Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe
Resource
win7-20240903-en
General
-
Target
62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe
-
Size
64KB
-
MD5
4948e4ac3dfeee3aa5fc4229541b515b
-
SHA1
fe19811fe3ff6479a740dea6a52ced6a9ddf730f
-
SHA256
62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295
-
SHA512
52db3bc6d8f074668cbf6a1be1f8040fc68ae84285a1c106ed2e3e0276e3bb492a3f45403cb5c712c8faed0a2edfaf877fe9f335470cc8abf8e41fcd11dd716e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1k:ymb3NkkiQ3mdBjFI9c6
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2652-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2372 vddpv.exe 2752 lflrffl.exe 2964 hbttbb.exe 2740 1vjpv.exe 2616 jdppp.exe 2612 xrlfrrf.exe 1360 llxlxxl.exe 2184 vpjvp.exe 1972 3pjjv.exe 2888 1xxxlrf.exe 2052 1ffxlrx.exe 1620 htbnhn.exe 1664 jvdvp.exe 1312 1rxfrxl.exe 2120 nhtbnt.exe 1500 btnthn.exe 544 3vdpd.exe 2388 xxrxllx.exe 2368 1lrxfrx.exe 1960 nhtbnn.exe 1488 nnhtbn.exe 1368 7dppv.exe 2532 rlxfxxl.exe 560 9rlrflr.exe 2416 hhnntt.exe 2456 ntbntn.exe 3012 rlxffxx.exe 376 7xlfxxf.exe 1800 tnthtn.exe 1308 3tnnhh.exe 3020 3vjvp.exe 2968 xrxlrlr.exe 2776 rllxlxx.exe 2568 nbnttt.exe 2728 bnhnbb.exe 1544 jdvdv.exe 2560 dvdjp.exe 2616 7fxflrx.exe 2612 1rxxllr.exe 776 3hnntt.exe 1432 5hbnhh.exe 2184 jvjvd.exe 1208 xrrrlfl.exe 1976 tttbnt.exe 1276 bthbhb.exe 2664 jjvjd.exe 1992 frrffxf.exe 1296 ffxlflx.exe 1724 hbnthh.exe 3048 3nnhth.exe 532 jjvjv.exe 568 5jjjv.exe 2196 7frrrlr.exe 2180 1frrxfr.exe 1796 1hnntt.exe 2368 hhtbnt.exe 2384 3ppvd.exe 2132 5lffrxf.exe 2412 fxrfxfl.exe 908 1nnthb.exe 1236 5bbhth.exe 2900 pjddp.exe 2416 vpjjj.exe 2464 rlxxxfl.exe -
resource yara_rule behavioral1/memory/2652-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2372 2652 62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe 30 PID 2652 wrote to memory of 2372 2652 62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe 30 PID 2652 wrote to memory of 2372 2652 62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe 30 PID 2652 wrote to memory of 2372 2652 62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe 30 PID 2372 wrote to memory of 2752 2372 vddpv.exe 31 PID 2372 wrote to memory of 2752 2372 vddpv.exe 31 PID 2372 wrote to memory of 2752 2372 vddpv.exe 31 PID 2372 wrote to memory of 2752 2372 vddpv.exe 31 PID 2752 wrote to memory of 2964 2752 lflrffl.exe 32 PID 2752 wrote to memory of 2964 2752 lflrffl.exe 32 PID 2752 wrote to memory of 2964 2752 lflrffl.exe 32 PID 2752 wrote to memory of 2964 2752 lflrffl.exe 32 PID 2964 wrote to memory of 2740 2964 hbttbb.exe 33 PID 2964 wrote to memory of 2740 2964 hbttbb.exe 33 PID 2964 wrote to memory of 2740 2964 hbttbb.exe 33 PID 2964 wrote to memory of 2740 2964 hbttbb.exe 33 PID 2740 wrote to memory of 2616 2740 1vjpv.exe 34 PID 2740 wrote to memory of 2616 2740 1vjpv.exe 34 PID 2740 wrote to memory of 2616 2740 1vjpv.exe 34 PID 2740 wrote to memory of 2616 2740 1vjpv.exe 34 PID 2616 wrote to memory of 2612 2616 jdppp.exe 35 PID 2616 wrote to memory of 2612 2616 jdppp.exe 35 PID 2616 wrote to memory of 2612 2616 jdppp.exe 35 PID 2616 wrote to memory of 2612 2616 jdppp.exe 35 PID 2612 wrote to memory of 1360 2612 xrlfrrf.exe 36 PID 2612 wrote to memory of 1360 2612 xrlfrrf.exe 36 PID 2612 wrote to memory of 1360 2612 xrlfrrf.exe 36 PID 2612 wrote to memory of 1360 2612 xrlfrrf.exe 36 PID 1360 wrote to memory of 2184 1360 llxlxxl.exe 37 PID 1360 wrote to memory of 2184 1360 llxlxxl.exe 37 PID 1360 wrote to memory of 2184 1360 llxlxxl.exe 37 PID 1360 wrote to memory of 2184 1360 llxlxxl.exe 37 PID 2184 wrote to memory of 1972 2184 vpjvp.exe 38 PID 2184 wrote to memory of 1972 2184 vpjvp.exe 38 PID 2184 wrote to memory of 1972 2184 vpjvp.exe 38 PID 2184 wrote to memory of 1972 2184 vpjvp.exe 38 PID 1972 wrote to memory of 2888 1972 3pjjv.exe 39 PID 1972 wrote to memory of 2888 1972 3pjjv.exe 39 PID 1972 wrote to memory of 2888 1972 3pjjv.exe 39 PID 1972 wrote to memory of 2888 1972 3pjjv.exe 39 PID 2888 wrote to memory of 2052 2888 1xxxlrf.exe 40 PID 2888 wrote to memory of 2052 2888 1xxxlrf.exe 40 PID 2888 wrote to memory of 2052 2888 1xxxlrf.exe 40 PID 2888 wrote to memory of 2052 2888 1xxxlrf.exe 40 PID 2052 wrote to memory of 1620 2052 1ffxlrx.exe 41 PID 2052 wrote to memory of 1620 2052 1ffxlrx.exe 41 PID 2052 wrote to memory of 1620 2052 1ffxlrx.exe 41 PID 2052 wrote to memory of 1620 2052 1ffxlrx.exe 41 PID 1620 wrote to memory of 1664 1620 htbnhn.exe 42 PID 1620 wrote to memory of 1664 1620 htbnhn.exe 42 PID 1620 wrote to memory of 1664 1620 htbnhn.exe 42 PID 1620 wrote to memory of 1664 1620 htbnhn.exe 42 PID 1664 wrote to memory of 1312 1664 jvdvp.exe 43 PID 1664 wrote to memory of 1312 1664 jvdvp.exe 43 PID 1664 wrote to memory of 1312 1664 jvdvp.exe 43 PID 1664 wrote to memory of 1312 1664 jvdvp.exe 43 PID 1312 wrote to memory of 2120 1312 1rxfrxl.exe 44 PID 1312 wrote to memory of 2120 1312 1rxfrxl.exe 44 PID 1312 wrote to memory of 2120 1312 1rxfrxl.exe 44 PID 1312 wrote to memory of 2120 1312 1rxfrxl.exe 44 PID 2120 wrote to memory of 1500 2120 nhtbnt.exe 45 PID 2120 wrote to memory of 1500 2120 nhtbnt.exe 45 PID 2120 wrote to memory of 1500 2120 nhtbnt.exe 45 PID 2120 wrote to memory of 1500 2120 nhtbnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe"C:\Users\Admin\AppData\Local\Temp\62f4662f9909899d9a59cdbb17d1cfdce4138dbe275c75ff87deb01a1c519295.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vddpv.exec:\vddpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lflrffl.exec:\lflrffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hbttbb.exec:\hbttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\1vjpv.exec:\1vjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jdppp.exec:\jdppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xrlfrrf.exec:\xrlfrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\llxlxxl.exec:\llxlxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\vpjvp.exec:\vpjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\3pjjv.exec:\3pjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\1xxxlrf.exec:\1xxxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1ffxlrx.exec:\1ffxlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\htbnhn.exec:\htbnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jvdvp.exec:\jvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\1rxfrxl.exec:\1rxfrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\nhtbnt.exec:\nhtbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\btnthn.exec:\btnthn.exe17⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3vdpd.exec:\3vdpd.exe18⤵
- Executes dropped EXE
PID:544 -
\??\c:\xxrxllx.exec:\xxrxllx.exe19⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1lrxfrx.exec:\1lrxfrx.exe20⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhtbnn.exec:\nhtbnn.exe21⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nnhtbn.exec:\nnhtbn.exe22⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7dppv.exec:\7dppv.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rlxfxxl.exec:\rlxfxxl.exe24⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9rlrflr.exec:\9rlrflr.exe25⤵
- Executes dropped EXE
PID:560 -
\??\c:\hhnntt.exec:\hhnntt.exe26⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ntbntn.exec:\ntbntn.exe27⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlxffxx.exec:\rlxffxx.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7xlfxxf.exec:\7xlfxxf.exe29⤵
- Executes dropped EXE
PID:376 -
\??\c:\tnthtn.exec:\tnthtn.exe30⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3tnnhh.exec:\3tnnhh.exe31⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3vjvp.exec:\3vjvp.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xrxlrlr.exec:\xrxlrlr.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rllxlxx.exec:\rllxlxx.exe34⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nbnttt.exec:\nbnttt.exe35⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bnhnbb.exec:\bnhnbb.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jdvdv.exec:\jdvdv.exe37⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dvdjp.exec:\dvdjp.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7fxflrx.exec:\7fxflrx.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1rxxllr.exec:\1rxxllr.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3hnntt.exec:\3hnntt.exe41⤵
- Executes dropped EXE
PID:776 -
\??\c:\5hbnhh.exec:\5hbnhh.exe42⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jvjvd.exec:\jvjvd.exe43⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xrrrlfl.exec:\xrrrlfl.exe44⤵
- Executes dropped EXE
PID:1208 -
\??\c:\tttbnt.exec:\tttbnt.exe45⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bthbhb.exec:\bthbhb.exe46⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jjvjd.exec:\jjvjd.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\frrffxf.exec:\frrffxf.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\ffxlflx.exec:\ffxlflx.exe49⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hbnthh.exec:\hbnthh.exe50⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3nnhth.exec:\3nnhth.exe51⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jjvjv.exec:\jjvjv.exe52⤵
- Executes dropped EXE
PID:532 -
\??\c:\5jjjv.exec:\5jjjv.exe53⤵
- Executes dropped EXE
PID:568 -
\??\c:\7frrrlr.exec:\7frrrlr.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1frrxfr.exec:\1frrxfr.exe55⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1hnntt.exec:\1hnntt.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hhtbnt.exec:\hhtbnt.exe57⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3ppvd.exec:\3ppvd.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5lffrxf.exec:\5lffrxf.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe60⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1nnthb.exec:\1nnthb.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\5bbhth.exec:\5bbhth.exe62⤵
- Executes dropped EXE
PID:1236 -
\??\c:\pjddp.exec:\pjddp.exe63⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vpjjj.exec:\vpjjj.exe64⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe65⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxrrxff.exec:\lxrrxff.exe66⤵PID:1736
-
\??\c:\7btbhn.exec:\7btbhn.exe67⤵PID:1240
-
\??\c:\jvjpp.exec:\jvjpp.exe68⤵PID:1784
-
\??\c:\dpjvp.exec:\dpjvp.exe69⤵PID:1012
-
\??\c:\xrfffrx.exec:\xrfffrx.exe70⤵PID:2032
-
\??\c:\llxxxxf.exec:\llxxxxf.exe71⤵PID:2484
-
\??\c:\tnbttb.exec:\tnbttb.exe72⤵PID:2768
-
\??\c:\ttnttt.exec:\ttnttt.exe73⤵PID:2968
-
\??\c:\dvppv.exec:\dvppv.exe74⤵PID:1904
-
\??\c:\pjjvd.exec:\pjjvd.exe75⤵PID:2228
-
\??\c:\xrfflll.exec:\xrfflll.exe76⤵PID:1564
-
\??\c:\3xfrxfl.exec:\3xfrxfl.exe77⤵PID:1256
-
\??\c:\7btbnn.exec:\7btbnn.exe78⤵PID:2584
-
\??\c:\ddjpv.exec:\ddjpv.exe79⤵PID:3064
-
\??\c:\pjvpj.exec:\pjvpj.exe80⤵PID:1484
-
\??\c:\5fxxflf.exec:\5fxxflf.exe81⤵PID:1808
-
\??\c:\rlfflll.exec:\rlfflll.exe82⤵PID:2064
-
\??\c:\tnbbnh.exec:\tnbbnh.exe83⤵PID:3036
-
\??\c:\hhthbn.exec:\hhthbn.exe84⤵PID:628
-
\??\c:\vdjjp.exec:\vdjjp.exe85⤵PID:2540
-
\??\c:\jvppv.exec:\jvppv.exe86⤵PID:2100
-
\??\c:\lxrxrxx.exec:\lxrxrxx.exe87⤵PID:2244
-
\??\c:\lxrrflx.exec:\lxrrflx.exe88⤵PID:2648
-
\??\c:\llxfllr.exec:\llxfllr.exe89⤵PID:1052
-
\??\c:\3hhtbh.exec:\3hhtbh.exe90⤵PID:1312
-
\??\c:\hbthnn.exec:\hbthnn.exe91⤵PID:1700
-
\??\c:\7vjpv.exec:\7vjpv.exe92⤵PID:600
-
\??\c:\vpddp.exec:\vpddp.exe93⤵PID:1532
-
\??\c:\xxrfffr.exec:\xxrfffr.exe94⤵PID:1964
-
\??\c:\xxlrflr.exec:\xxlrflr.exe95⤵PID:2352
-
\??\c:\bhtnhh.exec:\bhtnhh.exe96⤵PID:2348
-
\??\c:\jjdpp.exec:\jjdpp.exe97⤵PID:2336
-
\??\c:\9vjjp.exec:\9vjjp.exe98⤵PID:1792
-
\??\c:\xrlrflr.exec:\xrlrflr.exe99⤵PID:1488
-
\??\c:\fxlxlxr.exec:\fxlxlxr.exe100⤵PID:1768
-
\??\c:\btnthb.exec:\btnthb.exe101⤵PID:1836
-
\??\c:\nhtttb.exec:\nhtttb.exe102⤵PID:964
-
\??\c:\nhbbtb.exec:\nhbbtb.exe103⤵PID:2936
-
\??\c:\jdjjj.exec:\jdjjj.exe104⤵PID:1672
-
\??\c:\5jjvd.exec:\5jjvd.exe105⤵PID:2396
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe106⤵PID:2492
-
\??\c:\7fxxxfl.exec:\7fxxxfl.exe107⤵PID:2020
-
\??\c:\7htthh.exec:\7htthh.exe108⤵PID:1748
-
\??\c:\nttnbt.exec:\nttnbt.exe109⤵PID:2524
-
\??\c:\7jdpd.exec:\7jdpd.exe110⤵PID:2704
-
\??\c:\7jvjv.exec:\7jvjv.exe111⤵PID:2156
-
\??\c:\7rxxrrf.exec:\7rxxrrf.exe112⤵PID:2816
-
\??\c:\1rlxfxl.exec:\1rlxfxl.exe113⤵PID:2716
-
\??\c:\3hhttt.exec:\3hhttt.exe114⤵PID:1924
-
\??\c:\5nhtth.exec:\5nhtth.exe115⤵PID:2740
-
\??\c:\jjjpp.exec:\jjjpp.exe116⤵PID:2296
-
\??\c:\vvvdj.exec:\vvvdj.exe117⤵PID:2636
-
\??\c:\xfrrxll.exec:\xfrrxll.exe118⤵PID:3068
-
\??\c:\fxlxffl.exec:\fxlxffl.exe119⤵PID:2000
-
\??\c:\bthnth.exec:\bthnth.exe120⤵PID:2236
-
\??\c:\9hhhtt.exec:\9hhhtt.exe121⤵PID:2432
-
\??\c:\pjvvj.exec:\pjvvj.exe122⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-