Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 06:01
Static task
static1
Behavioral task
behavioral1
Sample
a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe
Resource
win7-20240903-en
General
-
Target
a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe
-
Size
71KB
-
MD5
1a1fd3ac0b6520ebacbfa48578d8f8f0
-
SHA1
16abafff7e2c954929e5052ce32d64ccd9809f30
-
SHA256
a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586b
-
SHA512
58cdd84cffdb816dec83ba8c8b0e4fbce2b2d3429b20f5e4603c50daf1e6c0af16c0c49eccaf8a0036a9c561408c2bb80300af3633db7d88823a54eda9bd8f28
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj/:ymb3NkkiQ3mdBjFI4VP
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1708-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-3294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1624 tnnhbn.exe 2060 5vdpd.exe 2760 dvpdv.exe 1712 xxlrxlx.exe 2828 tbhbth.exe 2280 pppdj.exe 2768 rrllrlx.exe 2332 xrxxflr.exe 2696 1hbbht.exe 3056 ddvjd.exe 1992 3dvpd.exe 2912 ffflxlx.exe 2676 nbhnth.exe 2540 tnnhnb.exe 1056 jjjpd.exe 1964 xrfrfrr.exe 2176 lffrlrf.exe 1728 hbnhtn.exe 2160 vvvjv.exe 1800 vvpvj.exe 1124 xrfxflf.exe 2020 tnnbnn.exe 956 ttthtn.exe 1100 9jdjp.exe 748 fflffrl.exe 1816 rrlrfll.exe 3016 5hhbnb.exe 2200 1btbhn.exe 1996 pjvjj.exe 2080 9xxflrf.exe 1692 9bhhtb.exe 1684 tnhtnt.exe 2208 jjpvp.exe 2680 xxxrxrl.exe 2508 lfxxlrf.exe 2852 bbbtnt.exe 2968 1ttthn.exe 2692 ppjdd.exe 2712 rrlrlfr.exe 2616 rxrrlrx.exe 2580 hhbnth.exe 3044 bbbhnn.exe 2696 vpvdp.exe 2076 jppvp.exe 2776 fxxfrxf.exe 1680 5rlfxlx.exe 2036 1tthth.exe 2672 tthbtb.exe 2004 ppvjd.exe 2608 ppdpp.exe 1976 xrflxlr.exe 1112 9lrlffr.exe 2176 3nhbhn.exe 2536 ntntnh.exe 2268 9jvdp.exe 2328 nttthn.exe 1800 tttbnn.exe 1540 vpjpd.exe 1344 5dddd.exe 1280 xxrfxlx.exe 756 fffxfrf.exe 824 nhhnbh.exe 1744 hhbntn.exe 2124 5pdvv.exe -
resource yara_rule behavioral1/memory/1624-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-3294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxllxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1624 1708 a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe 31 PID 1708 wrote to memory of 1624 1708 a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe 31 PID 1708 wrote to memory of 1624 1708 a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe 31 PID 1708 wrote to memory of 1624 1708 a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe 31 PID 1624 wrote to memory of 2060 1624 tnnhbn.exe 32 PID 1624 wrote to memory of 2060 1624 tnnhbn.exe 32 PID 1624 wrote to memory of 2060 1624 tnnhbn.exe 32 PID 1624 wrote to memory of 2060 1624 tnnhbn.exe 32 PID 2060 wrote to memory of 2760 2060 5vdpd.exe 33 PID 2060 wrote to memory of 2760 2060 5vdpd.exe 33 PID 2060 wrote to memory of 2760 2060 5vdpd.exe 33 PID 2060 wrote to memory of 2760 2060 5vdpd.exe 33 PID 2760 wrote to memory of 1712 2760 dvpdv.exe 34 PID 2760 wrote to memory of 1712 2760 dvpdv.exe 34 PID 2760 wrote to memory of 1712 2760 dvpdv.exe 34 PID 2760 wrote to memory of 1712 2760 dvpdv.exe 34 PID 1712 wrote to memory of 2828 1712 xxlrxlx.exe 35 PID 1712 wrote to memory of 2828 1712 xxlrxlx.exe 35 PID 1712 wrote to memory of 2828 1712 xxlrxlx.exe 35 PID 1712 wrote to memory of 2828 1712 xxlrxlx.exe 35 PID 2828 wrote to memory of 2280 2828 tbhbth.exe 36 PID 2828 wrote to memory of 2280 2828 tbhbth.exe 36 PID 2828 wrote to memory of 2280 2828 tbhbth.exe 36 PID 2828 wrote to memory of 2280 2828 tbhbth.exe 36 PID 2280 wrote to memory of 2768 2280 pppdj.exe 37 PID 2280 wrote to memory of 2768 2280 pppdj.exe 37 PID 2280 wrote to memory of 2768 2280 pppdj.exe 37 PID 2280 wrote to memory of 2768 2280 pppdj.exe 37 PID 2768 wrote to memory of 2332 2768 rrllrlx.exe 38 PID 2768 wrote to memory of 2332 2768 rrllrlx.exe 38 PID 2768 wrote to memory of 2332 2768 rrllrlx.exe 38 PID 2768 wrote to memory of 2332 2768 rrllrlx.exe 38 PID 2332 wrote to memory of 2696 2332 xrxxflr.exe 39 PID 2332 wrote to memory of 2696 2332 xrxxflr.exe 39 PID 2332 wrote to memory of 2696 2332 xrxxflr.exe 39 PID 2332 wrote to memory of 2696 2332 xrxxflr.exe 39 PID 2696 wrote to memory of 3056 2696 1hbbht.exe 40 PID 2696 wrote to memory of 3056 2696 1hbbht.exe 40 PID 2696 wrote to memory of 3056 2696 1hbbht.exe 40 PID 2696 wrote to memory of 3056 2696 1hbbht.exe 40 PID 3056 wrote to memory of 1992 3056 ddvjd.exe 41 PID 3056 wrote to memory of 1992 3056 ddvjd.exe 41 PID 3056 wrote to memory of 1992 3056 ddvjd.exe 41 PID 3056 wrote to memory of 1992 3056 ddvjd.exe 41 PID 1992 wrote to memory of 2912 1992 3dvpd.exe 42 PID 1992 wrote to memory of 2912 1992 3dvpd.exe 42 PID 1992 wrote to memory of 2912 1992 3dvpd.exe 42 PID 1992 wrote to memory of 2912 1992 3dvpd.exe 42 PID 2912 wrote to memory of 2676 2912 ffflxlx.exe 43 PID 2912 wrote to memory of 2676 2912 ffflxlx.exe 43 PID 2912 wrote to memory of 2676 2912 ffflxlx.exe 43 PID 2912 wrote to memory of 2676 2912 ffflxlx.exe 43 PID 2676 wrote to memory of 2540 2676 nbhnth.exe 44 PID 2676 wrote to memory of 2540 2676 nbhnth.exe 44 PID 2676 wrote to memory of 2540 2676 nbhnth.exe 44 PID 2676 wrote to memory of 2540 2676 nbhnth.exe 44 PID 2540 wrote to memory of 1056 2540 tnnhnb.exe 45 PID 2540 wrote to memory of 1056 2540 tnnhnb.exe 45 PID 2540 wrote to memory of 1056 2540 tnnhnb.exe 45 PID 2540 wrote to memory of 1056 2540 tnnhnb.exe 45 PID 1056 wrote to memory of 1964 1056 jjjpd.exe 46 PID 1056 wrote to memory of 1964 1056 jjjpd.exe 46 PID 1056 wrote to memory of 1964 1056 jjjpd.exe 46 PID 1056 wrote to memory of 1964 1056 jjjpd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe"C:\Users\Admin\AppData\Local\Temp\a046554dc6305c61fda6c7116d20c4104361f94d8162d79aa11349db82c6586bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\tnnhbn.exec:\tnnhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\5vdpd.exec:\5vdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\dvpdv.exec:\dvpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xxlrxlx.exec:\xxlrxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\tbhbth.exec:\tbhbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\pppdj.exec:\pppdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\rrllrlx.exec:\rrllrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xrxxflr.exec:\xrxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\1hbbht.exec:\1hbbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ddvjd.exec:\ddvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\3dvpd.exec:\3dvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\ffflxlx.exec:\ffflxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nbhnth.exec:\nbhnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnnhnb.exec:\tnnhnb.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jjjpd.exec:\jjjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\xrfrfrr.exec:\xrfrfrr.exe17⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lffrlrf.exec:\lffrlrf.exe18⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hbnhtn.exec:\hbnhtn.exe19⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vvvjv.exec:\vvvjv.exe20⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xrfxflf.exec:\xrfxflf.exe22⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tnnbnn.exec:\tnnbnn.exe23⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ttthtn.exec:\ttthtn.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\9jdjp.exec:\9jdjp.exe25⤵
- Executes dropped EXE
PID:1100 -
\??\c:\fflffrl.exec:\fflffrl.exe26⤵
- Executes dropped EXE
PID:748 -
\??\c:\rrlrfll.exec:\rrlrfll.exe27⤵
- Executes dropped EXE
PID:1816 -
\??\c:\5hhbnb.exec:\5hhbnb.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\1btbhn.exec:\1btbhn.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjvjj.exec:\pjvjj.exe30⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9xxflrf.exec:\9xxflrf.exe31⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9bhhtb.exec:\9bhhtb.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tnhtnt.exec:\tnhtnt.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jjpvp.exec:\jjpvp.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208 -
\??\c:\xxxrxrl.exec:\xxxrxrl.exe35⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bbbtnt.exec:\bbbtnt.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1ttthn.exec:\1ttthn.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ppjdd.exec:\ppjdd.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rrlrlfr.exec:\rrlrlfr.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rxrrlrx.exec:\rxrrlrx.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hhbnth.exec:\hhbnth.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bbbhnn.exec:\bbbhnn.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpvdp.exec:\vpvdp.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jppvp.exec:\jppvp.exe45⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe46⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5rlfxlx.exec:\5rlfxlx.exe47⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1tthth.exec:\1tthth.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\tthbtb.exec:\tthbtb.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ppvjd.exec:\ppvjd.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ppdpp.exec:\ppdpp.exe51⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrflxlr.exec:\xrflxlr.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9lrlffr.exec:\9lrlffr.exe53⤵
- Executes dropped EXE
PID:1112 -
\??\c:\3nhbhn.exec:\3nhbhn.exe54⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ntntnh.exec:\ntntnh.exe55⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9jvdp.exec:\9jvdp.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nttthn.exec:\nttthn.exe57⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tttbnn.exec:\tttbnn.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vpjpd.exec:\vpjpd.exe59⤵
- Executes dropped EXE
PID:1540 -
\??\c:\5dddd.exec:\5dddd.exe60⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe61⤵
- Executes dropped EXE
PID:1280 -
\??\c:\fffxfrf.exec:\fffxfrf.exe62⤵
- Executes dropped EXE
PID:756 -
\??\c:\nhhnbh.exec:\nhhnbh.exe63⤵
- Executes dropped EXE
PID:824 -
\??\c:\hhbntn.exec:\hhbntn.exe64⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5pdvv.exec:\5pdvv.exe65⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3llrflx.exec:\3llrflx.exe66⤵PID:3016
-
\??\c:\xxffllr.exec:\xxffllr.exe67⤵PID:3032
-
\??\c:\hhtbht.exec:\hhtbht.exe68⤵PID:2264
-
\??\c:\btnbbh.exec:\btnbbh.exe69⤵
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\1nbbhh.exec:\1nbbhh.exe70⤵PID:1400
-
\??\c:\5pvjp.exec:\5pvjp.exe71⤵PID:1604
-
\??\c:\pjvdj.exec:\pjvdj.exe72⤵PID:2484
-
\??\c:\5fxlrxr.exec:\5fxlrxr.exe73⤵PID:2500
-
\??\c:\5fllxxf.exec:\5fllxxf.exe74⤵PID:2732
-
\??\c:\tttbth.exec:\tttbth.exe75⤵PID:2680
-
\??\c:\dvpvv.exec:\dvpvv.exe76⤵PID:2980
-
\??\c:\vpjvd.exec:\vpjvd.exe77⤵PID:2852
-
\??\c:\3rlxxfx.exec:\3rlxxfx.exe78⤵PID:2968
-
\??\c:\5xrflrl.exec:\5xrflrl.exe79⤵PID:2692
-
\??\c:\hbntbb.exec:\hbntbb.exe80⤵PID:3060
-
\??\c:\thntht.exec:\thntht.exe81⤵PID:2616
-
\??\c:\jvdvd.exec:\jvdvd.exe82⤵PID:2332
-
\??\c:\jdjpd.exec:\jdjpd.exe83⤵PID:2568
-
\??\c:\llxflfr.exec:\llxflfr.exe84⤵PID:2772
-
\??\c:\rlfflrl.exec:\rlfflrl.exe85⤵PID:2076
-
\??\c:\hnhbbn.exec:\hnhbbn.exe86⤵PID:2776
-
\??\c:\9tntbt.exec:\9tntbt.exe87⤵PID:2800
-
\??\c:\ddpdj.exec:\ddpdj.exe88⤵PID:1956
-
\??\c:\pvvdd.exec:\pvvdd.exe89⤵PID:2672
-
\??\c:\fxfrxxl.exec:\fxfrxxl.exe90⤵PID:1972
-
\??\c:\lfrflrr.exec:\lfrflrr.exe91⤵PID:2608
-
\??\c:\7bnhhb.exec:\7bnhhb.exe92⤵PID:1976
-
\??\c:\3ppvj.exec:\3ppvj.exe93⤵PID:1112
-
\??\c:\9dvjj.exec:\9dvjj.exe94⤵PID:2096
-
\??\c:\3lllfrf.exec:\3lllfrf.exe95⤵PID:1804
-
\??\c:\rlflrfr.exec:\rlflrfr.exe96⤵PID:404
-
\??\c:\hbhnbb.exec:\hbhnbb.exe97⤵PID:2328
-
\??\c:\9tnbbh.exec:\9tnbbh.exe98⤵PID:1032
-
\??\c:\dvpvd.exec:\dvpvd.exe99⤵PID:1540
-
\??\c:\vvvvd.exec:\vvvvd.exe100⤵PID:1344
-
\??\c:\llxfflr.exec:\llxfflr.exe101⤵PID:1280
-
\??\c:\llflffl.exec:\llflffl.exe102⤵PID:2932
-
\??\c:\7thhhh.exec:\7thhhh.exe103⤵PID:824
-
\??\c:\7hnnbn.exec:\7hnnbn.exe104⤵PID:2260
-
\??\c:\vvjpd.exec:\vvjpd.exe105⤵PID:2124
-
\??\c:\vvjpd.exec:\vvjpd.exe106⤵PID:3068
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe107⤵PID:2512
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe108⤵PID:884
-
\??\c:\bbhntb.exec:\bbhntb.exe109⤵PID:2308
-
\??\c:\tnhnbt.exec:\tnhnbt.exe110⤵PID:1596
-
\??\c:\vpvdd.exec:\vpvdd.exe111⤵PID:2056
-
\??\c:\jjdvv.exec:\jjdvv.exe112⤵PID:2424
-
\??\c:\xxlxlrl.exec:\xxlxlrl.exe113⤵PID:2352
-
\??\c:\9rlxrlf.exec:\9rlxrlf.exe114⤵PID:2344
-
\??\c:\hbbntt.exec:\hbbntt.exe115⤵PID:2832
-
\??\c:\bhnhnb.exec:\bhnhnb.exe116⤵PID:2716
-
\??\c:\dvpvv.exec:\dvpvv.exe117⤵PID:2808
-
\??\c:\pjvdp.exec:\pjvdp.exe118⤵PID:2796
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe119⤵PID:2420
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe120⤵PID:2564
-
\??\c:\9nbhnt.exec:\9nbhnt.exe121⤵PID:3036
-
\??\c:\3tthnn.exec:\3tthnn.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-