Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe
Resource
win7-20240903-en
General
-
Target
375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe
-
Size
70KB
-
MD5
5ef41b873a0d73ab902e390f788ec5d0
-
SHA1
35dc366a5a453f99d1d95ba2dd00922134534191
-
SHA256
375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69e
-
SHA512
28f109170c6553a9c65728da9a90b1dfc2777cf473c52e782cbc3c2ce2858dc768d739f1ba65f449cf1765b128a14c2f3790bff999e5da949c5403d265758bd0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj5h9:ymb3NkkiQ3mdBjFI4V9
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/1856-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-61-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-84-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1856 djppv.exe 2808 ppdjp.exe 2876 1rfllff.exe 2412 tthtbb.exe 2752 3ntbhh.exe 2604 7jjvj.exe 840 bthnbb.exe 2100 dpdvv.exe 2144 lfxxrfr.exe 292 btnnbt.exe 1080 dvpvv.exe 1340 ppdpv.exe 2036 rlxxflx.exe 2680 hhtnbb.exe 268 5hbttb.exe 1524 dvjjj.exe 480 1frxfxr.exe 1108 lfxxrxx.exe 2392 nhbhtb.exe 664 jvppp.exe 2988 9jdvd.exe 1596 xlxflfl.exe 896 rlrxxff.exe 1744 5nbhnn.exe 548 dpddd.exe 2284 1pppv.exe 2132 tnhhnn.exe 2484 5bthnh.exe 1636 ddvjp.exe 1772 rfrxxrf.exe 1856 3xllxxl.exe 2820 hthbbt.exe 2876 1ddpv.exe 2744 rlxlrxf.exe 2772 xfflxfl.exe 2752 hthhnb.exe 1576 hbtbhn.exe 2628 3pjvd.exe 3060 3vvjj.exe 2172 3frrxxf.exe 1720 xrlrflx.exe 1188 1bnbhh.exe 1976 1bhhnb.exe 2144 dvvpp.exe 2980 3jvdd.exe 348 fxfxllr.exe 1964 5llfxxl.exe 1340 thbbtt.exe 544 tnbhth.exe 2760 vvjpv.exe 1840 5dddd.exe 568 xrlrlxx.exe 1344 xfxlfrx.exe 1952 tnbtbt.exe 2348 7tbbnt.exe 1040 pjvvv.exe 1312 jdppp.exe 2204 lfrrrxf.exe 1220 xrlxfxl.exe 924 nbhhnn.exe 1776 hbtbhn.exe 1848 3pvdd.exe 772 dpjdj.exe 2304 1ntntt.exe -
resource yara_rule behavioral1/memory/1856-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-343-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1856 2256 375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe 30 PID 2256 wrote to memory of 1856 2256 375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe 30 PID 2256 wrote to memory of 1856 2256 375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe 30 PID 2256 wrote to memory of 1856 2256 375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe 30 PID 1856 wrote to memory of 2808 1856 djppv.exe 31 PID 1856 wrote to memory of 2808 1856 djppv.exe 31 PID 1856 wrote to memory of 2808 1856 djppv.exe 31 PID 1856 wrote to memory of 2808 1856 djppv.exe 31 PID 2808 wrote to memory of 2876 2808 ppdjp.exe 32 PID 2808 wrote to memory of 2876 2808 ppdjp.exe 32 PID 2808 wrote to memory of 2876 2808 ppdjp.exe 32 PID 2808 wrote to memory of 2876 2808 ppdjp.exe 32 PID 2876 wrote to memory of 2412 2876 1rfllff.exe 33 PID 2876 wrote to memory of 2412 2876 1rfllff.exe 33 PID 2876 wrote to memory of 2412 2876 1rfllff.exe 33 PID 2876 wrote to memory of 2412 2876 1rfllff.exe 33 PID 2412 wrote to memory of 2752 2412 tthtbb.exe 34 PID 2412 wrote to memory of 2752 2412 tthtbb.exe 34 PID 2412 wrote to memory of 2752 2412 tthtbb.exe 34 PID 2412 wrote to memory of 2752 2412 tthtbb.exe 34 PID 2752 wrote to memory of 2604 2752 3ntbhh.exe 35 PID 2752 wrote to memory of 2604 2752 3ntbhh.exe 35 PID 2752 wrote to memory of 2604 2752 3ntbhh.exe 35 PID 2752 wrote to memory of 2604 2752 3ntbhh.exe 35 PID 2604 wrote to memory of 840 2604 7jjvj.exe 36 PID 2604 wrote to memory of 840 2604 7jjvj.exe 36 PID 2604 wrote to memory of 840 2604 7jjvj.exe 36 PID 2604 wrote to memory of 840 2604 7jjvj.exe 36 PID 840 wrote to memory of 2100 840 bthnbb.exe 37 PID 840 wrote to memory of 2100 840 bthnbb.exe 37 PID 840 wrote to memory of 2100 840 bthnbb.exe 37 PID 840 wrote to memory of 2100 840 bthnbb.exe 37 PID 2100 wrote to memory of 2144 2100 dpdvv.exe 38 PID 2100 wrote to memory of 2144 2100 dpdvv.exe 38 PID 2100 wrote to memory of 2144 2100 dpdvv.exe 38 PID 2100 wrote to memory of 2144 2100 dpdvv.exe 38 PID 2144 wrote to memory of 292 2144 lfxxrfr.exe 39 PID 2144 wrote to memory of 292 2144 lfxxrfr.exe 39 PID 2144 wrote to memory of 292 2144 lfxxrfr.exe 39 PID 2144 wrote to memory of 292 2144 lfxxrfr.exe 39 PID 292 wrote to memory of 1080 292 btnnbt.exe 40 PID 292 wrote to memory of 1080 292 btnnbt.exe 40 PID 292 wrote to memory of 1080 292 btnnbt.exe 40 PID 292 wrote to memory of 1080 292 btnnbt.exe 40 PID 1080 wrote to memory of 1340 1080 dvpvv.exe 41 PID 1080 wrote to memory of 1340 1080 dvpvv.exe 41 PID 1080 wrote to memory of 1340 1080 dvpvv.exe 41 PID 1080 wrote to memory of 1340 1080 dvpvv.exe 41 PID 1340 wrote to memory of 2036 1340 ppdpv.exe 42 PID 1340 wrote to memory of 2036 1340 ppdpv.exe 42 PID 1340 wrote to memory of 2036 1340 ppdpv.exe 42 PID 1340 wrote to memory of 2036 1340 ppdpv.exe 42 PID 2036 wrote to memory of 2680 2036 rlxxflx.exe 43 PID 2036 wrote to memory of 2680 2036 rlxxflx.exe 43 PID 2036 wrote to memory of 2680 2036 rlxxflx.exe 43 PID 2036 wrote to memory of 2680 2036 rlxxflx.exe 43 PID 2680 wrote to memory of 268 2680 hhtnbb.exe 44 PID 2680 wrote to memory of 268 2680 hhtnbb.exe 44 PID 2680 wrote to memory of 268 2680 hhtnbb.exe 44 PID 2680 wrote to memory of 268 2680 hhtnbb.exe 44 PID 268 wrote to memory of 1524 268 5hbttb.exe 45 PID 268 wrote to memory of 1524 268 5hbttb.exe 45 PID 268 wrote to memory of 1524 268 5hbttb.exe 45 PID 268 wrote to memory of 1524 268 5hbttb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe"C:\Users\Admin\AppData\Local\Temp\375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\djppv.exec:\djppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\ppdjp.exec:\ppdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\1rfllff.exec:\1rfllff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tthtbb.exec:\tthtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\3ntbhh.exec:\3ntbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\7jjvj.exec:\7jjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\bthnbb.exec:\bthnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\dpdvv.exec:\dpdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\lfxxrfr.exec:\lfxxrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\btnnbt.exec:\btnnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\dvpvv.exec:\dvpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\ppdpv.exec:\ppdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\rlxxflx.exec:\rlxxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hhtnbb.exec:\hhtnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5hbttb.exec:\5hbttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\dvjjj.exec:\dvjjj.exe17⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1frxfxr.exec:\1frxfxr.exe18⤵
- Executes dropped EXE
PID:480 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe19⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nhbhtb.exec:\nhbhtb.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jvppp.exec:\jvppp.exe21⤵
- Executes dropped EXE
PID:664 -
\??\c:\9jdvd.exec:\9jdvd.exe22⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xlxflfl.exec:\xlxflfl.exe23⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rlrxxff.exec:\rlrxxff.exe24⤵
- Executes dropped EXE
PID:896 -
\??\c:\5nbhnn.exec:\5nbhnn.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dpddd.exec:\dpddd.exe26⤵
- Executes dropped EXE
PID:548 -
\??\c:\1pppv.exec:\1pppv.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnhhnn.exec:\tnhhnn.exe28⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5bthnh.exec:\5bthnh.exe29⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ddvjp.exec:\ddvjp.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rfrxxrf.exec:\rfrxxrf.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3xllxxl.exec:\3xllxxl.exe32⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hthbbt.exec:\hthbbt.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1ddpv.exec:\1ddpv.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xfflxfl.exec:\xfflxfl.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hthhnb.exec:\hthhnb.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbtbhn.exec:\hbtbhn.exe38⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3pjvd.exec:\3pjvd.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3vvjj.exec:\3vvjj.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3frrxxf.exec:\3frrxxf.exe41⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xrlrflx.exec:\xrlrflx.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\1bnbhh.exec:\1bnbhh.exe43⤵
- Executes dropped EXE
PID:1188 -
\??\c:\1bhhnb.exec:\1bhhnb.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvvpp.exec:\dvvpp.exe45⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3jvdd.exec:\3jvdd.exe46⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fxfxllr.exec:\fxfxllr.exe47⤵
- Executes dropped EXE
PID:348 -
\??\c:\5llfxxl.exec:\5llfxxl.exe48⤵
- Executes dropped EXE
PID:1964 -
\??\c:\thbbtt.exec:\thbbtt.exe49⤵
- Executes dropped EXE
PID:1340 -
\??\c:\tnbhth.exec:\tnbhth.exe50⤵
- Executes dropped EXE
PID:544 -
\??\c:\vvjpv.exec:\vvjpv.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5dddd.exec:\5dddd.exe52⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xrlrlxx.exec:\xrlrlxx.exe53⤵
- Executes dropped EXE
PID:568 -
\??\c:\xfxlfrx.exec:\xfxlfrx.exe54⤵
- Executes dropped EXE
PID:1344 -
\??\c:\tnbtbt.exec:\tnbtbt.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\7tbbnt.exec:\7tbbnt.exe56⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pjvvv.exec:\pjvvv.exe57⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdppp.exec:\jdppp.exe58⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe59⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xrlxfxl.exec:\xrlxfxl.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220 -
\??\c:\nbhhnn.exec:\nbhhnn.exe61⤵
- Executes dropped EXE
PID:924 -
\??\c:\hbtbhn.exec:\hbtbhn.exe62⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3pvdd.exec:\3pvdd.exe63⤵
- Executes dropped EXE
PID:1848 -
\??\c:\dpjdj.exec:\dpjdj.exe64⤵
- Executes dropped EXE
PID:772 -
\??\c:\1ntntt.exec:\1ntntt.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hbttnt.exec:\hbttnt.exe66⤵PID:2040
-
\??\c:\9jjpp.exec:\9jjpp.exe67⤵PID:2164
-
\??\c:\pdvvj.exec:\pdvvj.exe68⤵PID:2200
-
\??\c:\llflrfl.exec:\llflrfl.exe69⤵PID:876
-
\??\c:\fxllrll.exec:\fxllrll.exe70⤵PID:1696
-
\??\c:\thntbh.exec:\thntbh.exe71⤵PID:1608
-
\??\c:\thhhbb.exec:\thhhbb.exe72⤵PID:2436
-
\??\c:\dvpdj.exec:\dvpdj.exe73⤵PID:2740
-
\??\c:\7jdvj.exec:\7jdvj.exe74⤵PID:2808
-
\??\c:\xxlrxff.exec:\xxlrxff.exe75⤵PID:2252
-
\??\c:\xlllrlr.exec:\xlllrlr.exe76⤵PID:2288
-
\??\c:\tntbbb.exec:\tntbbb.exe77⤵PID:2640
-
\??\c:\7hbbnt.exec:\7hbbnt.exe78⤵PID:2752
-
\??\c:\dvdpp.exec:\dvdpp.exe79⤵PID:2656
-
\??\c:\dvddd.exec:\dvddd.exe80⤵PID:2648
-
\??\c:\llrxrfr.exec:\llrxrfr.exe81⤵PID:3060
-
\??\c:\5fffrrx.exec:\5fffrrx.exe82⤵PID:2172
-
\??\c:\9nbbhb.exec:\9nbbhb.exe83⤵PID:1720
-
\??\c:\btthbb.exec:\btthbb.exe84⤵PID:1928
-
\??\c:\ppjjp.exec:\ppjjp.exe85⤵PID:1976
-
\??\c:\pvddd.exec:\pvddd.exe86⤵PID:1864
-
\??\c:\frxrlrx.exec:\frxrlrx.exe87⤵PID:2980
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe88⤵PID:1944
-
\??\c:\tnbhtt.exec:\tnbhtt.exe89⤵PID:1480
-
\??\c:\9ntnnn.exec:\9ntnnn.exe90⤵PID:1044
-
\??\c:\vpjpj.exec:\vpjpj.exe91⤵PID:544
-
\??\c:\ddjdj.exec:\ddjdj.exe92⤵PID:2084
-
\??\c:\5lrrrlr.exec:\5lrrrlr.exe93⤵PID:532
-
\??\c:\rfflxff.exec:\rfflxff.exe94⤵PID:976
-
\??\c:\htbbhh.exec:\htbbhh.exe95⤵PID:1344
-
\??\c:\hbhtth.exec:\hbhtth.exe96⤵PID:2188
-
\??\c:\djjdd.exec:\djjdd.exe97⤵PID:2348
-
\??\c:\dvjvv.exec:\dvjvv.exe98⤵PID:2400
-
\??\c:\lfxflrl.exec:\lfxflrl.exe99⤵PID:952
-
\??\c:\3llrlrf.exec:\3llrlrf.exe100⤵PID:1688
-
\??\c:\xrxfxff.exec:\xrxfxff.exe101⤵PID:2124
-
\??\c:\nhntbb.exec:\nhntbb.exe102⤵PID:2212
-
\??\c:\nhnbhn.exec:\nhnbhn.exe103⤵PID:880
-
\??\c:\3pvvv.exec:\3pvvv.exe104⤵PID:1788
-
\??\c:\ddppp.exec:\ddppp.exe105⤵PID:2440
-
\??\c:\3jjpv.exec:\3jjpv.exe106⤵PID:2292
-
\??\c:\3lffllf.exec:\3lffllf.exe107⤵PID:2040
-
\??\c:\rlfllrf.exec:\rlfllrf.exe108⤵PID:2664
-
\??\c:\1bnnnh.exec:\1bnnnh.exe109⤵PID:1768
-
\??\c:\7hthtt.exec:\7hthtt.exe110⤵PID:992
-
\??\c:\dvjjj.exec:\dvjjj.exe111⤵PID:2256
-
\??\c:\9dvdj.exec:\9dvdj.exe112⤵PID:1772
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe113⤵PID:2804
-
\??\c:\5fxxllr.exec:\5fxxllr.exe114⤵PID:2308
-
\??\c:\7xrxffx.exec:\7xrxffx.exe115⤵PID:1088
-
\??\c:\5nbnbt.exec:\5nbnbt.exe116⤵PID:2676
-
\??\c:\nhthth.exec:\nhthth.exe117⤵PID:2696
-
\??\c:\9djjj.exec:\9djjj.exe118⤵PID:1588
-
\??\c:\ppjvj.exec:\ppjvj.exe119⤵PID:1556
-
\??\c:\5fxxfxr.exec:\5fxxfxr.exe120⤵PID:2720
-
\??\c:\9xrxflx.exec:\9xrxflx.exe121⤵PID:3056
-
\??\c:\hbhhhb.exec:\hbhhhb.exe122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-