Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 17:11
Static task
static1
Behavioral task
behavioral1
Sample
9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe
Resource
win7-20240708-en
General
-
Target
9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe
-
Size
106KB
-
MD5
933f7e97eeabbfdf493fc152e9367520
-
SHA1
ca0a816229de59000020991464ebe6958b8d1b0a
-
SHA256
9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5e
-
SHA512
0934231e464855d7c827f7074b45c84e19389d67a8f8092e772be765432852734be7c5f2a92d9ca15859639e4775f610b9a03276b9d8aa0e8ab1f95af5568d23
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CmB:n3C9BRo7MlrWKVT+buBGu3PHB
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2596-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2156 lfxfrrx.exe 2768 3lxxxrr.exe 2792 3nhhbh.exe 2848 lxfllrr.exe 2780 btbbbt.exe 2624 nhbbbn.exe 2520 3lxxffl.exe 1804 rrrxlrx.exe 2404 5bnntn.exe 2476 7vppj.exe 2828 rlxfllr.exe 2564 1rfxffl.exe 2820 bnhnnt.exe 1824 dpjvv.exe 2824 9xfxxrf.exe 1792 xlffffl.exe 848 btbbnt.exe 472 bnbhtt.exe 2120 pdjvd.exe 2352 dpvvv.exe 3056 lflxrfr.exe 1496 3tbttn.exe 2076 1pjvv.exe 1856 5rllxfr.exe 1332 btnntt.exe 2968 bthnbn.exe 2108 jvjdp.exe 876 9xrrxxl.exe 3016 5hbhnt.exe 1080 pdjpv.exe 2480 1flfffl.exe 2764 lxlrrxf.exe 1072 hhnbth.exe 1628 jvddv.exe 2544 jdpjp.exe 2504 fxfrxxf.exe 2556 7rrlfxx.exe 2548 xxrfxff.exe 1052 htbbhb.exe 864 1bbnhb.exe 572 vjppp.exe 1820 vjdvv.exe 2376 9lrlllf.exe 2732 rxxrrrx.exe 2476 bnnntn.exe 2704 httttt.exe 2492 nbhbnh.exe 1592 3vjpv.exe 1944 5pdvj.exe 1284 fllflll.exe 1952 rffxfrx.exe 1792 nbbbtn.exe 760 dvjvj.exe 2168 9ddpp.exe 2148 fllllff.exe 2408 lxllffx.exe 2352 3tbhtt.exe 2288 bnbhbb.exe 2084 1dppp.exe 1524 rflrxxl.exe 3036 xrlrfrf.exe 752 nhhhtt.exe 376 hthbbh.exe 1056 pdjpd.exe -
resource yara_rule behavioral1/memory/2596-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2156 2596 9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe 30 PID 2596 wrote to memory of 2156 2596 9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe 30 PID 2596 wrote to memory of 2156 2596 9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe 30 PID 2596 wrote to memory of 2156 2596 9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe 30 PID 2156 wrote to memory of 2768 2156 lfxfrrx.exe 31 PID 2156 wrote to memory of 2768 2156 lfxfrrx.exe 31 PID 2156 wrote to memory of 2768 2156 lfxfrrx.exe 31 PID 2156 wrote to memory of 2768 2156 lfxfrrx.exe 31 PID 2768 wrote to memory of 2792 2768 3lxxxrr.exe 32 PID 2768 wrote to memory of 2792 2768 3lxxxrr.exe 32 PID 2768 wrote to memory of 2792 2768 3lxxxrr.exe 32 PID 2768 wrote to memory of 2792 2768 3lxxxrr.exe 32 PID 2792 wrote to memory of 2848 2792 3nhhbh.exe 33 PID 2792 wrote to memory of 2848 2792 3nhhbh.exe 33 PID 2792 wrote to memory of 2848 2792 3nhhbh.exe 33 PID 2792 wrote to memory of 2848 2792 3nhhbh.exe 33 PID 2848 wrote to memory of 2780 2848 lxfllrr.exe 34 PID 2848 wrote to memory of 2780 2848 lxfllrr.exe 34 PID 2848 wrote to memory of 2780 2848 lxfllrr.exe 34 PID 2848 wrote to memory of 2780 2848 lxfllrr.exe 34 PID 2780 wrote to memory of 2624 2780 btbbbt.exe 35 PID 2780 wrote to memory of 2624 2780 btbbbt.exe 35 PID 2780 wrote to memory of 2624 2780 btbbbt.exe 35 PID 2780 wrote to memory of 2624 2780 btbbbt.exe 35 PID 2624 wrote to memory of 2520 2624 nhbbbn.exe 36 PID 2624 wrote to memory of 2520 2624 nhbbbn.exe 36 PID 2624 wrote to memory of 2520 2624 nhbbbn.exe 36 PID 2624 wrote to memory of 2520 2624 nhbbbn.exe 36 PID 2520 wrote to memory of 1804 2520 3lxxffl.exe 37 PID 2520 wrote to memory of 1804 2520 3lxxffl.exe 37 PID 2520 wrote to memory of 1804 2520 3lxxffl.exe 37 PID 2520 wrote to memory of 1804 2520 3lxxffl.exe 37 PID 1804 wrote to memory of 2404 1804 rrrxlrx.exe 38 PID 1804 wrote to memory of 2404 1804 rrrxlrx.exe 38 PID 1804 wrote to memory of 2404 1804 rrrxlrx.exe 38 PID 1804 wrote to memory of 2404 1804 rrrxlrx.exe 38 PID 2404 wrote to memory of 2476 2404 5bnntn.exe 39 PID 2404 wrote to memory of 2476 2404 5bnntn.exe 39 PID 2404 wrote to memory of 2476 2404 5bnntn.exe 39 PID 2404 wrote to memory of 2476 2404 5bnntn.exe 39 PID 2476 wrote to memory of 2828 2476 7vppj.exe 40 PID 2476 wrote to memory of 2828 2476 7vppj.exe 40 PID 2476 wrote to memory of 2828 2476 7vppj.exe 40 PID 2476 wrote to memory of 2828 2476 7vppj.exe 40 PID 2828 wrote to memory of 2564 2828 rlxfllr.exe 41 PID 2828 wrote to memory of 2564 2828 rlxfllr.exe 41 PID 2828 wrote to memory of 2564 2828 rlxfllr.exe 41 PID 2828 wrote to memory of 2564 2828 rlxfllr.exe 41 PID 2564 wrote to memory of 2820 2564 1rfxffl.exe 42 PID 2564 wrote to memory of 2820 2564 1rfxffl.exe 42 PID 2564 wrote to memory of 2820 2564 1rfxffl.exe 42 PID 2564 wrote to memory of 2820 2564 1rfxffl.exe 42 PID 2820 wrote to memory of 1824 2820 bnhnnt.exe 43 PID 2820 wrote to memory of 1824 2820 bnhnnt.exe 43 PID 2820 wrote to memory of 1824 2820 bnhnnt.exe 43 PID 2820 wrote to memory of 1824 2820 bnhnnt.exe 43 PID 1824 wrote to memory of 2824 1824 dpjvv.exe 44 PID 1824 wrote to memory of 2824 1824 dpjvv.exe 44 PID 1824 wrote to memory of 2824 1824 dpjvv.exe 44 PID 1824 wrote to memory of 2824 1824 dpjvv.exe 44 PID 2824 wrote to memory of 1792 2824 9xfxxrf.exe 45 PID 2824 wrote to memory of 1792 2824 9xfxxrf.exe 45 PID 2824 wrote to memory of 1792 2824 9xfxxrf.exe 45 PID 2824 wrote to memory of 1792 2824 9xfxxrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe"C:\Users\Admin\AppData\Local\Temp\9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\3lxxxrr.exec:\3lxxxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\3nhhbh.exec:\3nhhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lxfllrr.exec:\lxfllrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\btbbbt.exec:\btbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhbbbn.exec:\nhbbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3lxxffl.exec:\3lxxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\5bnntn.exec:\5bnntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\7vppj.exec:\7vppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rlxfllr.exec:\rlxfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1rfxffl.exec:\1rfxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bnhnnt.exec:\bnhnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dpjvv.exec:\dpjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\9xfxxrf.exec:\9xfxxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xlffffl.exec:\xlffffl.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\btbbnt.exec:\btbbnt.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:848 -
\??\c:\bnbhtt.exec:\bnbhtt.exe19⤵
- Executes dropped EXE
PID:472 -
\??\c:\pdjvd.exec:\pdjvd.exe20⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dpvvv.exec:\dpvvv.exe21⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lflxrfr.exec:\lflxrfr.exe22⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3tbttn.exec:\3tbttn.exe23⤵
- Executes dropped EXE
PID:1496 -
\??\c:\1pjvv.exec:\1pjvv.exe24⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5rllxfr.exec:\5rllxfr.exe25⤵
- Executes dropped EXE
PID:1856 -
\??\c:\btnntt.exec:\btnntt.exe26⤵
- Executes dropped EXE
PID:1332 -
\??\c:\bthnbn.exec:\bthnbn.exe27⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jvjdp.exec:\jvjdp.exe28⤵
- Executes dropped EXE
PID:2108 -
\??\c:\9xrrxxl.exec:\9xrrxxl.exe29⤵
- Executes dropped EXE
PID:876 -
\??\c:\5hbhnt.exec:\5hbhnt.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pdjpv.exec:\pdjpv.exe31⤵
- Executes dropped EXE
PID:1080 -
\??\c:\1flfffl.exec:\1flfffl.exe32⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lxlrrxf.exec:\lxlrrxf.exe33⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hhnbth.exec:\hhnbth.exe34⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jvddv.exec:\jvddv.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jdpjp.exec:\jdpjp.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxfrxxf.exec:\fxfrxxf.exe37⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7rrlfxx.exec:\7rrlfxx.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xxrfxff.exec:\xxrfxff.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\htbbhb.exec:\htbbhb.exe40⤵
- Executes dropped EXE
PID:1052 -
\??\c:\1bbnhb.exec:\1bbnhb.exe41⤵
- Executes dropped EXE
PID:864 -
\??\c:\vjppp.exec:\vjppp.exe42⤵
- Executes dropped EXE
PID:572 -
\??\c:\vjdvv.exec:\vjdvv.exe43⤵
- Executes dropped EXE
PID:1820 -
\??\c:\9lrlllf.exec:\9lrlllf.exe44⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rxxrrrx.exec:\rxxrrrx.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bnnntn.exec:\bnnntn.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\httttt.exec:\httttt.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nbhbnh.exec:\nbhbnh.exe48⤵
- Executes dropped EXE
PID:2492 -
\??\c:\3vjpv.exec:\3vjpv.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5pdvj.exec:\5pdvj.exe50⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fllflll.exec:\fllflll.exe51⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rffxfrx.exec:\rffxfrx.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nbbbtn.exec:\nbbbtn.exe53⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvjvj.exec:\dvjvj.exe54⤵
- Executes dropped EXE
PID:760 -
\??\c:\9ddpp.exec:\9ddpp.exe55⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fllllff.exec:\fllllff.exe56⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lxllffx.exec:\lxllffx.exe57⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3tbhtt.exec:\3tbhtt.exe58⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bnbhbb.exec:\bnbhbb.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1dppp.exec:\1dppp.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rflrxxl.exec:\rflrxxl.exe61⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe62⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhhhtt.exec:\nhhhtt.exe63⤵
- Executes dropped EXE
PID:752 -
\??\c:\hthbbh.exec:\hthbbh.exe64⤵
- Executes dropped EXE
PID:376 -
\??\c:\pdjpd.exec:\pdjpd.exe65⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vpddv.exec:\vpddv.exe66⤵PID:868
-
\??\c:\1fxlrxl.exec:\1fxlrxl.exe67⤵PID:2472
-
\??\c:\fxlrrlf.exec:\fxlrrlf.exe68⤵PID:3068
-
\??\c:\nnbhnt.exec:\nnbhnt.exe69⤵PID:3016
-
\??\c:\nbnttn.exec:\nbnttn.exe70⤵PID:2760
-
\??\c:\pdvdv.exec:\pdvdv.exe71⤵PID:2800
-
\??\c:\jvvpd.exec:\jvvpd.exe72⤵PID:2788
-
\??\c:\5rffxxl.exec:\5rffxxl.exe73⤵PID:2920
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe74⤵PID:1072
-
\??\c:\bthhnh.exec:\bthhnh.exe75⤵PID:2676
-
\??\c:\5dppv.exec:\5dppv.exe76⤵PID:2524
-
\??\c:\9jddp.exec:\9jddp.exe77⤵PID:2616
-
\??\c:\xfxlxll.exec:\xfxlxll.exe78⤵PID:2996
-
\??\c:\rfrrxxr.exec:\rfrrxxr.exe79⤵PID:1456
-
\??\c:\tthnhn.exec:\tthnhn.exe80⤵PID:704
-
\??\c:\hbntbb.exec:\hbntbb.exe81⤵PID:2600
-
\??\c:\vjvvv.exec:\vjvvv.exe82⤵PID:1180
-
\??\c:\ppjvp.exec:\ppjvp.exe83⤵PID:2404
-
\??\c:\vjvdj.exec:\vjvdj.exe84⤵PID:2876
-
\??\c:\frlrllx.exec:\frlrllx.exe85⤵PID:1368
-
\??\c:\1xxrxlx.exec:\1xxrxlx.exe86⤵PID:2476
-
\??\c:\5nhhbh.exec:\5nhhbh.exe87⤵PID:2336
-
\??\c:\1nntbn.exec:\1nntbn.exe88⤵PID:2820
-
\??\c:\vvjjd.exec:\vvjjd.exe89⤵PID:1824
-
\??\c:\jdpvd.exec:\jdpvd.exe90⤵PID:1996
-
\??\c:\fflrxfr.exec:\fflrxfr.exe91⤵PID:1964
-
\??\c:\9rxxrxl.exec:\9rxxrxl.exe92⤵PID:2488
-
\??\c:\rrllffx.exec:\rrllffx.exe93⤵PID:2300
-
\??\c:\htnbht.exec:\htnbht.exe94⤵PID:2184
-
\??\c:\nbnhnn.exec:\nbnhnn.exe95⤵PID:2400
-
\??\c:\pjdjp.exec:\pjdjp.exe96⤵PID:656
-
\??\c:\jjdvd.exec:\jjdvd.exe97⤵PID:1100
-
\??\c:\lfxrxfr.exec:\lfxrxfr.exe98⤵PID:2104
-
\??\c:\fflrxxl.exec:\fflrxxl.exe99⤵PID:1588
-
\??\c:\7bbtbn.exec:\7bbtbn.exe100⤵PID:1740
-
\??\c:\1tnbht.exec:\1tnbht.exe101⤵PID:944
-
\??\c:\pdjdd.exec:\pdjdd.exe102⤵PID:1232
-
\??\c:\9pjvj.exec:\9pjvj.exe103⤵PID:1332
-
\??\c:\1vdpv.exec:\1vdpv.exe104⤵PID:1452
-
\??\c:\fxllrxl.exec:\fxllrxl.exe105⤵PID:2108
-
\??\c:\rrrflxx.exec:\rrrflxx.exe106⤵PID:2276
-
\??\c:\1nhhnb.exec:\1nhhnb.exe107⤵PID:2024
-
\??\c:\dddjp.exec:\dddjp.exe108⤵PID:1568
-
\??\c:\vjvdj.exec:\vjvdj.exe109⤵PID:2796
-
\??\c:\frrffxx.exec:\frrffxx.exe110⤵PID:2652
-
\??\c:\bhthtt.exec:\bhthtt.exe111⤵PID:2768
-
\??\c:\bntbhn.exec:\bntbhn.exe112⤵PID:2664
-
\??\c:\pdpvd.exec:\pdpvd.exe113⤵PID:2892
-
\??\c:\vppdj.exec:\vppdj.exe114⤵PID:2560
-
\??\c:\rlflrxl.exec:\rlflrxl.exe115⤵PID:2536
-
\??\c:\xxrflxr.exec:\xxrflxr.exe116⤵PID:3040
-
\??\c:\tttbnn.exec:\tttbnn.exe117⤵PID:3008
-
\??\c:\ddjdv.exec:\ddjdv.exe118⤵PID:1088
-
\??\c:\lxrxllx.exec:\lxrxllx.exe119⤵PID:2520
-
\??\c:\rlflfxf.exec:\rlflfxf.exe120⤵PID:2128
-
\??\c:\nbhnnn.exec:\nbhnnn.exe121⤵PID:2188
-
\??\c:\htnntt.exec:\htnntt.exe122⤵PID:1312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-