr.exe22⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhbhbn.exec:\nhbhbn.exe23⤵
- Executes dropped EXE
PID:404 -
\??\c:\vvvdv.exec:\vvvdv.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vjvvv.exec:\vjvvv.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lxrxlfl.exec:\lxrxlfl.exe26⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fxrxxff.exec:\fxrxxff.exe27⤵
- Executes dropped EXE
PID:544 -
\??\c:\3hbhtn.exec:\3hbhtn.exe28⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pjdpv.exec:\pjdpv.exe29⤵
- Executes dropped EXE
PID:1764 -
\??\c:\frxffll.exec:\frxffll.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xllflff.exec:\xllflff.exe31⤵
- Executes dropped EXE
PID:1108 -
\??\c:\1nhnnn.exec:\1nhnnn.exe32⤵
- Executes dropped EXE
PID:2876 -
\??\c:\btntnh.exec:\btntnh.exe33⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dvdpv.exec:\dvdpv.exe34⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xfrrllr.exec:\xfrrllr.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\9lfffll.exec:\9lfffll.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nbhnnn.exec:\nbhnnn.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bnttnh.exec:\bnttnh.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5pvdd.exec:\5pvdd.exe39⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vjjdv.exec:\vjjdv.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9xlrrxf.exec:\9xlrrxf.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\frrffxf.exec:\frrffxf.exe42⤵
- Executes dropped EXE
PID:1812 -
\??\c:\thtnhb.exec:\thtnhb.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1htbtt.exec:\1htbtt.exe44⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jpvjj.exec:\jpvjj.exe45⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pvjdj.exec:\pvjdj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\rlrxffl.exec:\rlrxffl.exe47⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xfrlxfx.exec:\xfrlxfx.exe48⤵
- Executes dropped EXE
PID:580 -
\??\c:\1nnnnn.exec:\1nnnnn.exe49⤵
- Executes dropped EXE
PID:1296 -
\??\c:\bhbhhb.exec:\bhbhhb.exe50⤵
- Executes dropped EXE
PID:1440 -
\??\c:\3dpjj.exec:\3dpjj.exe51⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3jdvp.exec:\3jdvp.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9lrrllr.exec:\9lrrllr.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rfxflfx.exec:\rfxflfx.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\tnttbt.exec:\tnttbt.exe55⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bntbht.exec:\bntbht.exe56⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dppjj.exec:\dppjj.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jdpvv.exec:\jdpvv.exe58⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9xrrxfl.exec:\9xrrxfl.exe59⤵
- Executes dropped EXE
PID:404 -
\??\c:\rfrrffr.exec:\rfrrffr.exe60⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1htbnn.exec:\1htbnn.exe61⤵
- Executes dropped EXE
PID:988 -
\??\c:\nbhnbt.exec:\nbhnbt.exe62⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vdppp.exec:\vdppp.exe63⤵
- Executes dropped EXE
PID:480 -
\??\c:\7bhbbt.exec:\7bhbbt.exe64⤵
- Executes dropped EXE
PID:608 -
\??\c:\tnbtbt.exec:\tnbtbt.exe65⤵
- Executes dropped EXE
PID:952 -
\??\c:\3jdvv.exec:\3jdvv.exe66⤵PID:3016
-
\??\c:\vjvdd.exec:\vjvdd.exe67⤵PID:1916
-
\??\c:\9frxfxl.exec:\9frxfxl.exe68⤵PID:3064
-
\??\c:\rfxrrlf.exec:\rfxrrlf.exe69⤵PID:2880
-
\??\c:\thhbbt.exec:\thhbbt.exe70⤵PID:2804
-
\??\c:\1hbhhn.exec:\1hbhhn.exe71⤵PID:2824
-
\??\c:\pdppd.exec:\pdppd.exe72⤵PID:2768
-
\??\c:\jvjjj.exec:\jvjjj.exe73⤵PID:2756
-
\??\c:\xlllrxf.exec:\xlllrxf.exe74⤵PID:2868
-
\??\c:\rxfxxrx.exec:\rxfxxrx.exe75⤵PID:2744
-
\??\c:\thnnhh.exec:\thnnhh.exe76⤵PID:2632
-
\??\c:\bnbnnt.exec:\bnbnnt.exe77⤵PID:3004
-
\??\c:\3ttthb.exec:\3ttthb.exe78⤵PID:2924
-
\??\c:\pjppv.exec:\pjppv.exe79⤵PID:2364
-
\??\c:\3pvvj.exec:\3pvvj.exe80⤵PID:2676
-
\??\c:\xlxfrxx.exec:\xlxfrxx.exe81⤵PID:564
-
\??\c:\lfrlrll.exec:\lfrlrll.exe82⤵PID:1876
-
\??\c:\nhntnn.exec:\nhntnn.exe83⤵PID:2968
-
\??\c:\htnbbh.exec:\htnbbh.exe84⤵PID:2684
-
\??\c:\vjjjj.exec:\vjjjj.exe85⤵PID:1268
-
\??\c:\vjvvd.exec:\vjvvd.exe86⤵PID:2724
-
\??\c:\rlllrrf.exec:\rlllrrf.exe87⤵PID:2956
-
\??\c:\lxfrxff.exec:\lxfrxff.exe88⤵PID:2108
-
\??\c:\xlrllxl.exec:\xlrllxl.exe89⤵PID:1152
-
\??\c:\bnnbbb.exec:\bnnbbb.exe90⤵PID:2976
-
\??\c:\bnbtbt.exec:\bnbtbt.exe91⤵PID:2356
-
\??\c:\pvjpd.exec:\pvjpd.exe92⤵PID:1676
-
\??\c:\vjvvv.exec:\vjvvv.exe93⤵PID:2120
-
\??\c:\frxlrrx.exec:\frxlrrx.exe94⤵PID:1924
-
\??\c:\rxxfffx.exec:\rxxfffx.exe95⤵PID:1748
-
\??\c:\bhhhtt.exec:\bhhhtt.exe96⤵PID:1596
-
\??\c:\httntn.exec:\httntn.exe97⤵PID:844
-
\??\c:\jvjvv.exec:\jvjvv.exe98⤵PID:3048
-
\??\c:\pdppv.exec:\pdppv.exe99⤵PID:2360
-
\??\c:\rfrlflf.exec:\rfrlflf.exe100⤵PID:1760
-
\??\c:\lxlllfr.exec:\lxlllfr.exe101⤵PID:964
-
\??\c:\xlxllff.exec:\xlxllff.exe102⤵PID:1288
-
\??\c:\7thhhh.exec:\7thhhh.exe103⤵PID:1304
-
\??\c:\hthhbt.exec:\hthhbt.exe104⤵PID:2372
-
\??\c:\7pddd.exec:\7pddd.exe105⤵PID:1504
-
\??\c:\vjvpp.exec:\vjvpp.exe106⤵PID:2936
-
\??\c:\flxxfff.exec:\flxxfff.exe107⤵PID:776
-
\??\c:\fxfrlrr.exec:\fxfrlrr.exe108⤵PID:1588
-
\??\c:\frfxxrr.exec:\frfxxrr.exe109⤵PID:1256
-
\??\c:\bhttth.exec:\bhttth.exe110⤵PID:2832
-
\??\c:\1bnttn.exec:\1bnttn.exe111⤵PID:2060
-
\??\c:\dpvjp.exec:\dpvjp.exe112⤵PID:2820
-
\??\c:\5dpvp.exec:\5dpvp.exe113⤵PID:2760
-
\??\c:\xrxfxxl.exec:\xrxfxxl.exe114⤵PID:2648
-
\??\c:\fxlrffl.exec:\fxlrffl.exe115⤵PID:2840
-
\??\c:\xxllllx.exec:\xxllllx.exe116⤵PID:2640
-
\??\c:\nhtthh.exec:\nhtthh.exe117⤵PID:1884
-
\??\c:\1htbhn.exec:\1htbhn.exe118⤵PID:2748
-
\??\c:\vpppv.exec:\vpppv.exe119⤵PID:1484
-
\??\c:\pddvp.exec:\pddvp.exe120⤵PID:1744
-
\??\c:\fxffrfx.exec:\fxffrfx.exe121⤵PID:2980
-
\??\c:\xrlrrff.exec:\xrlrrff.exe122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-