Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 09:45
Static task
static1
Behavioral task
behavioral1
Sample
34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe
Resource
win7-20240903-en
General
-
Target
34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe
-
Size
65KB
-
MD5
d3b85f7c04f24ed881373477bcf50af0
-
SHA1
746bb10f0750140e4deafcf50bb4eca14499b76d
-
SHA256
34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55
-
SHA512
fb2605e99df6c79bb697ae1e4ec83c8de1973f8f3dae286cabe65d15e033705f85e5db70484913bf46c035aeaa8d797a8c7478bb882812de18947d5f2d4523fc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfm:ymb3NkkiQ3mdBjFI9cqfm
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/276-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 jjjjj.exe 2100 rffxfff.exe 1516 hnhbnt.exe 2268 btbhtt.exe 2824 vdvjp.exe 2736 5jddj.exe 2640 3lxlxrx.exe 2780 1bhbhh.exe 2648 vjpdp.exe 2180 vpppv.exe 1288 rflfffl.exe 1040 flxflfl.exe 320 bnttbb.exe 2576 thttbb.exe 352 pdpvd.exe 2840 jjppp.exe 816 7lrrrlr.exe 1640 xlxflrr.exe 2996 hthbhb.exe 2288 nbhnbh.exe 2052 3jjpd.exe 2368 1dvjj.exe 1244 9fflxxl.exe 1788 xrflllr.exe 2040 ththbt.exe 1592 7hntbt.exe 1808 bntnnh.exe 2672 3dvjj.exe 1156 xlxxrrx.exe 2456 9lxflrf.exe 2384 hbhhnn.exe 1880 hthbtn.exe 3068 djjdv.exe 2788 jdppv.exe 2324 lfllxxx.exe 1716 lflxfll.exe 2812 hhnttn.exe 2760 hnbbtt.exe 2912 bntnbt.exe 2908 pdpvd.exe 2740 3dpvj.exe 2716 rlfxrxr.exe 2676 lflrlrf.exe 2320 hbhbhb.exe 1804 btnbhb.exe 900 thtttn.exe 1288 vdjjp.exe 2508 vpppv.exe 600 rlxllrl.exe 784 rffllrx.exe 604 frxxxrr.exe 1712 tbttbb.exe 1284 tnttnn.exe 2916 jpvpj.exe 2176 jvdpp.exe 2056 fxlrrll.exe 2372 frxffff.exe 2988 5xlllll.exe 2080 9tbhnn.exe 712 vjvdv.exe 2148 pjpdj.exe 688 rlxxfrl.exe 3000 5xlrlxf.exe 1592 btbhtt.exe -
resource yara_rule behavioral1/memory/276-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 276 wrote to memory of 2540 276 34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe 30 PID 276 wrote to memory of 2540 276 34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe 30 PID 276 wrote to memory of 2540 276 34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe 30 PID 276 wrote to memory of 2540 276 34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe 30 PID 2540 wrote to memory of 2100 2540 jjjjj.exe 31 PID 2540 wrote to memory of 2100 2540 jjjjj.exe 31 PID 2540 wrote to memory of 2100 2540 jjjjj.exe 31 PID 2540 wrote to memory of 2100 2540 jjjjj.exe 31 PID 2100 wrote to memory of 1516 2100 rffxfff.exe 32 PID 2100 wrote to memory of 1516 2100 rffxfff.exe 32 PID 2100 wrote to memory of 1516 2100 rffxfff.exe 32 PID 2100 wrote to memory of 1516 2100 rffxfff.exe 32 PID 1516 wrote to memory of 2268 1516 hnhbnt.exe 33 PID 1516 wrote to memory of 2268 1516 hnhbnt.exe 33 PID 1516 wrote to memory of 2268 1516 hnhbnt.exe 33 PID 1516 wrote to memory of 2268 1516 hnhbnt.exe 33 PID 2268 wrote to memory of 2824 2268 btbhtt.exe 34 PID 2268 wrote to memory of 2824 2268 btbhtt.exe 34 PID 2268 wrote to memory of 2824 2268 btbhtt.exe 34 PID 2268 wrote to memory of 2824 2268 btbhtt.exe 34 PID 2824 wrote to memory of 2736 2824 vdvjp.exe 35 PID 2824 wrote to memory of 2736 2824 vdvjp.exe 35 PID 2824 wrote to memory of 2736 2824 vdvjp.exe 35 PID 2824 wrote to memory of 2736 2824 vdvjp.exe 35 PID 2736 wrote to memory of 2640 2736 5jddj.exe 36 PID 2736 wrote to memory of 2640 2736 5jddj.exe 36 PID 2736 wrote to memory of 2640 2736 5jddj.exe 36 PID 2736 wrote to memory of 2640 2736 5jddj.exe 36 PID 2640 wrote to memory of 2780 2640 3lxlxrx.exe 37 PID 2640 wrote to memory of 2780 2640 3lxlxrx.exe 37 PID 2640 wrote to memory of 2780 2640 3lxlxrx.exe 37 PID 2640 wrote to memory of 2780 2640 3lxlxrx.exe 37 PID 2780 wrote to memory of 2648 2780 1bhbhh.exe 38 PID 2780 wrote to memory of 2648 2780 1bhbhh.exe 38 PID 2780 wrote to memory of 2648 2780 1bhbhh.exe 38 PID 2780 wrote to memory of 2648 2780 1bhbhh.exe 38 PID 2648 wrote to memory of 2180 2648 vjpdp.exe 39 PID 2648 wrote to memory of 2180 2648 vjpdp.exe 39 PID 2648 wrote to memory of 2180 2648 vjpdp.exe 39 PID 2648 wrote to memory of 2180 2648 vjpdp.exe 39 PID 2180 wrote to memory of 1288 2180 vpppv.exe 40 PID 2180 wrote to memory of 1288 2180 vpppv.exe 40 PID 2180 wrote to memory of 1288 2180 vpppv.exe 40 PID 2180 wrote to memory of 1288 2180 vpppv.exe 40 PID 1288 wrote to memory of 1040 1288 rflfffl.exe 41 PID 1288 wrote to memory of 1040 1288 rflfffl.exe 41 PID 1288 wrote to memory of 1040 1288 rflfffl.exe 41 PID 1288 wrote to memory of 1040 1288 rflfffl.exe 41 PID 1040 wrote to memory of 320 1040 flxflfl.exe 42 PID 1040 wrote to memory of 320 1040 flxflfl.exe 42 PID 1040 wrote to memory of 320 1040 flxflfl.exe 42 PID 1040 wrote to memory of 320 1040 flxflfl.exe 42 PID 320 wrote to memory of 2576 320 bnttbb.exe 43 PID 320 wrote to memory of 2576 320 bnttbb.exe 43 PID 320 wrote to memory of 2576 320 bnttbb.exe 43 PID 320 wrote to memory of 2576 320 bnttbb.exe 43 PID 2576 wrote to memory of 352 2576 thttbb.exe 44 PID 2576 wrote to memory of 352 2576 thttbb.exe 44 PID 2576 wrote to memory of 352 2576 thttbb.exe 44 PID 2576 wrote to memory of 352 2576 thttbb.exe 44 PID 352 wrote to memory of 2840 352 pdpvd.exe 45 PID 352 wrote to memory of 2840 352 pdpvd.exe 45 PID 352 wrote to memory of 2840 352 pdpvd.exe 45 PID 352 wrote to memory of 2840 352 pdpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe"C:\Users\Admin\AppData\Local\Temp\34dbebbd60567a61015dd638ef44f58fcf42594a4efc2559de3887c8a8dc2f55N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\jjjjj.exec:\jjjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rffxfff.exec:\rffxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hnhbnt.exec:\hnhbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\btbhtt.exec:\btbhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\vdvjp.exec:\vdvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\5jddj.exec:\5jddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3lxlxrx.exec:\3lxlxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1bhbhh.exec:\1bhbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vjpdp.exec:\vjpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vpppv.exec:\vpppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rflfffl.exec:\rflfffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\flxflfl.exec:\flxflfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\bnttbb.exec:\bnttbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\thttbb.exec:\thttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pdpvd.exec:\pdpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\jjppp.exec:\jjppp.exe17⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7lrrrlr.exec:\7lrrrlr.exe18⤵
- Executes dropped EXE
PID:816 -
\??\c:\xlxflrr.exec:\xlxflrr.exe19⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hthbhb.exec:\hthbhb.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nbhnbh.exec:\nbhnbh.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3jjpd.exec:\3jjpd.exe22⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1dvjj.exec:\1dvjj.exe23⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9fflxxl.exec:\9fflxxl.exe24⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xrflllr.exec:\xrflllr.exe25⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ththbt.exec:\ththbt.exe26⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7hntbt.exec:\7hntbt.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592 -
\??\c:\bntnnh.exec:\bntnnh.exe28⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3dvjj.exec:\3dvjj.exe29⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xlxxrrx.exec:\xlxxrrx.exe30⤵
- Executes dropped EXE
PID:1156 -
\??\c:\9lxflrf.exec:\9lxflrf.exe31⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbhhnn.exec:\hbhhnn.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hthbtn.exec:\hthbtn.exe33⤵
- Executes dropped EXE
PID:1880 -
\??\c:\djjdv.exec:\djjdv.exe34⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lfllxxx.exec:\lfllxxx.exe36⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lflxfll.exec:\lflxfll.exe37⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hhnttn.exec:\hhnttn.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hnbbtt.exec:\hnbbtt.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bntnbt.exec:\bntnbt.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdpvd.exec:\pdpvd.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3dpvj.exec:\3dpvj.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rlfxrxr.exec:\rlfxrxr.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lflrlrf.exec:\lflrlrf.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hbhbhb.exec:\hbhbhb.exe45⤵
- Executes dropped EXE
PID:2320 -
\??\c:\btnbhb.exec:\btnbhb.exe46⤵
- Executes dropped EXE
PID:1804 -
\??\c:\thtttn.exec:\thtttn.exe47⤵
- Executes dropped EXE
PID:900 -
\??\c:\vdjjp.exec:\vdjjp.exe48⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vpppv.exec:\vpppv.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rlxllrl.exec:\rlxllrl.exe50⤵
- Executes dropped EXE
PID:600 -
\??\c:\rffllrx.exec:\rffllrx.exe51⤵
- Executes dropped EXE
PID:784 -
\??\c:\frxxxrr.exec:\frxxxrr.exe52⤵
- Executes dropped EXE
PID:604 -
\??\c:\tbttbb.exec:\tbttbb.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tnttnn.exec:\tnttnn.exe54⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jpvpj.exec:\jpvpj.exe55⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jvdpp.exec:\jvdpp.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxlrrll.exec:\fxlrrll.exe57⤵
- Executes dropped EXE
PID:2056 -
\??\c:\frxffff.exec:\frxffff.exe58⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5xlllll.exec:\5xlllll.exe59⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9tbhnn.exec:\9tbhnn.exe60⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vjvdv.exec:\vjvdv.exe61⤵
- Executes dropped EXE
PID:712 -
\??\c:\pjpdj.exec:\pjpdj.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rlxxfrl.exec:\rlxxfrl.exe63⤵
- Executes dropped EXE
PID:688 -
\??\c:\5xlrlxf.exec:\5xlrlxf.exe64⤵
- Executes dropped EXE
PID:3000 -
\??\c:\btbhtt.exec:\btbhtt.exe65⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tntbnn.exec:\tntbnn.exe66⤵PID:336
-
\??\c:\9dddj.exec:\9dddj.exe67⤵PID:1152
-
\??\c:\5dvvd.exec:\5dvvd.exe68⤵PID:2264
-
\??\c:\5xrlrrr.exec:\5xrlrrr.exe69⤵PID:1944
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe70⤵PID:2304
-
\??\c:\thhhtb.exec:\thhhtb.exe71⤵PID:2456
-
\??\c:\thbhnn.exec:\thbhnn.exe72⤵PID:1752
-
\??\c:\jdpdd.exec:\jdpdd.exe73⤵PID:2240
-
\??\c:\vjdvd.exec:\vjdvd.exe74⤵PID:2356
-
\??\c:\frxfxrx.exec:\frxfxrx.exe75⤵PID:1304
-
\??\c:\frfrffl.exec:\frfrffl.exe76⤵PID:2804
-
\??\c:\9ntbbt.exec:\9ntbbt.exe77⤵PID:2820
-
\??\c:\hbtbhh.exec:\hbtbhh.exe78⤵PID:2808
-
\??\c:\jjjvv.exec:\jjjvv.exe79⤵PID:880
-
\??\c:\jjvvp.exec:\jjvvp.exe80⤵PID:2884
-
\??\c:\lxxrlrx.exec:\lxxrlrx.exe81⤵PID:1800
-
\??\c:\1bnntt.exec:\1bnntt.exe82⤵PID:2652
-
\??\c:\thhhbh.exec:\thhhbh.exe83⤵PID:2636
-
\??\c:\nntttt.exec:\nntttt.exe84⤵PID:2616
-
\??\c:\1pppv.exec:\1pppv.exe85⤵PID:2648
-
\??\c:\9vjdp.exec:\9vjdp.exe86⤵PID:1480
-
\??\c:\lxfffxx.exec:\lxfffxx.exe87⤵PID:900
-
\??\c:\7fxlxfr.exec:\7fxlxfr.exe88⤵PID:576
-
\??\c:\tbnnnh.exec:\tbnnnh.exe89⤵PID:1684
-
\??\c:\1nbhnn.exec:\1nbhnn.exe90⤵PID:2036
-
\??\c:\jpvdv.exec:\jpvdv.exe91⤵PID:584
-
\??\c:\ddjpd.exec:\ddjpd.exe92⤵PID:1484
-
\??\c:\xxfffll.exec:\xxfffll.exe93⤵PID:2920
-
\??\c:\xxrrfrx.exec:\xxrrfrx.exe94⤵PID:1624
-
\??\c:\lxfllrr.exec:\lxfllrr.exe95⤵PID:3004
-
\??\c:\nnnbnt.exec:\nnnbnt.exe96⤵PID:2844
-
\??\c:\dvppp.exec:\dvppp.exe97⤵PID:2472
-
\??\c:\pdjjd.exec:\pdjjd.exe98⤵PID:2644
-
\??\c:\ddddj.exec:\ddddj.exe99⤵PID:1784
-
\??\c:\frfxllx.exec:\frfxllx.exe100⤵PID:408
-
\??\c:\xllfllr.exec:\xllfllr.exe101⤵PID:3044
-
\??\c:\tbbhtn.exec:\tbbhtn.exe102⤵PID:1244
-
\??\c:\9htttb.exec:\9htttb.exe103⤵PID:1924
-
\??\c:\jjvpd.exec:\jjvpd.exe104⤵PID:2040
-
\??\c:\vjvvd.exec:\vjvvd.exe105⤵PID:2448
-
\??\c:\3rflrxl.exec:\3rflrxl.exe106⤵PID:1064
-
\??\c:\lfllllr.exec:\lfllllr.exe107⤵PID:1184
-
\??\c:\hhbtnn.exec:\hhbtnn.exe108⤵PID:2672
-
\??\c:\bbtbnt.exec:\bbtbnt.exe109⤵PID:892
-
\??\c:\jvvpd.exec:\jvvpd.exe110⤵PID:1420
-
\??\c:\dpvdp.exec:\dpvdp.exe111⤵PID:1692
-
\??\c:\hbhnhn.exec:\hbhnhn.exe112⤵PID:2112
-
\??\c:\hbtbbh.exec:\hbtbbh.exe113⤵PID:1864
-
\??\c:\vpdpj.exec:\vpdpj.exe114⤵PID:1952
-
\??\c:\jvddd.exec:\jvddd.exe115⤵PID:1600
-
\??\c:\vppvv.exec:\vppvv.exe116⤵PID:2324
-
\??\c:\xrlrflx.exec:\xrlrflx.exe117⤵PID:2836
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe118⤵PID:2812
-
\??\c:\9nbbhb.exec:\9nbbhb.exe119⤵PID:2720
-
\??\c:\1hhthn.exec:\1hhthn.exe120⤵PID:2912
-
\??\c:\jdjvp.exec:\jdjvp.exe121⤵PID:2828
-
\??\c:\vjpdd.exec:\vjpdd.exe122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-