Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 21:06
Static task
static1
Behavioral task
behavioral1
Sample
4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe
Resource
win7-20240903-en
General
-
Target
4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe
-
Size
63KB
-
MD5
01ed081145016b0815622ffea253bdec
-
SHA1
459bf75133c4bbd502d907b5ca9472c39afb03e7
-
SHA256
4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588
-
SHA512
97b279f59c94c62168ad825808bda79b3e5a9acae6a8116c5a0045e628dfea4820152d6f02bf5ef27c3a1089d4dc1c8c9e8e42fd4f7977c384db50e62325430d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbW:ymb3NkkiQ3mdBjF0y7kbW
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/3012-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 bbnhnt.exe 2088 nnttnn.exe 2400 dvjdd.exe 2744 3ffxffx.exe 2756 9ntthb.exe 2856 hhttbb.exe 2780 5jdpj.exe 2604 lrxlxll.exe 2724 7nbbth.exe 3032 3vvjp.exe 1892 lfrfxfx.exe 1924 9bhntb.exe 2036 3dvdj.exe 1584 llfrlxl.exe 1016 tbbtnb.exe 1040 9hntth.exe 852 jdvdj.exe 1788 rrlfxrx.exe 2924 lxxxllx.exe 2812 pvjdp.exe 948 7vddp.exe 1012 xrrxxrf.exe 656 nnhnbh.exe 960 nhhbhh.exe 988 ppjjd.exe 792 rrlrxlx.exe 1728 tbnhht.exe 2280 hbttbh.exe 768 jdpdv.exe 2984 llffflx.exe 2092 ffxflrx.exe 2532 nnnbnn.exe 2188 vdjvv.exe 1604 dvvdj.exe 2848 fxlfxfr.exe 2748 llllfff.exe 2764 btnbnb.exe 2900 1jjvj.exe 3056 9jjpv.exe 2600 3frrffl.exe 2772 lxlrxrf.exe 3024 tnhntb.exe 676 1hbhnt.exe 2552 jddpd.exe 2024 jdvdj.exe 1912 rrxlrxf.exe 2052 llfxllf.exe 1872 htnbnt.exe 1448 ttnthn.exe 696 pjddv.exe 1920 fxlrlrf.exe 556 rlrxrxx.exe 852 bnhtnt.exe 2168 7jdpp.exe 2824 jdpvp.exe 1940 fxlxflf.exe 2692 lfxfrlx.exe 1648 btnhhn.exe 2032 3vvdd.exe 1080 pjvvj.exe 1636 3rlrxfr.exe 1064 fxflxrr.exe 1552 hbhnnt.exe 2248 nhtbbh.exe -
resource yara_rule behavioral1/memory/3012-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 3008 3012 4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe 30 PID 3012 wrote to memory of 3008 3012 4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe 30 PID 3012 wrote to memory of 3008 3012 4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe 30 PID 3012 wrote to memory of 3008 3012 4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe 30 PID 3008 wrote to memory of 2088 3008 bbnhnt.exe 31 PID 3008 wrote to memory of 2088 3008 bbnhnt.exe 31 PID 3008 wrote to memory of 2088 3008 bbnhnt.exe 31 PID 3008 wrote to memory of 2088 3008 bbnhnt.exe 31 PID 2088 wrote to memory of 2400 2088 nnttnn.exe 32 PID 2088 wrote to memory of 2400 2088 nnttnn.exe 32 PID 2088 wrote to memory of 2400 2088 nnttnn.exe 32 PID 2088 wrote to memory of 2400 2088 nnttnn.exe 32 PID 2400 wrote to memory of 2744 2400 dvjdd.exe 33 PID 2400 wrote to memory of 2744 2400 dvjdd.exe 33 PID 2400 wrote to memory of 2744 2400 dvjdd.exe 33 PID 2400 wrote to memory of 2744 2400 dvjdd.exe 33 PID 2744 wrote to memory of 2756 2744 3ffxffx.exe 34 PID 2744 wrote to memory of 2756 2744 3ffxffx.exe 34 PID 2744 wrote to memory of 2756 2744 3ffxffx.exe 34 PID 2744 wrote to memory of 2756 2744 3ffxffx.exe 34 PID 2756 wrote to memory of 2856 2756 9ntthb.exe 35 PID 2756 wrote to memory of 2856 2756 9ntthb.exe 35 PID 2756 wrote to memory of 2856 2756 9ntthb.exe 35 PID 2756 wrote to memory of 2856 2756 9ntthb.exe 35 PID 2856 wrote to memory of 2780 2856 hhttbb.exe 36 PID 2856 wrote to memory of 2780 2856 hhttbb.exe 36 PID 2856 wrote to memory of 2780 2856 hhttbb.exe 36 PID 2856 wrote to memory of 2780 2856 hhttbb.exe 36 PID 2780 wrote to memory of 2604 2780 5jdpj.exe 37 PID 2780 wrote to memory of 2604 2780 5jdpj.exe 37 PID 2780 wrote to memory of 2604 2780 5jdpj.exe 37 PID 2780 wrote to memory of 2604 2780 5jdpj.exe 37 PID 2604 wrote to memory of 2724 2604 lrxlxll.exe 38 PID 2604 wrote to memory of 2724 2604 lrxlxll.exe 38 PID 2604 wrote to memory of 2724 2604 lrxlxll.exe 38 PID 2604 wrote to memory of 2724 2604 lrxlxll.exe 38 PID 2724 wrote to memory of 3032 2724 7nbbth.exe 39 PID 2724 wrote to memory of 3032 2724 7nbbth.exe 39 PID 2724 wrote to memory of 3032 2724 7nbbth.exe 39 PID 2724 wrote to memory of 3032 2724 7nbbth.exe 39 PID 3032 wrote to memory of 1892 3032 3vvjp.exe 40 PID 3032 wrote to memory of 1892 3032 3vvjp.exe 40 PID 3032 wrote to memory of 1892 3032 3vvjp.exe 40 PID 3032 wrote to memory of 1892 3032 3vvjp.exe 40 PID 1892 wrote to memory of 1924 1892 lfrfxfx.exe 41 PID 1892 wrote to memory of 1924 1892 lfrfxfx.exe 41 PID 1892 wrote to memory of 1924 1892 lfrfxfx.exe 41 PID 1892 wrote to memory of 1924 1892 lfrfxfx.exe 41 PID 1924 wrote to memory of 2036 1924 9bhntb.exe 42 PID 1924 wrote to memory of 2036 1924 9bhntb.exe 42 PID 1924 wrote to memory of 2036 1924 9bhntb.exe 42 PID 1924 wrote to memory of 2036 1924 9bhntb.exe 42 PID 2036 wrote to memory of 1584 2036 3dvdj.exe 43 PID 2036 wrote to memory of 1584 2036 3dvdj.exe 43 PID 2036 wrote to memory of 1584 2036 3dvdj.exe 43 PID 2036 wrote to memory of 1584 2036 3dvdj.exe 43 PID 1584 wrote to memory of 1016 1584 llfrlxl.exe 44 PID 1584 wrote to memory of 1016 1584 llfrlxl.exe 44 PID 1584 wrote to memory of 1016 1584 llfrlxl.exe 44 PID 1584 wrote to memory of 1016 1584 llfrlxl.exe 44 PID 1016 wrote to memory of 1040 1016 tbbtnb.exe 45 PID 1016 wrote to memory of 1040 1016 tbbtnb.exe 45 PID 1016 wrote to memory of 1040 1016 tbbtnb.exe 45 PID 1016 wrote to memory of 1040 1016 tbbtnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe"C:\Users\Admin\AppData\Local\Temp\4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bbnhnt.exec:\bbnhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\nnttnn.exec:\nnttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\dvjdd.exec:\dvjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\3ffxffx.exec:\3ffxffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9ntthb.exec:\9ntthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hhttbb.exec:\hhttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5jdpj.exec:\5jdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lrxlxll.exec:\lrxlxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7nbbth.exec:\7nbbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3vvjp.exec:\3vvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\lfrfxfx.exec:\lfrfxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\9bhntb.exec:\9bhntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\3dvdj.exec:\3dvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\llfrlxl.exec:\llfrlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\tbbtnb.exec:\tbbtnb.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\9hntth.exec:\9hntth.exe17⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdvdj.exec:\jdvdj.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\rrlfxrx.exec:\rrlfxrx.exe19⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxxxllx.exec:\lxxxllx.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pvjdp.exec:\pvjdp.exe21⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7vddp.exec:\7vddp.exe22⤵
- Executes dropped EXE
PID:948 -
\??\c:\xrrxxrf.exec:\xrrxxrf.exe23⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nnhnbh.exec:\nnhnbh.exe24⤵
- Executes dropped EXE
PID:656 -
\??\c:\nhhbhh.exec:\nhhbhh.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\ppjjd.exec:\ppjjd.exe26⤵
- Executes dropped EXE
PID:988 -
\??\c:\rrlrxlx.exec:\rrlrxlx.exe27⤵
- Executes dropped EXE
PID:792 -
\??\c:\tbnhht.exec:\tbnhht.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbttbh.exec:\hbttbh.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jdpdv.exec:\jdpdv.exe30⤵
- Executes dropped EXE
PID:768 -
\??\c:\llffflx.exec:\llffflx.exe31⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ffxflrx.exec:\ffxflrx.exe32⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nnnbnn.exec:\nnnbnn.exe33⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vdjvv.exec:\vdjvv.exe34⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvvdj.exec:\dvvdj.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\fxlfxfr.exec:\fxlfxfr.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\llllfff.exec:\llllfff.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\btnbnb.exec:\btnbnb.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1jjvj.exec:\1jjvj.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9jjpv.exec:\9jjpv.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3frrffl.exec:\3frrffl.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lxlrxrf.exec:\lxlrxrf.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnhntb.exec:\tnhntb.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1hbhnt.exec:\1hbhnt.exe44⤵
- Executes dropped EXE
PID:676 -
\??\c:\jddpd.exec:\jddpd.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jdvdj.exec:\jdvdj.exe46⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rrxlrxf.exec:\rrxlrxf.exe47⤵
- Executes dropped EXE
PID:1912 -
\??\c:\llfxllf.exec:\llfxllf.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\htnbnt.exec:\htnbnt.exe49⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ttnthn.exec:\ttnthn.exe50⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pjddv.exec:\pjddv.exe51⤵
- Executes dropped EXE
PID:696 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlrxrxx.exec:\rlrxrxx.exe53⤵
- Executes dropped EXE
PID:556 -
\??\c:\bnhtnt.exec:\bnhtnt.exe54⤵
- Executes dropped EXE
PID:852 -
\??\c:\7jdpp.exec:\7jdpp.exe55⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdpvp.exec:\jdpvp.exe56⤵
- Executes dropped EXE
PID:2824 -
\??\c:\fxlxflf.exec:\fxlxflf.exe57⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe58⤵
- Executes dropped EXE
PID:2692 -
\??\c:\btnhhn.exec:\btnhhn.exe59⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3vvdd.exec:\3vvdd.exe60⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pjvvj.exec:\pjvvj.exe61⤵
- Executes dropped EXE
PID:1080 -
\??\c:\3rlrxfr.exec:\3rlrxfr.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\fxflxrr.exec:\fxflxrr.exe63⤵
- Executes dropped EXE
PID:1064 -
\??\c:\hbhnnt.exec:\hbhnnt.exe64⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nhtbbh.exec:\nhtbbh.exe65⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1dvdd.exec:\1dvdd.exe66⤵PID:544
-
\??\c:\jjvdp.exec:\jjvdp.exe67⤵PID:1856
-
\??\c:\fxlxlrx.exec:\fxlxlrx.exe68⤵PID:1332
-
\??\c:\9rrxllx.exec:\9rrxllx.exe69⤵PID:2324
-
\??\c:\7nhnbn.exec:\7nhnbn.exe70⤵PID:3048
-
\??\c:\bhbbtt.exec:\bhbbtt.exe71⤵PID:3052
-
\??\c:\djpjp.exec:\djpjp.exe72⤵PID:2240
-
\??\c:\7djvj.exec:\7djvj.exe73⤵PID:2340
-
\??\c:\ffflrfl.exec:\ffflrfl.exe74⤵PID:2860
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe75⤵PID:2436
-
\??\c:\htnhhb.exec:\htnhhb.exe76⤵PID:2728
-
\??\c:\hhbnbb.exec:\hhbnbb.exe77⤵PID:2712
-
\??\c:\vpvjv.exec:\vpvjv.exe78⤵PID:2740
-
\??\c:\flxlllx.exec:\flxlllx.exe79⤵PID:2788
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe80⤵PID:2780
-
\??\c:\nnbhbn.exec:\nnbhbn.exe81⤵PID:2604
-
\??\c:\hbbhtb.exec:\hbbhtb.exe82⤵PID:1144
-
\??\c:\7pvdj.exec:\7pvdj.exe83⤵PID:1240
-
\??\c:\ppdvv.exec:\ppdvv.exe84⤵PID:2576
-
\??\c:\fxrxflx.exec:\fxrxflx.exe85⤵PID:2568
-
\??\c:\nhttbb.exec:\nhttbb.exe86⤵PID:2004
-
\??\c:\tntbbn.exec:\tntbbn.exe87⤵PID:1960
-
\??\c:\5vvpp.exec:\5vvpp.exe88⤵PID:2428
-
\??\c:\vppdp.exec:\vppdp.exe89⤵PID:1484
-
\??\c:\fxrxlll.exec:\fxrxlll.exe90⤵PID:696
-
\??\c:\7xrrrfr.exec:\7xrrrfr.exe91⤵PID:816
-
\??\c:\nhnthn.exec:\nhnthn.exe92⤵PID:2844
-
\??\c:\tnhttt.exec:\tnhttt.exe93⤵PID:3000
-
\??\c:\dvddp.exec:\dvddp.exe94⤵PID:2480
-
\??\c:\5vvvv.exec:\5vvvv.exe95⤵PID:2432
-
\??\c:\xlfflfl.exec:\xlfflfl.exe96⤵PID:2792
-
\??\c:\xxrfflr.exec:\xxrfflr.exe97⤵PID:2960
-
\??\c:\tnhhtb.exec:\tnhhtb.exe98⤵PID:2584
-
\??\c:\hhhntb.exec:\hhhntb.exe99⤵
- System Location Discovery: System Language Discovery
PID:1184 -
\??\c:\jpvdp.exec:\jpvdp.exe100⤵PID:2200
-
\??\c:\xrlrflf.exec:\xrlrflf.exe101⤵PID:2012
-
\??\c:\rlflrxf.exec:\rlflrxf.exe102⤵PID:2284
-
\??\c:\5bhnhh.exec:\5bhnhh.exe103⤵PID:480
-
\??\c:\bhhtbt.exec:\bhhtbt.exe104⤵PID:2504
-
\??\c:\1ppvp.exec:\1ppvp.exe105⤵PID:1220
-
\??\c:\rfxfrlx.exec:\rfxfrlx.exe106⤵PID:2280
-
\??\c:\lxxlxxf.exec:\lxxlxxf.exe107⤵PID:1856
-
\??\c:\tntthn.exec:\tntthn.exe108⤵PID:3012
-
\??\c:\tbhhhh.exec:\tbhhhh.exe109⤵PID:2996
-
\??\c:\3jdpp.exec:\3jdpp.exe110⤵PID:2292
-
\??\c:\pjddp.exec:\pjddp.exe111⤵PID:1576
-
\??\c:\llrxfrr.exec:\llrxfrr.exe112⤵PID:2872
-
\??\c:\llxfrxl.exec:\llxfrxl.exe113⤵PID:1604
-
\??\c:\9hhntt.exec:\9hhntt.exe114⤵PID:2228
-
\??\c:\7bnnbt.exec:\7bnnbt.exe115⤵PID:2912
-
\??\c:\3vdjd.exec:\3vdjd.exe116⤵PID:2832
-
\??\c:\ppdjv.exec:\ppdjv.exe117⤵PID:2900
-
\??\c:\rflllfl.exec:\rflllfl.exe118⤵PID:2796
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe119⤵PID:2616
-
\??\c:\nnthtb.exec:\nnthtb.exe120⤵PID:3016
-
\??\c:\nbbtnh.exec:\nbbtnh.exe121⤵PID:3060
-
\??\c:\pjdjd.exec:\pjdjd.exe122⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-