Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe
Resource
win7-20240903-en
General
-
Target
d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe
-
Size
69KB
-
MD5
fbfbda2474ee80121cc7b0eea7ddb270
-
SHA1
b784745c56916fb0104a904b96e071598d66243f
-
SHA256
d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75a
-
SHA512
319fc54fb9458b85ce55f8ee5aeb5433021668c9c5492fefffb7936b12c3cf113469c930f3afb0f23860d64d5791ed1f478369d2df7447823bba32995f58e19b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLW:ymb3NkkiQ3mdBjF0yMlia
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2528-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-289-0x00000000778E0000-0x00000000779FF000-memory.dmp family_blackmoon behavioral1/memory/2408-290-0x0000000077A00000-0x0000000077AFA000-memory.dmp family_blackmoon behavioral1/memory/2408-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2028 djjvv.exe 2880 5vjdd.exe 2564 bbbtnb.exe 2820 9jjdd.exe 2736 7pjjp.exe 2640 xxxflrl.exe 2768 nbtbtb.exe 2624 dpjjd.exe 1976 5vpjp.exe 1260 rfrfrfr.exe 2788 bthhnn.exe 1652 jvdjd.exe 1940 jdvpp.exe 484 xrfrflx.exe 296 nhnbhh.exe 1544 nhbhhn.exe 2252 1vdpp.exe 2144 lfrxllx.exe 1844 rlxlrxl.exe 1648 nhttbh.exe 2072 3bnnhb.exe 1932 ddvpd.exe 1280 lxrrrrx.exe 2464 5bnnbb.exe 1256 hhntbt.exe 1948 vvddj.exe 2996 vppjj.exe 3012 9xxlxfr.exe 2132 nhbhbb.exe 2408 vvjvj.exe 1484 pjjjd.exe 2448 tnnttn.exe 1928 9hntbt.exe 2808 vjppp.exe 2828 dvjjj.exe 2860 rflffxl.exe 2888 9nthhb.exe 2780 nttbhh.exe 2652 3vjpv.exe 2620 5dvdp.exe 1776 xlfflrx.exe 3044 xrfflfr.exe 980 nhtthn.exe 3016 3tnhnn.exe 444 jddjj.exe 2664 5lrflxl.exe 1916 7rrxxfl.exe 1444 nbnnnh.exe 2692 nbhhhb.exe 1792 pjdpp.exe 296 frffrll.exe 3068 7xflrrr.exe 2252 9rfxxrr.exe 2076 bthbhh.exe 284 btnnhb.exe 1352 3jpjd.exe 448 dvjdd.exe 2072 3xlrxxf.exe 2052 1hhbtt.exe 1852 bnbbbt.exe 1424 pjvdd.exe 2032 vjjdj.exe 1436 vjjjp.exe 2584 frfxxlr.exe -
resource yara_rule behavioral1/memory/2528-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-290-0x0000000077A00000-0x0000000077AFA000-memory.dmp upx behavioral1/memory/2408-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2028 2528 d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe 30 PID 2528 wrote to memory of 2028 2528 d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe 30 PID 2528 wrote to memory of 2028 2528 d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe 30 PID 2528 wrote to memory of 2028 2528 d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe 30 PID 2028 wrote to memory of 2880 2028 djjvv.exe 31 PID 2028 wrote to memory of 2880 2028 djjvv.exe 31 PID 2028 wrote to memory of 2880 2028 djjvv.exe 31 PID 2028 wrote to memory of 2880 2028 djjvv.exe 31 PID 2880 wrote to memory of 2564 2880 5vjdd.exe 32 PID 2880 wrote to memory of 2564 2880 5vjdd.exe 32 PID 2880 wrote to memory of 2564 2880 5vjdd.exe 32 PID 2880 wrote to memory of 2564 2880 5vjdd.exe 32 PID 2564 wrote to memory of 2820 2564 bbbtnb.exe 33 PID 2564 wrote to memory of 2820 2564 bbbtnb.exe 33 PID 2564 wrote to memory of 2820 2564 bbbtnb.exe 33 PID 2564 wrote to memory of 2820 2564 bbbtnb.exe 33 PID 2820 wrote to memory of 2736 2820 9jjdd.exe 34 PID 2820 wrote to memory of 2736 2820 9jjdd.exe 34 PID 2820 wrote to memory of 2736 2820 9jjdd.exe 34 PID 2820 wrote to memory of 2736 2820 9jjdd.exe 34 PID 2736 wrote to memory of 2640 2736 7pjjp.exe 35 PID 2736 wrote to memory of 2640 2736 7pjjp.exe 35 PID 2736 wrote to memory of 2640 2736 7pjjp.exe 35 PID 2736 wrote to memory of 2640 2736 7pjjp.exe 35 PID 2640 wrote to memory of 2768 2640 xxxflrl.exe 36 PID 2640 wrote to memory of 2768 2640 xxxflrl.exe 36 PID 2640 wrote to memory of 2768 2640 xxxflrl.exe 36 PID 2640 wrote to memory of 2768 2640 xxxflrl.exe 36 PID 2768 wrote to memory of 2624 2768 nbtbtb.exe 37 PID 2768 wrote to memory of 2624 2768 nbtbtb.exe 37 PID 2768 wrote to memory of 2624 2768 nbtbtb.exe 37 PID 2768 wrote to memory of 2624 2768 nbtbtb.exe 37 PID 2624 wrote to memory of 1976 2624 dpjjd.exe 38 PID 2624 wrote to memory of 1976 2624 dpjjd.exe 38 PID 2624 wrote to memory of 1976 2624 dpjjd.exe 38 PID 2624 wrote to memory of 1976 2624 dpjjd.exe 38 PID 1976 wrote to memory of 1260 1976 5vpjp.exe 39 PID 1976 wrote to memory of 1260 1976 5vpjp.exe 39 PID 1976 wrote to memory of 1260 1976 5vpjp.exe 39 PID 1976 wrote to memory of 1260 1976 5vpjp.exe 39 PID 1260 wrote to memory of 2788 1260 rfrfrfr.exe 40 PID 1260 wrote to memory of 2788 1260 rfrfrfr.exe 40 PID 1260 wrote to memory of 2788 1260 rfrfrfr.exe 40 PID 1260 wrote to memory of 2788 1260 rfrfrfr.exe 40 PID 2788 wrote to memory of 1652 2788 bthhnn.exe 41 PID 2788 wrote to memory of 1652 2788 bthhnn.exe 41 PID 2788 wrote to memory of 1652 2788 bthhnn.exe 41 PID 2788 wrote to memory of 1652 2788 bthhnn.exe 41 PID 1652 wrote to memory of 1940 1652 jvdjd.exe 42 PID 1652 wrote to memory of 1940 1652 jvdjd.exe 42 PID 1652 wrote to memory of 1940 1652 jvdjd.exe 42 PID 1652 wrote to memory of 1940 1652 jvdjd.exe 42 PID 1940 wrote to memory of 484 1940 jdvpp.exe 43 PID 1940 wrote to memory of 484 1940 jdvpp.exe 43 PID 1940 wrote to memory of 484 1940 jdvpp.exe 43 PID 1940 wrote to memory of 484 1940 jdvpp.exe 43 PID 484 wrote to memory of 296 484 xrfrflx.exe 44 PID 484 wrote to memory of 296 484 xrfrflx.exe 44 PID 484 wrote to memory of 296 484 xrfrflx.exe 44 PID 484 wrote to memory of 296 484 xrfrflx.exe 44 PID 296 wrote to memory of 1544 296 nhnbhh.exe 45 PID 296 wrote to memory of 1544 296 nhnbhh.exe 45 PID 296 wrote to memory of 1544 296 nhnbhh.exe 45 PID 296 wrote to memory of 1544 296 nhnbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe"C:\Users\Admin\AppData\Local\Temp\d8c8f990cd27c40557f1ce64d25953e71b2852fe989d05388eca5d90d758d75aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\djjvv.exec:\djjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\5vjdd.exec:\5vjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bbbtnb.exec:\bbbtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\9jjdd.exec:\9jjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7pjjp.exec:\7pjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xxxflrl.exec:\xxxflrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nbtbtb.exec:\nbtbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dpjjd.exec:\dpjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\5vpjp.exec:\5vpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rfrfrfr.exec:\rfrfrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\bthhnn.exec:\bthhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jvdjd.exec:\jvdjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\jdvpp.exec:\jdvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\xrfrflx.exec:\xrfrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\nhnbhh.exec:\nhnbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\nhbhhn.exec:\nhbhhn.exe17⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1vdpp.exec:\1vdpp.exe18⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lfrxllx.exec:\lfrxllx.exe19⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe20⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nhttbh.exec:\nhttbh.exe21⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3bnnhb.exec:\3bnnhb.exe22⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ddvpd.exec:\ddvpd.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe24⤵
- Executes dropped EXE
PID:1280 -
\??\c:\5bnnbb.exec:\5bnnbb.exe25⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hhntbt.exec:\hhntbt.exe26⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vvddj.exec:\vvddj.exe27⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vppjj.exec:\vppjj.exe28⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9xxlxfr.exec:\9xxlxfr.exe29⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhbhbb.exec:\nhbhbb.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvjvj.exec:\vvjvj.exe31⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9vjpd.exec:\9vjpd.exe32⤵PID:1600
-
\??\c:\pjjjd.exec:\pjjjd.exe33⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tnnttn.exec:\tnnttn.exe34⤵
- Executes dropped EXE
PID:2448 -
\??\c:\9hntbt.exec:\9hntbt.exe35⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vjppp.exec:\vjppp.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvjjj.exec:\dvjjj.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rflffxl.exec:\rflffxl.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9nthhb.exec:\9nthhb.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nttbhh.exec:\nttbhh.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3vjpv.exec:\3vjpv.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5dvdp.exec:\5dvdp.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xlfflrx.exec:\xlfflrx.exe43⤵
- Executes dropped EXE
PID:1776 -
\??\c:\xrfflfr.exec:\xrfflfr.exe44⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nhtthn.exec:\nhtthn.exe45⤵
- Executes dropped EXE
PID:980 -
\??\c:\3tnhnn.exec:\3tnhnn.exe46⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jddjj.exec:\jddjj.exe47⤵
- Executes dropped EXE
PID:444 -
\??\c:\5lrflxl.exec:\5lrflxl.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7rrxxfl.exec:\7rrxxfl.exe49⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nbnnnh.exec:\nbnnnh.exe50⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nbhhhb.exec:\nbhhhb.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjdpp.exec:\pjdpp.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\frffrll.exec:\frffrll.exe53⤵
- Executes dropped EXE
PID:296 -
\??\c:\7xflrrr.exec:\7xflrrr.exe54⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9rfxxrr.exec:\9rfxxrr.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bthbhh.exec:\bthbhh.exe56⤵
- Executes dropped EXE
PID:2076 -
\??\c:\btnnhb.exec:\btnnhb.exe57⤵
- Executes dropped EXE
PID:284 -
\??\c:\3jpjd.exec:\3jpjd.exe58⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dvjdd.exec:\dvjdd.exe59⤵
- Executes dropped EXE
PID:448 -
\??\c:\3xlrxxf.exec:\3xlrxxf.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1hhbtt.exec:\1hhbtt.exe61⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bnbbbt.exec:\bnbbbt.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pjvdd.exec:\pjvdd.exe63⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vjjdj.exec:\vjjdj.exe64⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vjjjp.exec:\vjjjp.exe65⤵
- Executes dropped EXE
PID:1436 -
\??\c:\frfxxlr.exec:\frfxxlr.exe66⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxxxlll.exec:\fxxxlll.exe67⤵PID:1808
-
\??\c:\nhtttt.exec:\nhtttt.exe68⤵PID:1784
-
\??\c:\7nhhnh.exec:\7nhhnh.exe69⤵PID:888
-
\??\c:\7dvvv.exec:\7dvvv.exe70⤵PID:2116
-
\??\c:\jdpdv.exec:\jdpdv.exe71⤵PID:2684
-
\??\c:\lllrlrf.exec:\lllrlrf.exe72⤵PID:1496
-
\??\c:\3frxxrx.exec:\3frxxrx.exe73⤵PID:2028
-
\??\c:\fxxxllr.exec:\fxxxllr.exe74⤵PID:2712
-
\??\c:\tnbthn.exec:\tnbthn.exe75⤵PID:2744
-
\??\c:\bbnthn.exec:\bbnthn.exe76⤵PID:2756
-
\??\c:\9jjvv.exec:\9jjvv.exe77⤵PID:2820
-
\??\c:\pddpp.exec:\pddpp.exe78⤵PID:2612
-
\??\c:\7xfxxrl.exec:\7xfxxrl.exe79⤵PID:2908
-
\??\c:\7lrxxrx.exec:\7lrxxrx.exe80⤵PID:2640
-
\??\c:\thnntn.exec:\thnntn.exe81⤵PID:2652
-
\??\c:\tnbttb.exec:\tnbttb.exe82⤵PID:2488
-
\??\c:\jvdjj.exec:\jvdjj.exe83⤵PID:2864
-
\??\c:\jdjvj.exec:\jdjvj.exe84⤵PID:1976
-
\??\c:\rflffxf.exec:\rflffxf.exe85⤵PID:2924
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe86⤵PID:1064
-
\??\c:\bnbttt.exec:\bnbttt.exe87⤵PID:940
-
\??\c:\hhtbhh.exec:\hhtbhh.exe88⤵PID:320
-
\??\c:\vjvdj.exec:\vjvdj.exe89⤵PID:1520
-
\??\c:\vpdjd.exec:\vpdjd.exe90⤵PID:2504
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe91⤵PID:484
-
\??\c:\frflfll.exec:\frflfll.exe92⤵PID:1788
-
\??\c:\bttbtt.exec:\bttbtt.exe93⤵PID:296
-
\??\c:\tnnhnt.exec:\tnnhnt.exe94⤵PID:832
-
\??\c:\dvpdj.exec:\dvpdj.exe95⤵PID:2068
-
\??\c:\vjdjp.exec:\vjdjp.exe96⤵PID:1728
-
\??\c:\lfrxflr.exec:\lfrxflr.exe97⤵PID:304
-
\??\c:\lrxrlxr.exec:\lrxrlxr.exe98⤵PID:1100
-
\??\c:\3tntth.exec:\3tntth.exe99⤵PID:1732
-
\??\c:\nhnnnn.exec:\nhnnnn.exe100⤵
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\vpdpd.exec:\vpdpd.exe101⤵PID:1932
-
\??\c:\jvddp.exec:\jvddp.exe102⤵PID:1960
-
\??\c:\rlrxffl.exec:\rlrxffl.exe103⤵PID:684
-
\??\c:\rllffxl.exec:\rllffxl.exe104⤵PID:2580
-
\??\c:\hbtntt.exec:\hbtntt.exe105⤵PID:2424
-
\??\c:\9nnbhb.exec:\9nnbhb.exe106⤵PID:1820
-
\??\c:\jvjjv.exec:\jvjjv.exe107⤵PID:1800
-
\??\c:\jdvvv.exec:\jdvvv.exe108⤵PID:2104
-
\??\c:\xlrxrfl.exec:\xlrxrfl.exe109⤵PID:2548
-
\??\c:\lffflrx.exec:\lffflrx.exe110⤵PID:2356
-
\??\c:\1tbbbh.exec:\1tbbbh.exe111⤵PID:1048
-
\??\c:\tnbbbb.exec:\tnbbbb.exe112⤵PID:1692
-
\??\c:\9jppj.exec:\9jppj.exe113⤵PID:2448
-
\??\c:\7fxlllr.exec:\7fxlllr.exe114⤵PID:2812
-
\??\c:\lxfffff.exec:\lxfffff.exe115⤵PID:2760
-
\??\c:\1fxflfl.exec:\1fxflfl.exe116⤵PID:2876
-
\??\c:\5bnbhh.exec:\5bnbhh.exe117⤵PID:2860
-
\??\c:\1bnttn.exec:\1bnttn.exe118⤵PID:2632
-
\??\c:\vppvd.exec:\vppvd.exe119⤵PID:2160
-
\??\c:\xlrxfxf.exec:\xlrxfxf.exe120⤵PID:2824
-
\??\c:\rlrlxfl.exec:\rlrlxfl.exe121⤵PID:2616
-
\??\c:\9rffrlx.exec:\9rffrlx.exe122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-