Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe
Resource
win7-20240903-en
General
-
Target
027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe
-
Size
80KB
-
MD5
03195d14c12a391bff77049cc121a240
-
SHA1
4ebd807db9270f9bf794b1754b76b8d9be14e19d
-
SHA256
027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891b
-
SHA512
be31a3a395889eaa8e3d7286608ac6204349cdbb685fc736961439032ea842e05751ae94f81140b0dc6c849b876e3094f6929befa1b16337598bdad7b2a247ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeCH:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4T
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2892-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 hhhtth.exe 2880 1ddvd.exe 2996 rflrxxf.exe 2872 9tbhhn.exe 2632 3pvvp.exe 2656 7rfrxxf.exe 2188 9xrllrl.exe 2212 tnbbnt.exe 2052 nhbhnt.exe 332 ppdpp.exe 2788 9jjpd.exe 1656 fxffllr.exe 2976 frxflfl.exe 2100 hbnttb.exe 760 httnhn.exe 1820 9pddv.exe 1308 vjvvj.exe 1792 9rlflfl.exe 2452 rfrrxfl.exe 1676 fxflxfr.exe 876 hnbhnt.exe 444 tbntnb.exe 2352 9pppd.exe 2552 dvdjp.exe 1584 lflrffl.exe 864 ffxrfrf.exe 2500 tnbttn.exe 1228 nbbbtn.exe 2340 vjvvj.exe 1512 3jvvd.exe 2688 rfrrxxf.exe 2816 fxrxlrx.exe 2712 xrflxxf.exe 2836 bnbhtn.exe 2880 7ntttb.exe 2856 ppdjv.exe 2744 jjddp.exe 2888 jdvdp.exe 2312 lxxfxxl.exe 2652 9lfxrrx.exe 2204 1fxfrrx.exe 2624 btbhtt.exe 1412 bbttbb.exe 2144 3nbbbn.exe 332 9vjjp.exe 2236 7jdpp.exe 2948 pjdvv.exe 2540 frllxfr.exe 2168 fxrfrxf.exe 1952 7rlxrxf.exe 1756 3tnnnt.exe 944 bthbhn.exe 2088 btbbhb.exe 320 vpddd.exe 3016 5dvjd.exe 2152 7pdjp.exe 1484 flxxflr.exe 1048 5xxfrrf.exe 2164 1htbhn.exe 1608 hbnhtt.exe 2972 tnnhtb.exe 1900 7jvjd.exe 596 dvjdj.exe 2320 ppjjd.exe -
resource yara_rule behavioral1/memory/2892-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-91-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2308 2892 027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe 30 PID 2892 wrote to memory of 2308 2892 027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe 30 PID 2892 wrote to memory of 2308 2892 027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe 30 PID 2892 wrote to memory of 2308 2892 027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe 30 PID 2308 wrote to memory of 2880 2308 hhhtth.exe 31 PID 2308 wrote to memory of 2880 2308 hhhtth.exe 31 PID 2308 wrote to memory of 2880 2308 hhhtth.exe 31 PID 2308 wrote to memory of 2880 2308 hhhtth.exe 31 PID 2880 wrote to memory of 2996 2880 1ddvd.exe 32 PID 2880 wrote to memory of 2996 2880 1ddvd.exe 32 PID 2880 wrote to memory of 2996 2880 1ddvd.exe 32 PID 2880 wrote to memory of 2996 2880 1ddvd.exe 32 PID 2996 wrote to memory of 2872 2996 rflrxxf.exe 33 PID 2996 wrote to memory of 2872 2996 rflrxxf.exe 33 PID 2996 wrote to memory of 2872 2996 rflrxxf.exe 33 PID 2996 wrote to memory of 2872 2996 rflrxxf.exe 33 PID 2872 wrote to memory of 2632 2872 9tbhhn.exe 34 PID 2872 wrote to memory of 2632 2872 9tbhhn.exe 34 PID 2872 wrote to memory of 2632 2872 9tbhhn.exe 34 PID 2872 wrote to memory of 2632 2872 9tbhhn.exe 34 PID 2632 wrote to memory of 2656 2632 3pvvp.exe 35 PID 2632 wrote to memory of 2656 2632 3pvvp.exe 35 PID 2632 wrote to memory of 2656 2632 3pvvp.exe 35 PID 2632 wrote to memory of 2656 2632 3pvvp.exe 35 PID 2656 wrote to memory of 2188 2656 7rfrxxf.exe 36 PID 2656 wrote to memory of 2188 2656 7rfrxxf.exe 36 PID 2656 wrote to memory of 2188 2656 7rfrxxf.exe 36 PID 2656 wrote to memory of 2188 2656 7rfrxxf.exe 36 PID 2188 wrote to memory of 2212 2188 9xrllrl.exe 37 PID 2188 wrote to memory of 2212 2188 9xrllrl.exe 37 PID 2188 wrote to memory of 2212 2188 9xrllrl.exe 37 PID 2188 wrote to memory of 2212 2188 9xrllrl.exe 37 PID 2212 wrote to memory of 2052 2212 tnbbnt.exe 38 PID 2212 wrote to memory of 2052 2212 tnbbnt.exe 38 PID 2212 wrote to memory of 2052 2212 tnbbnt.exe 38 PID 2212 wrote to memory of 2052 2212 tnbbnt.exe 38 PID 2052 wrote to memory of 332 2052 nhbhnt.exe 39 PID 2052 wrote to memory of 332 2052 nhbhnt.exe 39 PID 2052 wrote to memory of 332 2052 nhbhnt.exe 39 PID 2052 wrote to memory of 332 2052 nhbhnt.exe 39 PID 332 wrote to memory of 2788 332 ppdpp.exe 40 PID 332 wrote to memory of 2788 332 ppdpp.exe 40 PID 332 wrote to memory of 2788 332 ppdpp.exe 40 PID 332 wrote to memory of 2788 332 ppdpp.exe 40 PID 2788 wrote to memory of 1656 2788 9jjpd.exe 41 PID 2788 wrote to memory of 1656 2788 9jjpd.exe 41 PID 2788 wrote to memory of 1656 2788 9jjpd.exe 41 PID 2788 wrote to memory of 1656 2788 9jjpd.exe 41 PID 1656 wrote to memory of 2976 1656 fxffllr.exe 42 PID 1656 wrote to memory of 2976 1656 fxffllr.exe 42 PID 1656 wrote to memory of 2976 1656 fxffllr.exe 42 PID 1656 wrote to memory of 2976 1656 fxffllr.exe 42 PID 2976 wrote to memory of 2100 2976 frxflfl.exe 43 PID 2976 wrote to memory of 2100 2976 frxflfl.exe 43 PID 2976 wrote to memory of 2100 2976 frxflfl.exe 43 PID 2976 wrote to memory of 2100 2976 frxflfl.exe 43 PID 2100 wrote to memory of 760 2100 hbnttb.exe 44 PID 2100 wrote to memory of 760 2100 hbnttb.exe 44 PID 2100 wrote to memory of 760 2100 hbnttb.exe 44 PID 2100 wrote to memory of 760 2100 hbnttb.exe 44 PID 760 wrote to memory of 1820 760 httnhn.exe 45 PID 760 wrote to memory of 1820 760 httnhn.exe 45 PID 760 wrote to memory of 1820 760 httnhn.exe 45 PID 760 wrote to memory of 1820 760 httnhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe"C:\Users\Admin\AppData\Local\Temp\027b1105ae474cb53c12c847688ff41715ba0b74638000291d7d7d8da9a2891bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hhhtth.exec:\hhhtth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\1ddvd.exec:\1ddvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rflrxxf.exec:\rflrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\9tbhhn.exec:\9tbhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\3pvvp.exec:\3pvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\7rfrxxf.exec:\7rfrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\9xrllrl.exec:\9xrllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\tnbbnt.exec:\tnbbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\nhbhnt.exec:\nhbhnt.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\ppdpp.exec:\ppdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\9jjpd.exec:\9jjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\fxffllr.exec:\fxffllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\frxflfl.exec:\frxflfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hbnttb.exec:\hbnttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\httnhn.exec:\httnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\9pddv.exec:\9pddv.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vjvvj.exec:\vjvvj.exe18⤵
- Executes dropped EXE
PID:1308 -
\??\c:\9rlflfl.exec:\9rlflfl.exe19⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxflxfr.exec:\fxflxfr.exe21⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hnbhnt.exec:\hnbhnt.exe22⤵
- Executes dropped EXE
PID:876 -
\??\c:\tbntnb.exec:\tbntnb.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\9pppd.exec:\9pppd.exe24⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dvdjp.exec:\dvdjp.exe25⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lflrffl.exec:\lflrffl.exe26⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ffxrfrf.exec:\ffxrfrf.exe27⤵
- Executes dropped EXE
PID:864 -
\??\c:\tnbttn.exec:\tnbttn.exe28⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nbbbtn.exec:\nbbbtn.exe29⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vjvvj.exec:\vjvvj.exe30⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3jvvd.exec:\3jvvd.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe32⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe33⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrflxxf.exec:\xrflxxf.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bnbhtn.exec:\bnbhtn.exe35⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7ntttb.exec:\7ntttb.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ppdjv.exec:\ppdjv.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jjddp.exec:\jjddp.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdvdp.exec:\jdvdp.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lxxfxxl.exec:\lxxfxxl.exe40⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9lfxrrx.exec:\9lfxrrx.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1fxfrrx.exec:\1fxfrrx.exe42⤵
- Executes dropped EXE
PID:2204 -
\??\c:\btbhtt.exec:\btbhtt.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bbttbb.exec:\bbttbb.exe44⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3nbbbn.exec:\3nbbbn.exe45⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9vjjp.exec:\9vjjp.exe46⤵
- Executes dropped EXE
PID:332 -
\??\c:\7jdpp.exec:\7jdpp.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236 -
\??\c:\pjdvv.exec:\pjdvv.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\frllxfr.exec:\frllxfr.exe49⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe50⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7rlxrxf.exec:\7rlxrxf.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3tnnnt.exec:\3tnnnt.exe52⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bthbhn.exec:\bthbhn.exe53⤵
- Executes dropped EXE
PID:944 -
\??\c:\btbbhb.exec:\btbbhb.exe54⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vpddd.exec:\vpddd.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\5dvjd.exec:\5dvjd.exe56⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7pdjp.exec:\7pdjp.exe57⤵
- Executes dropped EXE
PID:2152 -
\??\c:\flxxflr.exec:\flxxflr.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\5xxfrrf.exec:\5xxfrrf.exe59⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1htbhn.exec:\1htbhn.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbnhtt.exec:\hbnhtt.exe61⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tnnhtb.exec:\tnnhtb.exe62⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7jvjd.exec:\7jvjd.exe63⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dvjdj.exec:\dvjdj.exe64⤵
- Executes dropped EXE
PID:596 -
\??\c:\ppjjd.exec:\ppjjd.exe65⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tnnbnn.exec:\tnnbnn.exe66⤵PID:1736
-
\??\c:\ttnhht.exec:\ttnhht.exe67⤵PID:1420
-
\??\c:\bbhtbb.exec:\bbhtbb.exe68⤵PID:1228
-
\??\c:\dvpjv.exec:\dvpjv.exe69⤵PID:1444
-
\??\c:\3xxrflr.exec:\3xxrflr.exe70⤵PID:1556
-
\??\c:\tnbbtb.exec:\tnbbtb.exe71⤵PID:1340
-
\??\c:\jjvpv.exec:\jjvpv.exe72⤵PID:2876
-
\??\c:\pjppj.exec:\pjppj.exe73⤵PID:2708
-
\??\c:\nbttnb.exec:\nbttnb.exe74⤵PID:2804
-
\??\c:\nhbhnt.exec:\nhbhnt.exe75⤵PID:2836
-
\??\c:\3rxrffr.exec:\3rxrffr.exe76⤵PID:1648
-
\??\c:\1lxrrrf.exec:\1lxrrrf.exe77⤵PID:576
-
\??\c:\tnnhnt.exec:\tnnhnt.exe78⤵PID:2692
-
\??\c:\9jvdp.exec:\9jvdp.exe79⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\pjvpd.exec:\pjvpd.exe80⤵PID:2888
-
\??\c:\1lrfflr.exec:\1lrfflr.exe81⤵PID:2312
-
\??\c:\nnntbn.exec:\nnntbn.exe82⤵PID:2068
-
\??\c:\dddjj.exec:\dddjj.exe83⤵PID:2608
-
\??\c:\3hnttb.exec:\3hnttb.exe84⤵PID:2736
-
\??\c:\3hhntt.exec:\3hhntt.exe85⤵PID:2544
-
\??\c:\ttnhnn.exec:\ttnhnn.exe86⤵PID:2848
-
\??\c:\vjdjv.exec:\vjdjv.exe87⤵PID:2940
-
\??\c:\pjjdj.exec:\pjjdj.exe88⤵PID:2564
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe89⤵PID:2920
-
\??\c:\tnbhtb.exec:\tnbhtb.exe90⤵PID:3068
-
\??\c:\9jdvp.exec:\9jdvp.exe91⤵PID:2396
-
\??\c:\1pdvj.exec:\1pdvj.exe92⤵PID:1524
-
\??\c:\xxrlllr.exec:\xxrlllr.exe93⤵PID:2116
-
\??\c:\1nnntt.exec:\1nnntt.exe94⤵PID:1820
-
\??\c:\3jpvd.exec:\3jpvd.exe95⤵PID:484
-
\??\c:\rlxflrf.exec:\rlxflrf.exe96⤵PID:2556
-
\??\c:\7ppjv.exec:\7ppjv.exe97⤵PID:2180
-
\??\c:\ffxffll.exec:\ffxffll.exe98⤵PID:2304
-
\??\c:\frlfflr.exec:\frlfflr.exe99⤵PID:1488
-
\??\c:\3nbhhn.exec:\3nbhhn.exe100⤵PID:1956
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe101⤵PID:1220
-
\??\c:\vpdpv.exec:\vpdpv.exe102⤵PID:2060
-
\??\c:\xffllff.exec:\xffllff.exe103⤵PID:1624
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe104⤵PID:2160
-
\??\c:\dvdjj.exec:\dvdjj.exe105⤵PID:2192
-
\??\c:\3pvpd.exec:\3pvpd.exe106⤵PID:2524
-
\??\c:\5pvdp.exec:\5pvdp.exe107⤵PID:972
-
\??\c:\xxrxflx.exec:\xxrxflx.exe108⤵PID:1736
-
\??\c:\3xxfrfr.exec:\3xxfrfr.exe109⤵PID:272
-
\??\c:\nhbhbn.exec:\nhbhbn.exe110⤵PID:1228
-
\??\c:\vdpdd.exec:\vdpdd.exe111⤵PID:872
-
\??\c:\jdvdp.exec:\jdvdp.exe112⤵PID:2300
-
\??\c:\3rlrrrx.exec:\3rlrrrx.exe113⤵PID:2720
-
\??\c:\5xllllr.exec:\5xllllr.exe114⤵PID:1716
-
\??\c:\tbthhh.exec:\tbthhh.exe115⤵PID:2828
-
\??\c:\ttnbbt.exec:\ttnbbt.exe116⤵PID:2732
-
\??\c:\jdpjp.exec:\jdpjp.exe117⤵PID:2680
-
\??\c:\jvvdj.exec:\jvvdj.exe118⤵PID:2932
-
\??\c:\rlflrxl.exec:\rlflrxl.exe119⤵PID:2792
-
\??\c:\fxlflrx.exec:\fxlflrx.exe120⤵PID:2208
-
\??\c:\frlffrl.exec:\frlffrl.exe121⤵PID:2864
-
\??\c:\hhtbtb.exec:\hhtbtb.exe122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-