Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe
Resource
win7-20240903-en
General
-
Target
c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe
-
Size
63KB
-
MD5
4858e14794f0f1bd7ecffe3985977150
-
SHA1
3d6e10d4cdf6ee172a84f7c64e4282c3b60fa441
-
SHA256
c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739
-
SHA512
d559610a3c23cfaf0f0b4fb2aa82263ec757e6a83a02ebcb44cdd18400e841d5f0cb69ced509b55a75d3ab3858c33db12626a00b891cc8949acf3062aee71b3d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJ44Hhhd8:ymb3NkkiQ3mdBjFILdhj8
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2936-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 7tbnhb.exe 2804 tnbttb.exe 2828 7vpdj.exe 2636 rlfflxx.exe 2772 nhbhbn.exe 2664 vpvjv.exe 2344 xxrxrfr.exe 1860 hthbbt.exe 2668 vvjvj.exe 2588 lxrlrlr.exe 2660 rllrllr.exe 2960 bbttnh.exe 1036 vdvpd.exe 1296 3vpvd.exe 1448 fxxxfrr.exe 1304 tnbttt.exe 780 7nhhnt.exe 2512 jpdvj.exe 3060 vjpjv.exe 1828 lfrxlxl.exe 328 1thnbn.exe 2508 nhnntn.exe 1740 dpdvp.exe 1776 vpddj.exe 848 frfllff.exe 292 nbhbhh.exe 3024 tbbnth.exe 1736 5pjpv.exe 1668 lxxrrlx.exe 2292 frllrxf.exe 3040 thttbt.exe 2832 bnnntt.exe 2800 pjdjv.exe 2804 rffffrr.exe 2912 rfrfflx.exe 2624 nhtntn.exe 2168 nbhhhh.exe 2632 pdpdj.exe 2336 3vvvp.exe 2672 rflffff.exe 1496 9xfxxxr.exe 1920 lxrxrrl.exe 2340 5ttntt.exe 764 nhnntt.exe 2872 7djvv.exe 2952 pdddd.exe 2992 xxlllfl.exe 2960 xrrxlrf.exe 1228 9nhntt.exe 2016 thbttt.exe 1672 vpddj.exe 772 pvvvp.exe 584 frxxllr.exe 380 1rrflff.exe 2460 bnhhhh.exe 2008 bbtnnb.exe 408 5jjpj.exe 1828 pdppp.exe 1048 rllrxlr.exe 2044 rlrrxxl.exe 1676 hbhhhh.exe 2576 btnthh.exe 1988 1vjpp.exe 1772 jjvdp.exe -
resource yara_rule behavioral1/memory/2936-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2308 2936 c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe 30 PID 2936 wrote to memory of 2308 2936 c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe 30 PID 2936 wrote to memory of 2308 2936 c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe 30 PID 2936 wrote to memory of 2308 2936 c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe 30 PID 2308 wrote to memory of 2804 2308 7tbnhb.exe 31 PID 2308 wrote to memory of 2804 2308 7tbnhb.exe 31 PID 2308 wrote to memory of 2804 2308 7tbnhb.exe 31 PID 2308 wrote to memory of 2804 2308 7tbnhb.exe 31 PID 2804 wrote to memory of 2828 2804 tnbttb.exe 32 PID 2804 wrote to memory of 2828 2804 tnbttb.exe 32 PID 2804 wrote to memory of 2828 2804 tnbttb.exe 32 PID 2804 wrote to memory of 2828 2804 tnbttb.exe 32 PID 2828 wrote to memory of 2636 2828 7vpdj.exe 33 PID 2828 wrote to memory of 2636 2828 7vpdj.exe 33 PID 2828 wrote to memory of 2636 2828 7vpdj.exe 33 PID 2828 wrote to memory of 2636 2828 7vpdj.exe 33 PID 2636 wrote to memory of 2772 2636 rlfflxx.exe 34 PID 2636 wrote to memory of 2772 2636 rlfflxx.exe 34 PID 2636 wrote to memory of 2772 2636 rlfflxx.exe 34 PID 2636 wrote to memory of 2772 2636 rlfflxx.exe 34 PID 2772 wrote to memory of 2664 2772 nhbhbn.exe 35 PID 2772 wrote to memory of 2664 2772 nhbhbn.exe 35 PID 2772 wrote to memory of 2664 2772 nhbhbn.exe 35 PID 2772 wrote to memory of 2664 2772 nhbhbn.exe 35 PID 2664 wrote to memory of 2344 2664 vpvjv.exe 36 PID 2664 wrote to memory of 2344 2664 vpvjv.exe 36 PID 2664 wrote to memory of 2344 2664 vpvjv.exe 36 PID 2664 wrote to memory of 2344 2664 vpvjv.exe 36 PID 2344 wrote to memory of 1860 2344 xxrxrfr.exe 37 PID 2344 wrote to memory of 1860 2344 xxrxrfr.exe 37 PID 2344 wrote to memory of 1860 2344 xxrxrfr.exe 37 PID 2344 wrote to memory of 1860 2344 xxrxrfr.exe 37 PID 1860 wrote to memory of 2668 1860 hthbbt.exe 38 PID 1860 wrote to memory of 2668 1860 hthbbt.exe 38 PID 1860 wrote to memory of 2668 1860 hthbbt.exe 38 PID 1860 wrote to memory of 2668 1860 hthbbt.exe 38 PID 2668 wrote to memory of 2588 2668 vvjvj.exe 39 PID 2668 wrote to memory of 2588 2668 vvjvj.exe 39 PID 2668 wrote to memory of 2588 2668 vvjvj.exe 39 PID 2668 wrote to memory of 2588 2668 vvjvj.exe 39 PID 2588 wrote to memory of 2660 2588 lxrlrlr.exe 40 PID 2588 wrote to memory of 2660 2588 lxrlrlr.exe 40 PID 2588 wrote to memory of 2660 2588 lxrlrlr.exe 40 PID 2588 wrote to memory of 2660 2588 lxrlrlr.exe 40 PID 2660 wrote to memory of 2960 2660 rllrllr.exe 41 PID 2660 wrote to memory of 2960 2660 rllrllr.exe 41 PID 2660 wrote to memory of 2960 2660 rllrllr.exe 41 PID 2660 wrote to memory of 2960 2660 rllrllr.exe 41 PID 2960 wrote to memory of 1036 2960 bbttnh.exe 42 PID 2960 wrote to memory of 1036 2960 bbttnh.exe 42 PID 2960 wrote to memory of 1036 2960 bbttnh.exe 42 PID 2960 wrote to memory of 1036 2960 bbttnh.exe 42 PID 1036 wrote to memory of 1296 1036 vdvpd.exe 43 PID 1036 wrote to memory of 1296 1036 vdvpd.exe 43 PID 1036 wrote to memory of 1296 1036 vdvpd.exe 43 PID 1036 wrote to memory of 1296 1036 vdvpd.exe 43 PID 1296 wrote to memory of 1448 1296 3vpvd.exe 44 PID 1296 wrote to memory of 1448 1296 3vpvd.exe 44 PID 1296 wrote to memory of 1448 1296 3vpvd.exe 44 PID 1296 wrote to memory of 1448 1296 3vpvd.exe 44 PID 1448 wrote to memory of 1304 1448 fxxxfrr.exe 45 PID 1448 wrote to memory of 1304 1448 fxxxfrr.exe 45 PID 1448 wrote to memory of 1304 1448 fxxxfrr.exe 45 PID 1448 wrote to memory of 1304 1448 fxxxfrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe"C:\Users\Admin\AppData\Local\Temp\c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\7tbnhb.exec:\7tbnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\tnbttb.exec:\tnbttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7vpdj.exec:\7vpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rlfflxx.exec:\rlfflxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nhbhbn.exec:\nhbhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vpvjv.exec:\vpvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\xxrxrfr.exec:\xxrxrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\hthbbt.exec:\hthbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\vvjvj.exec:\vvjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\lxrlrlr.exec:\lxrlrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\rllrllr.exec:\rllrllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bbttnh.exec:\bbttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vdvpd.exec:\vdvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\3vpvd.exec:\3vpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\fxxxfrr.exec:\fxxxfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\tnbttt.exec:\tnbttt.exe17⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7nhhnt.exec:\7nhhnt.exe18⤵
- Executes dropped EXE
PID:780 -
\??\c:\jpdvj.exec:\jpdvj.exe19⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vjpjv.exec:\vjpjv.exe20⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lfrxlxl.exec:\lfrxlxl.exe21⤵
- Executes dropped EXE
PID:1828 -
\??\c:\1thnbn.exec:\1thnbn.exe22⤵
- Executes dropped EXE
PID:328 -
\??\c:\nhnntn.exec:\nhnntn.exe23⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dpdvp.exec:\dpdvp.exe24⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vpddj.exec:\vpddj.exe25⤵
- Executes dropped EXE
PID:1776 -
\??\c:\frfllff.exec:\frfllff.exe26⤵
- Executes dropped EXE
PID:848 -
\??\c:\nbhbhh.exec:\nbhbhh.exe27⤵
- Executes dropped EXE
PID:292 -
\??\c:\tbbnth.exec:\tbbnth.exe28⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5pjpv.exec:\5pjpv.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lxxrrlx.exec:\lxxrrlx.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\frllrxf.exec:\frllrxf.exe31⤵
- Executes dropped EXE
PID:2292 -
\??\c:\thttbt.exec:\thttbt.exe32⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bnnntt.exec:\bnnntt.exe33⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pjdjv.exec:\pjdjv.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rffffrr.exec:\rffffrr.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rfrfflx.exec:\rfrfflx.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nhtntn.exec:\nhtntn.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbhhhh.exec:\nbhhhh.exe38⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pdpdj.exec:\pdpdj.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3vvvp.exec:\3vvvp.exe40⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rflffff.exec:\rflffff.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9xfxxxr.exec:\9xfxxxr.exe42⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lxrxrrl.exec:\lxrxrrl.exe43⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5ttntt.exec:\5ttntt.exe44⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhnntt.exec:\nhnntt.exe45⤵
- Executes dropped EXE
PID:764 -
\??\c:\7djvv.exec:\7djvv.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pdddd.exec:\pdddd.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xxlllfl.exec:\xxlllfl.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9nhntt.exec:\9nhntt.exe50⤵
- Executes dropped EXE
PID:1228 -
\??\c:\thbttt.exec:\thbttt.exe51⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vpddj.exec:\vpddj.exe52⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pvvvp.exec:\pvvvp.exe53⤵
- Executes dropped EXE
PID:772 -
\??\c:\frxxllr.exec:\frxxllr.exe54⤵
- Executes dropped EXE
PID:584 -
\??\c:\1rrflff.exec:\1rrflff.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\bnhhhh.exec:\bnhhhh.exe56⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bbtnnb.exec:\bbtnnb.exe57⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5jjpj.exec:\5jjpj.exe58⤵
- Executes dropped EXE
PID:408 -
\??\c:\pdppp.exec:\pdppp.exe59⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rllrxlr.exec:\rllrxlr.exe60⤵
- Executes dropped EXE
PID:1048 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbhhhh.exec:\hbhhhh.exe62⤵
- Executes dropped EXE
PID:1676 -
\??\c:\btnthh.exec:\btnthh.exe63⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1vjpp.exec:\1vjpp.exe64⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jjvdp.exec:\jjvdp.exe65⤵
- Executes dropped EXE
PID:1772 -
\??\c:\9xlxxxx.exec:\9xlxxxx.exe66⤵PID:1712
-
\??\c:\ffxflfr.exec:\ffxflfr.exe67⤵PID:1572
-
\??\c:\hbtbnn.exec:\hbtbnn.exe68⤵PID:892
-
\??\c:\rfffxxf.exec:\rfffxxf.exe69⤵PID:2420
-
\??\c:\fxffrrx.exec:\fxffrrx.exe70⤵PID:2088
-
\??\c:\tnbthh.exec:\tnbthh.exe71⤵PID:1700
-
\??\c:\7htbtt.exec:\7htbtt.exe72⤵PID:2792
-
\??\c:\dpvpv.exec:\dpvpv.exe73⤵PID:2836
-
\??\c:\dvjjd.exec:\dvjjd.exe74⤵PID:2900
-
\??\c:\lxlxfxl.exec:\lxlxfxl.exe75⤵PID:3032
-
\??\c:\1lfflrr.exec:\1lfflrr.exe76⤵PID:2628
-
\??\c:\frrrrrf.exec:\frrrrrf.exe77⤵PID:2820
-
\??\c:\nnbbhb.exec:\nnbbhb.exe78⤵PID:2596
-
\??\c:\bnbthn.exec:\bnbthn.exe79⤵PID:1996
-
\??\c:\dvdjd.exec:\dvdjd.exe80⤵PID:2924
-
\??\c:\djpdj.exec:\djpdj.exe81⤵PID:2688
-
\??\c:\1lrrxff.exec:\1lrrxff.exe82⤵PID:2344
-
\??\c:\frrrlll.exec:\frrrlll.exe83⤵PID:2128
-
\??\c:\hbnbnh.exec:\hbnbnh.exe84⤵PID:352
-
\??\c:\bntbnn.exec:\bntbnn.exe85⤵PID:2848
-
\??\c:\1ppvv.exec:\1ppvv.exe86⤵PID:2880
-
\??\c:\jdvdj.exec:\jdvdj.exe87⤵PID:1788
-
\??\c:\ffrffrl.exec:\ffrffrl.exe88⤵PID:2980
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe89⤵PID:1792
-
\??\c:\nbnnnn.exec:\nbnnnn.exe90⤵PID:1108
-
\??\c:\thbhbt.exec:\thbhbt.exe91⤵PID:1296
-
\??\c:\9tnnnt.exec:\9tnnnt.exe92⤵PID:1168
-
\??\c:\3pvvd.exec:\3pvvd.exe93⤵PID:532
-
\??\c:\jvvjj.exec:\jvvjj.exe94⤵PID:2296
-
\??\c:\lflflrx.exec:\lflflrx.exe95⤵PID:2488
-
\??\c:\lfrxfff.exec:\lfrxfff.exe96⤵PID:2580
-
\??\c:\bnbttt.exec:\bnbttt.exe97⤵PID:1204
-
\??\c:\nnbbht.exec:\nnbbht.exe98⤵PID:2232
-
\??\c:\7vjvd.exec:\7vjvd.exe99⤵PID:2396
-
\??\c:\jdddp.exec:\jdddp.exe100⤵PID:1364
-
\??\c:\rfxrllr.exec:\rfxrllr.exe101⤵PID:1100
-
\??\c:\5hthtb.exec:\5hthtb.exe102⤵PID:836
-
\??\c:\tnbhtt.exec:\tnbhtt.exe103⤵PID:1528
-
\??\c:\1htbnh.exec:\1htbnh.exe104⤵
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\1pvjp.exec:\1pvjp.exe105⤵PID:2216
-
\??\c:\xlrxlff.exec:\xlrxlff.exe106⤵
- System Location Discovery: System Language Discovery
PID:2116 -
\??\c:\frflfrl.exec:\frflfrl.exe107⤵PID:1284
-
\??\c:\fxfflfl.exec:\fxfflfl.exe108⤵PID:2516
-
\??\c:\thtthn.exec:\thtthn.exe109⤵PID:1796
-
\??\c:\bththn.exec:\bththn.exe110⤵PID:2380
-
\??\c:\ppjjp.exec:\ppjjp.exe111⤵PID:2224
-
\??\c:\ffxxrrx.exec:\ffxxrrx.exe112⤵PID:1700
-
\??\c:\rlxxflr.exec:\rlxxflr.exe113⤵PID:2808
-
\??\c:\7nnbth.exec:\7nnbth.exe114⤵PID:2836
-
\??\c:\hhnbnt.exec:\hhnbnt.exe115⤵PID:2720
-
\??\c:\jjjpd.exec:\jjjpd.exe116⤵PID:3032
-
\??\c:\ddjpj.exec:\ddjpj.exe117⤵PID:2920
-
\??\c:\lrlxrxx.exec:\lrlxrxx.exe118⤵PID:2776
-
\??\c:\9tbbtn.exec:\9tbbtn.exe119⤵PID:2596
-
\??\c:\5btnhb.exec:\5btnhb.exe120⤵PID:1996
-
\??\c:\pddvd.exec:\pddvd.exe121⤵PID:2924
-
\??\c:\9pppd.exec:\9pppd.exe122⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-