Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe
Resource
win7-20240729-en
General
-
Target
714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe
-
Size
57KB
-
MD5
a14dc2d35bbe74e2012eefe1744f0dd0
-
SHA1
580cc4cee05339bd276259e51adae7d588de35d7
-
SHA256
714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525
-
SHA512
8c2765bd6fecac80f1a6388168bb4ec50b8f8725e1957f7e6825e5945d63870a8e8f97840cba869132d1c864585bd0545eda7d558f824f9af401d547b1e649d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgFC:ymb3NkkiQ3mdBjFIgFC
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2144-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2616 flxrllr.exe 2804 nbnntb.exe 2816 7vdvp.exe 2016 rlrrrlr.exe 2848 tnhhnn.exe 2660 5bbbbn.exe 3044 bhnnnh.exe 448 vpvdd.exe 2220 dpvpp.exe 484 9fxfrlx.exe 1340 lxlfrlr.exe 2012 7tthtn.exe 2452 3ntttt.exe 900 ppdvd.exe 2720 vjpdj.exe 1156 rlrllrx.exe 1752 1rllllr.exe 2992 xrfflfl.exe 1940 5bnnnt.exe 2168 9nhnnt.exe 1976 vpddd.exe 1632 1vvjp.exe 2648 lfrxffr.exe 1960 xlxxxrx.exe 1312 fxlrxfl.exe 2352 hbhbhb.exe 2524 7htbbb.exe 1964 ddjpv.exe 2596 5dvpp.exe 2580 frfffxf.exe 1664 fxxxlrf.exe 2764 xxlrxxl.exe 2920 bbbbnt.exe 2812 thnnnt.exe 2796 vvpvv.exe 2676 pdppp.exe 2668 vjppv.exe 2900 7lrxffl.exe 2080 3xllrrr.exe 1908 xrxfrrx.exe 2024 7hbhhh.exe 1376 tnttbh.exe 756 bthhtb.exe 2564 dvjpv.exe 2452 vppdd.exe 768 jdjjp.exe 1196 5rxrxfx.exe 1712 frxlrlr.exe 1156 5frllxf.exe 2184 nbhnnn.exe 2292 9thhbh.exe 1940 nbhtbt.exe 2712 pdjjv.exe 1084 jvppp.exe 536 pjjdp.exe 3016 jvpvd.exe 2968 xfrllfr.exe 752 7fxlflr.exe 1316 rflffxf.exe 1312 1btbbt.exe 2396 htttnt.exe 1636 hbnhnn.exe 2440 ppvdj.exe 1964 1ppjv.exe -
resource yara_rule behavioral1/memory/2144-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-14-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2616 2144 714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe 29 PID 2144 wrote to memory of 2616 2144 714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe 29 PID 2144 wrote to memory of 2616 2144 714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe 29 PID 2144 wrote to memory of 2616 2144 714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe 29 PID 2616 wrote to memory of 2804 2616 flxrllr.exe 30 PID 2616 wrote to memory of 2804 2616 flxrllr.exe 30 PID 2616 wrote to memory of 2804 2616 flxrllr.exe 30 PID 2616 wrote to memory of 2804 2616 flxrllr.exe 30 PID 2804 wrote to memory of 2816 2804 nbnntb.exe 97 PID 2804 wrote to memory of 2816 2804 nbnntb.exe 97 PID 2804 wrote to memory of 2816 2804 nbnntb.exe 97 PID 2804 wrote to memory of 2816 2804 nbnntb.exe 97 PID 2816 wrote to memory of 2016 2816 7vdvp.exe 32 PID 2816 wrote to memory of 2016 2816 7vdvp.exe 32 PID 2816 wrote to memory of 2016 2816 7vdvp.exe 32 PID 2816 wrote to memory of 2016 2816 7vdvp.exe 32 PID 2016 wrote to memory of 2848 2016 rlrrrlr.exe 33 PID 2016 wrote to memory of 2848 2016 rlrrrlr.exe 33 PID 2016 wrote to memory of 2848 2016 rlrrrlr.exe 33 PID 2016 wrote to memory of 2848 2016 rlrrrlr.exe 33 PID 2848 wrote to memory of 2660 2848 tnhhnn.exe 34 PID 2848 wrote to memory of 2660 2848 tnhhnn.exe 34 PID 2848 wrote to memory of 2660 2848 tnhhnn.exe 34 PID 2848 wrote to memory of 2660 2848 tnhhnn.exe 34 PID 2660 wrote to memory of 3044 2660 5bbbbn.exe 35 PID 2660 wrote to memory of 3044 2660 5bbbbn.exe 35 PID 2660 wrote to memory of 3044 2660 5bbbbn.exe 35 PID 2660 wrote to memory of 3044 2660 5bbbbn.exe 35 PID 3044 wrote to memory of 448 3044 bhnnnh.exe 36 PID 3044 wrote to memory of 448 3044 bhnnnh.exe 36 PID 3044 wrote to memory of 448 3044 bhnnnh.exe 36 PID 3044 wrote to memory of 448 3044 bhnnnh.exe 36 PID 448 wrote to memory of 2220 448 vpvdd.exe 37 PID 448 wrote to memory of 2220 448 vpvdd.exe 37 PID 448 wrote to memory of 2220 448 vpvdd.exe 37 PID 448 wrote to memory of 2220 448 vpvdd.exe 37 PID 2220 wrote to memory of 484 2220 dpvpp.exe 38 PID 2220 wrote to memory of 484 2220 dpvpp.exe 38 PID 2220 wrote to memory of 484 2220 dpvpp.exe 38 PID 2220 wrote to memory of 484 2220 dpvpp.exe 38 PID 484 wrote to memory of 1340 484 9fxfrlx.exe 108 PID 484 wrote to memory of 1340 484 9fxfrlx.exe 108 PID 484 wrote to memory of 1340 484 9fxfrlx.exe 108 PID 484 wrote to memory of 1340 484 9fxfrlx.exe 108 PID 1340 wrote to memory of 2012 1340 lxlfrlr.exe 40 PID 1340 wrote to memory of 2012 1340 lxlfrlr.exe 40 PID 1340 wrote to memory of 2012 1340 lxlfrlr.exe 40 PID 1340 wrote to memory of 2012 1340 lxlfrlr.exe 40 PID 2012 wrote to memory of 2452 2012 7tthtn.exe 41 PID 2012 wrote to memory of 2452 2012 7tthtn.exe 41 PID 2012 wrote to memory of 2452 2012 7tthtn.exe 41 PID 2012 wrote to memory of 2452 2012 7tthtn.exe 41 PID 2452 wrote to memory of 900 2452 3ntttt.exe 42 PID 2452 wrote to memory of 900 2452 3ntttt.exe 42 PID 2452 wrote to memory of 900 2452 3ntttt.exe 42 PID 2452 wrote to memory of 900 2452 3ntttt.exe 42 PID 900 wrote to memory of 2720 900 ppdvd.exe 43 PID 900 wrote to memory of 2720 900 ppdvd.exe 43 PID 900 wrote to memory of 2720 900 ppdvd.exe 43 PID 900 wrote to memory of 2720 900 ppdvd.exe 43 PID 2720 wrote to memory of 1156 2720 vjpdj.exe 44 PID 2720 wrote to memory of 1156 2720 vjpdj.exe 44 PID 2720 wrote to memory of 1156 2720 vjpdj.exe 44 PID 2720 wrote to memory of 1156 2720 vjpdj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe"C:\Users\Admin\AppData\Local\Temp\714b35770f29663bc046d99a3bc67c93085f766b6f5317e8df1866c6d1af2525N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\flxrllr.exec:\flxrllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nbnntb.exec:\nbnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7vdvp.exec:\7vdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rlrrrlr.exec:\rlrrrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\tnhhnn.exec:\tnhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\5bbbbn.exec:\5bbbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bhnnnh.exec:\bhnnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vpvdd.exec:\vpvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\dpvpp.exec:\dpvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\9fxfrlx.exec:\9fxfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\lxlfrlr.exec:\lxlfrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\7tthtn.exec:\7tthtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\3ntttt.exec:\3ntttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ppdvd.exec:\ppdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\vjpdj.exec:\vjpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rlrllrx.exec:\rlrllrx.exe17⤵
- Executes dropped EXE
PID:1156 -
\??\c:\1rllllr.exec:\1rllllr.exe18⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xrfflfl.exec:\xrfflfl.exe19⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5bnnnt.exec:\5bnnnt.exe20⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9nhnnt.exec:\9nhnnt.exe21⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vpddd.exec:\vpddd.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1vvjp.exec:\1vvjp.exe23⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lfrxffr.exec:\lfrxffr.exe24⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe25⤵
- Executes dropped EXE
PID:1960 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hbhbhb.exec:\hbhbhb.exe27⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7htbbb.exec:\7htbbb.exe28⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ddjpv.exec:\ddjpv.exe29⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5dvpp.exec:\5dvpp.exe30⤵
- Executes dropped EXE
PID:2596 -
\??\c:\frfffxf.exec:\frfffxf.exe31⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe32⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe33⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bbbbnt.exec:\bbbbnt.exe34⤵
- Executes dropped EXE
PID:2920 -
\??\c:\thnnnt.exec:\thnnnt.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vvpvv.exec:\vvpvv.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pdppp.exec:\pdppp.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjppv.exec:\vjppv.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7lrxffl.exec:\7lrxffl.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3xllrrr.exec:\3xllrrr.exe40⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe41⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7hbhhh.exec:\7hbhhh.exe42⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnttbh.exec:\tnttbh.exe43⤵
- Executes dropped EXE
PID:1376 -
\??\c:\bthhtb.exec:\bthhtb.exe44⤵
- Executes dropped EXE
PID:756 -
\??\c:\dvjpv.exec:\dvjpv.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vppdd.exec:\vppdd.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jdjjp.exec:\jdjjp.exe47⤵
- Executes dropped EXE
PID:768 -
\??\c:\5rxrxfx.exec:\5rxrxfx.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\frxlrlr.exec:\frxlrlr.exe49⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5frllxf.exec:\5frllxf.exe50⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nbhnnn.exec:\nbhnnn.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\9thhbh.exec:\9thhbh.exe52⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nbhtbt.exec:\nbhtbt.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pdjjv.exec:\pdjjv.exe54⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jvppp.exec:\jvppp.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pjjdp.exec:\pjjdp.exe56⤵
- Executes dropped EXE
PID:536 -
\??\c:\jvpvd.exec:\jvpvd.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xfrllfr.exec:\xfrllfr.exe58⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7fxlflr.exec:\7fxlflr.exe59⤵
- Executes dropped EXE
PID:752 -
\??\c:\rflffxf.exec:\rflffxf.exe60⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1btbbt.exec:\1btbbt.exe61⤵
- Executes dropped EXE
PID:1312 -
\??\c:\htttnt.exec:\htttnt.exe62⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hbnhnn.exec:\hbnhnn.exe63⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ppvdj.exec:\ppvdj.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1ppjv.exec:\1ppjv.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vpjpp.exec:\vpjpp.exe66⤵PID:2808
-
\??\c:\rflflff.exec:\rflflff.exe67⤵PID:872
-
\??\c:\lxxxffl.exec:\lxxxffl.exe68⤵PID:2288
-
\??\c:\rllrxfr.exec:\rllrxfr.exe69⤵PID:2472
-
\??\c:\5bnhnh.exec:\5bnhnh.exe70⤵PID:2816
-
\??\c:\bbhhtn.exec:\bbhhtn.exe71⤵PID:544
-
\??\c:\xlrrffr.exec:\xlrrffr.exe72⤵PID:304
-
\??\c:\xlllrlr.exec:\xlllrlr.exe73⤵PID:2672
-
\??\c:\rrffrxf.exec:\rrffrxf.exe74⤵PID:2660
-
\??\c:\9fxffll.exec:\9fxffll.exe75⤵PID:568
-
\??\c:\1bhbhb.exec:\1bhbhb.exe76⤵PID:2928
-
\??\c:\nhbhbt.exec:\nhbhbt.exe77⤵PID:2068
-
\??\c:\tnnhth.exec:\tnnhth.exe78⤵PID:2748
-
\??\c:\rlrxffx.exec:\rlrxffx.exe79⤵PID:2792
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe80⤵PID:2000
-
\??\c:\hnhtth.exec:\hnhtth.exe81⤵PID:1340
-
\??\c:\tbtnnt.exec:\tbtnnt.exe82⤵PID:2096
-
\??\c:\pjvjj.exec:\pjvjj.exe83⤵PID:2384
-
\??\c:\3lffllr.exec:\3lffllr.exe84⤵PID:2424
-
\??\c:\llflxlx.exec:\llflxlx.exe85⤵PID:2532
-
\??\c:\9htbbh.exec:\9htbbh.exe86⤵PID:2520
-
\??\c:\5vjjj.exec:\5vjjj.exe87⤵PID:292
-
\??\c:\jvddj.exec:\jvddj.exe88⤵PID:1712
-
\??\c:\hbtbht.exec:\hbtbht.exe89⤵PID:1156
-
\??\c:\nhttbt.exec:\nhttbt.exe90⤵PID:2184
-
\??\c:\jvppd.exec:\jvppd.exe91⤵PID:2600
-
\??\c:\3xrllfl.exec:\3xrllfl.exe92⤵PID:2108
-
\??\c:\hthttb.exec:\hthttb.exe93⤵PID:1952
-
\??\c:\bntnnn.exec:\bntnnn.exe94⤵PID:664
-
\??\c:\7tbnbn.exec:\7tbnbn.exe95⤵PID:1896
-
\??\c:\vjppd.exec:\vjppd.exe96⤵PID:1700
-
\??\c:\3rfxfxf.exec:\3rfxfxf.exe97⤵PID:2356
-
\??\c:\5jppv.exec:\5jppv.exe98⤵PID:1920
-
\??\c:\ppppv.exec:\ppppv.exe99⤵PID:1308
-
\??\c:\vjvvd.exec:\vjvvd.exe100⤵PID:976
-
\??\c:\frlfllr.exec:\frlfllr.exe101⤵PID:1512
-
\??\c:\3ntntb.exec:\3ntntb.exe102⤵PID:1804
-
\??\c:\dvjjj.exec:\dvjjj.exe103⤵PID:2144
-
\??\c:\pjppp.exec:\pjppp.exe104⤵PID:2204
-
\??\c:\xlrrxrf.exec:\xlrrxrf.exe105⤵PID:1704
-
\??\c:\bthhhh.exec:\bthhhh.exe106⤵PID:2580
-
\??\c:\hbtnbb.exec:\hbtnbb.exe107⤵PID:700
-
\??\c:\7jvvj.exec:\7jvvj.exe108⤵PID:2776
-
\??\c:\9xffllr.exec:\9xffllr.exe109⤵PID:2696
-
\??\c:\hbtbbh.exec:\hbtbbh.exe110⤵PID:2688
-
\??\c:\vpppv.exec:\vpppv.exe111⤵PID:2684
-
\??\c:\rflflrx.exec:\rflflrx.exe112⤵PID:2212
-
\??\c:\hbhnnb.exec:\hbhnnb.exe113⤵PID:3056
-
\??\c:\jdppv.exec:\jdppv.exe114⤵PID:2924
-
\??\c:\xrfxfll.exec:\xrfxfll.exe115⤵PID:2468
-
\??\c:\xrlrrfl.exec:\xrlrrfl.exe116⤵PID:2940
-
\??\c:\tnttbb.exec:\tnttbb.exe117⤵PID:2756
-
\??\c:\jddvd.exec:\jddvd.exe118⤵PID:484
-
\??\c:\vvjjp.exec:\vvjjp.exe119⤵PID:832
-
\??\c:\frffflr.exec:\frffflr.exe120⤵PID:2824
-
\??\c:\xxxxfrf.exec:\xxxxfrf.exe121⤵PID:2200
-
\??\c:\bntbbh.exec:\bntbbh.exe122⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-