Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe
Resource
win7-20240903-en
General
-
Target
1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe
-
Size
68KB
-
MD5
db485556bfa88b743ded11de0bb80807
-
SHA1
1e235382e05074c24134516999a4d06d4ee35eeb
-
SHA256
1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d
-
SHA512
2c88c455fb51d2582a82983db802fd6ad273a282aa8b9b9f6e1d51285bb4686c65a194b4b73be59ce60fdc50e427e62cc539028157b059944555c9a2ad2bd2ca
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6Nl1B:ymb3NkkiQ3mdBjFIugptB
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2736-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/972-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-301-0x00000000776E0000-0x00000000777FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2904 bhtntb.exe 3000 dpdvd.exe 2912 3llrxxx.exe 2924 9nhhnn.exe 2728 3vppv.exe 2784 pdppp.exe 792 xrlllfl.exe 600 1flxfxx.exe 2052 jvppv.exe 2084 ddjjj.exe 2504 ffrllxx.exe 1684 rlxxllx.exe 2856 hthhnn.exe 2872 vpjdv.exe 2976 3xlrxxf.exe 1960 frlrxxf.exe 2460 hbnbnn.exe 2204 jvdpv.exe 2572 jjvjv.exe 2268 5lxrxfr.exe 1596 lfllrxf.exe 1660 tnnthn.exe 2300 7nnbtt.exe 972 vpddd.exe 2284 lxlrxfr.exe 1128 5thhhb.exe 1628 bthnnb.exe 2996 1vvdj.exe 2552 jvpvd.exe 908 frllxxl.exe 1668 hbbhtb.exe 1652 tthhtt.exe 2836 pjvvp.exe 2944 dpjdj.exe 2636 xxlfxff.exe 2612 ffrxllr.exe 2640 hthnbt.exe 2440 tnbhhb.exe 2728 1vpvp.exe 332 pjpjp.exe 2028 7rrrxff.exe 580 3rlfffl.exe 880 bnbhhn.exe 2160 tnbtbh.exe 112 1dvdp.exe 2176 dvppv.exe 2080 xlrxllr.exe 1624 xrflxfr.exe 2980 5tbtbt.exe 3060 3hbbbh.exe 316 pjvvj.exe 692 jvdvj.exe 1700 rfllrrx.exe 3028 rlxfrrl.exe 2312 hbhhnh.exe 2060 tbbhbh.exe 2572 pjddp.exe 2144 5dvpp.exe 1124 xrxxrrx.exe 376 rlxlrfl.exe 2244 hbttbh.exe 1452 bnbbhh.exe 1292 vpdjj.exe 1756 1jvpp.exe -
resource yara_rule behavioral1/memory/2736-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/972-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-301-0x00000000776E0000-0x00000000777FF000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2904 2736 1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe 30 PID 2736 wrote to memory of 2904 2736 1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe 30 PID 2736 wrote to memory of 2904 2736 1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe 30 PID 2736 wrote to memory of 2904 2736 1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe 30 PID 2904 wrote to memory of 3000 2904 bhtntb.exe 31 PID 2904 wrote to memory of 3000 2904 bhtntb.exe 31 PID 2904 wrote to memory of 3000 2904 bhtntb.exe 31 PID 2904 wrote to memory of 3000 2904 bhtntb.exe 31 PID 3000 wrote to memory of 2912 3000 dpdvd.exe 32 PID 3000 wrote to memory of 2912 3000 dpdvd.exe 32 PID 3000 wrote to memory of 2912 3000 dpdvd.exe 32 PID 3000 wrote to memory of 2912 3000 dpdvd.exe 32 PID 2912 wrote to memory of 2924 2912 3llrxxx.exe 33 PID 2912 wrote to memory of 2924 2912 3llrxxx.exe 33 PID 2912 wrote to memory of 2924 2912 3llrxxx.exe 33 PID 2912 wrote to memory of 2924 2912 3llrxxx.exe 33 PID 2924 wrote to memory of 2728 2924 9nhhnn.exe 34 PID 2924 wrote to memory of 2728 2924 9nhhnn.exe 34 PID 2924 wrote to memory of 2728 2924 9nhhnn.exe 34 PID 2924 wrote to memory of 2728 2924 9nhhnn.exe 34 PID 2728 wrote to memory of 2784 2728 3vppv.exe 35 PID 2728 wrote to memory of 2784 2728 3vppv.exe 35 PID 2728 wrote to memory of 2784 2728 3vppv.exe 35 PID 2728 wrote to memory of 2784 2728 3vppv.exe 35 PID 2784 wrote to memory of 792 2784 pdppp.exe 36 PID 2784 wrote to memory of 792 2784 pdppp.exe 36 PID 2784 wrote to memory of 792 2784 pdppp.exe 36 PID 2784 wrote to memory of 792 2784 pdppp.exe 36 PID 792 wrote to memory of 600 792 xrlllfl.exe 37 PID 792 wrote to memory of 600 792 xrlllfl.exe 37 PID 792 wrote to memory of 600 792 xrlllfl.exe 37 PID 792 wrote to memory of 600 792 xrlllfl.exe 37 PID 600 wrote to memory of 2052 600 1flxfxx.exe 38 PID 600 wrote to memory of 2052 600 1flxfxx.exe 38 PID 600 wrote to memory of 2052 600 1flxfxx.exe 38 PID 600 wrote to memory of 2052 600 1flxfxx.exe 38 PID 2052 wrote to memory of 2084 2052 jvppv.exe 39 PID 2052 wrote to memory of 2084 2052 jvppv.exe 39 PID 2052 wrote to memory of 2084 2052 jvppv.exe 39 PID 2052 wrote to memory of 2084 2052 jvppv.exe 39 PID 2084 wrote to memory of 2504 2084 ddjjj.exe 40 PID 2084 wrote to memory of 2504 2084 ddjjj.exe 40 PID 2084 wrote to memory of 2504 2084 ddjjj.exe 40 PID 2084 wrote to memory of 2504 2084 ddjjj.exe 40 PID 2504 wrote to memory of 1684 2504 ffrllxx.exe 41 PID 2504 wrote to memory of 1684 2504 ffrllxx.exe 41 PID 2504 wrote to memory of 1684 2504 ffrllxx.exe 41 PID 2504 wrote to memory of 1684 2504 ffrllxx.exe 41 PID 1684 wrote to memory of 2856 1684 rlxxllx.exe 42 PID 1684 wrote to memory of 2856 1684 rlxxllx.exe 42 PID 1684 wrote to memory of 2856 1684 rlxxllx.exe 42 PID 1684 wrote to memory of 2856 1684 rlxxllx.exe 42 PID 2856 wrote to memory of 2872 2856 hthhnn.exe 43 PID 2856 wrote to memory of 2872 2856 hthhnn.exe 43 PID 2856 wrote to memory of 2872 2856 hthhnn.exe 43 PID 2856 wrote to memory of 2872 2856 hthhnn.exe 43 PID 2872 wrote to memory of 2976 2872 vpjdv.exe 44 PID 2872 wrote to memory of 2976 2872 vpjdv.exe 44 PID 2872 wrote to memory of 2976 2872 vpjdv.exe 44 PID 2872 wrote to memory of 2976 2872 vpjdv.exe 44 PID 2976 wrote to memory of 1960 2976 3xlrxxf.exe 45 PID 2976 wrote to memory of 1960 2976 3xlrxxf.exe 45 PID 2976 wrote to memory of 1960 2976 3xlrxxf.exe 45 PID 2976 wrote to memory of 1960 2976 3xlrxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe"C:\Users\Admin\AppData\Local\Temp\1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bhtntb.exec:\bhtntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\dpdvd.exec:\dpdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3llrxxx.exec:\3llrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9nhhnn.exec:\9nhhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\3vppv.exec:\3vppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pdppp.exec:\pdppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xrlllfl.exec:\xrlllfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\1flxfxx.exec:\1flxfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\jvppv.exec:\jvppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\ddjjj.exec:\ddjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\ffrllxx.exec:\ffrllxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rlxxllx.exec:\rlxxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\hthhnn.exec:\hthhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vpjdv.exec:\vpjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\3xlrxxf.exec:\3xlrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\frlrxxf.exec:\frlrxxf.exe17⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hbnbnn.exec:\hbnbnn.exe18⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jvdpv.exec:\jvdpv.exe19⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jjvjv.exec:\jjvjv.exe20⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5lxrxfr.exec:\5lxrxfr.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lfllrxf.exec:\lfllrxf.exe22⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tnnthn.exec:\tnnthn.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7nnbtt.exec:\7nnbtt.exe24⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vpddd.exec:\vpddd.exe25⤵
- Executes dropped EXE
PID:972 -
\??\c:\lxlrxfr.exec:\lxlrxfr.exe26⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5thhhb.exec:\5thhhb.exe27⤵
- Executes dropped EXE
PID:1128 -
\??\c:\bthnnb.exec:\bthnnb.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1vvdj.exec:\1vvdj.exe29⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jvpvd.exec:\jvpvd.exe30⤵
- Executes dropped EXE
PID:2552 -
\??\c:\frllxxl.exec:\frllxxl.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\hbbhtb.exec:\hbbhtb.exe32⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5tnthh.exec:\5tnthh.exe33⤵PID:2908
-
\??\c:\tthhtt.exec:\tthhtt.exe34⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjvvp.exec:\pjvvp.exe35⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dpjdj.exec:\dpjdj.exe36⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxlfxff.exec:\xxlfxff.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ffrxllr.exec:\ffrxllr.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hthnbt.exec:\hthnbt.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tnbhhb.exec:\tnbhhb.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1vpvp.exec:\1vpvp.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pjpjp.exec:\pjpjp.exe42⤵
- Executes dropped EXE
PID:332 -
\??\c:\7rrrxff.exec:\7rrrxff.exe43⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3rlfffl.exec:\3rlfffl.exe44⤵
- Executes dropped EXE
PID:580 -
\??\c:\bnbhhn.exec:\bnbhhn.exe45⤵
- Executes dropped EXE
PID:880 -
\??\c:\tnbtbh.exec:\tnbtbh.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\1dvdp.exec:\1dvdp.exe47⤵
- Executes dropped EXE
PID:112 -
\??\c:\dvppv.exec:\dvppv.exe48⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xlrxllr.exec:\xlrxllr.exe49⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrflxfr.exec:\xrflxfr.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5tbtbt.exec:\5tbtbt.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3hbbbh.exec:\3hbbbh.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjvvj.exec:\pjvvj.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\jvdvj.exec:\jvdvj.exe54⤵
- Executes dropped EXE
PID:692 -
\??\c:\rfllrrx.exec:\rfllrrx.exe55⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hbhhnh.exec:\hbhhnh.exe57⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tbbhbh.exec:\tbbhbh.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pjddp.exec:\pjddp.exe59⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5dvpp.exec:\5dvpp.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xrxxrrx.exec:\xrxxrrx.exe61⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rlxlrfl.exec:\rlxlrfl.exe62⤵
- Executes dropped EXE
PID:376 -
\??\c:\hbttbh.exec:\hbttbh.exe63⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bnbbhh.exec:\bnbbhh.exe64⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vpdjj.exec:\vpdjj.exe65⤵
- Executes dropped EXE
PID:1292 -
\??\c:\1jvpp.exec:\1jvpp.exe66⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lxffllr.exec:\lxffllr.exe67⤵PID:2392
-
\??\c:\9rlrxxf.exec:\9rlrxxf.exe68⤵PID:1696
-
\??\c:\thtbhh.exec:\thtbhh.exe69⤵PID:1916
-
\??\c:\nnbnbh.exec:\nnbnbh.exe70⤵PID:2576
-
\??\c:\vvpjp.exec:\vvpjp.exe71⤵PID:2072
-
\??\c:\vppvj.exec:\vppvj.exe72⤵PID:2364
-
\??\c:\rlfxllr.exec:\rlfxllr.exe73⤵PID:2816
-
\??\c:\fxxxfxx.exec:\fxxxfxx.exe74⤵PID:2740
-
\??\c:\thbbhh.exec:\thbbhh.exe75⤵PID:2616
-
\??\c:\9nnntb.exec:\9nnntb.exe76⤵PID:1988
-
\??\c:\ddvdv.exec:\ddvdv.exe77⤵PID:2708
-
\??\c:\jvddd.exec:\jvddd.exe78⤵PID:2652
-
\??\c:\dvjjd.exec:\dvjjd.exe79⤵PID:2620
-
\??\c:\fxrlxrx.exec:\fxrlxrx.exe80⤵
- System Location Discovery: System Language Discovery
PID:1224 -
\??\c:\rlrxlxl.exec:\rlrxlxl.exe81⤵PID:2640
-
\??\c:\bttbhh.exec:\bttbhh.exe82⤵PID:596
-
\??\c:\9nhnnn.exec:\9nhnnn.exe83⤵PID:2784
-
\??\c:\vpvjj.exec:\vpvjj.exe84⤵PID:792
-
\??\c:\vjppp.exec:\vjppp.exe85⤵PID:1680
-
\??\c:\9pjdd.exec:\9pjdd.exe86⤵PID:600
-
\??\c:\7vjjj.exec:\7vjjj.exe87⤵
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\3lllllx.exec:\3lllllx.exe88⤵PID:2788
-
\??\c:\1xxfflr.exec:\1xxfflr.exe89⤵PID:2136
-
\??\c:\xllllll.exec:\xllllll.exe90⤵PID:776
-
\??\c:\nhbhhn.exec:\nhbhhn.exe91⤵PID:2952
-
\??\c:\9jdvv.exec:\9jdvv.exe92⤵PID:2232
-
\??\c:\7jdpv.exec:\7jdpv.exe93⤵PID:2984
-
\??\c:\5xlflfr.exec:\5xlflfr.exe94⤵PID:324
-
\??\c:\3xfxlfr.exec:\3xfxlfr.exe95⤵PID:1924
-
\??\c:\thhnnn.exec:\thhnnn.exe96⤵PID:1960
-
\??\c:\ntbtbb.exec:\ntbtbb.exe97⤵PID:2460
-
\??\c:\vpddd.exec:\vpddd.exe98⤵PID:2444
-
\??\c:\jjjpd.exec:\jjjpd.exe99⤵PID:2296
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe100⤵PID:2060
-
\??\c:\lxllrlr.exec:\lxllrlr.exe101⤵PID:1072
-
\??\c:\hbnntt.exec:\hbnntt.exe102⤵PID:408
-
\??\c:\nhtbnt.exec:\nhtbnt.exe103⤵PID:2492
-
\??\c:\5dpvj.exec:\5dpvj.exe104⤵PID:376
-
\??\c:\jdjjp.exec:\jdjjp.exe105⤵PID:2772
-
\??\c:\frfxxrx.exec:\frfxxrx.exe106⤵PID:768
-
\??\c:\lrlxxrr.exec:\lrlxxrr.exe107⤵PID:1812
-
\??\c:\bnbbbt.exec:\bnbbbt.exe108⤵PID:1892
-
\??\c:\7thnhh.exec:\7thnhh.exe109⤵PID:1728
-
\??\c:\vvdvv.exec:\vvdvv.exe110⤵PID:1180
-
\??\c:\jvddd.exec:\jvddd.exe111⤵PID:2524
-
\??\c:\1xrxxfr.exec:\1xrxxfr.exe112⤵PID:2576
-
\??\c:\5llrffl.exec:\5llrffl.exe113⤵PID:2820
-
\??\c:\bthnnt.exec:\bthnnt.exe114⤵PID:1516
-
\??\c:\nhhnnn.exec:\nhhnnn.exe115⤵PID:2904
-
\??\c:\tnhthb.exec:\tnhthb.exe116⤵PID:2724
-
\??\c:\1pppp.exec:\1pppp.exe117⤵PID:2804
-
\??\c:\jdvdj.exec:\jdvdj.exe118⤵PID:2696
-
\??\c:\frxrrrx.exec:\frxrrrx.exe119⤵PID:2608
-
\??\c:\rlxrflx.exec:\rlxrflx.exe120⤵PID:2652
-
\??\c:\httthh.exec:\httthh.exe121⤵PID:2660
-
\??\c:\5tbttb.exec:\5tbttb.exe122⤵PID:340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-