Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe
Resource
win7-20240708-en
General
-
Target
b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe
-
Size
66KB
-
MD5
29a7b54cca8b8ee40972bc949edacca0
-
SHA1
57a9eeedd7234ea9ee8ccb094b18fa4aa63d21de
-
SHA256
b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7d
-
SHA512
01141ed95e51c08a34aa94bfb5e166f9bfacc3c87196f79627f8ea57db9c60ac600107618a75eba962f9f673ef211ecad341b904fc291a0198e0906d31d11ec8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxeH:ymb3NkkiQ3mdBjF0y7kbUH
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2536-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2260 bntbhb.exe 2736 9dpdj.exe 2844 5fflrrf.exe 2884 tnbhnt.exe 2636 dvjjp.exe 2784 fxllrff.exe 2780 bbntbn.exe 3060 vjvdj.exe 2940 rfxxxxl.exe 1772 5lrxrxl.exe 2796 bthnnt.exe 1940 3nhntt.exe 2856 jdjjj.exe 2024 ffrrrrx.exe 2908 9xffrrx.exe 1584 hnthhb.exe 1192 jdjvv.exe 2588 rlxrrrf.exe 2004 rlxrllr.exe 2176 9nttbt.exe 1708 tnbnnt.exe 3004 pdjjp.exe 2492 jpvdd.exe 1676 fxlxflr.exe 2432 htbttt.exe 2476 pjjjp.exe 1400 xlrllxf.exe 876 9rflxxf.exe 2324 hbttnn.exe 2696 9hthtn.exe 1632 jvppp.exe 2448 dpdpp.exe 2832 1xlflff.exe 1720 bbnbhn.exe 2400 jdvdd.exe 2804 1dvdj.exe 2840 9rfllrx.exe 2724 fxffffr.exe 2676 3htnbh.exe 3056 1bbbhh.exe 2780 vdpvv.exe 2952 llrffxr.exe 2240 flrrfrr.exe 2940 1xflllr.exe 1980 9tnttb.exe 2012 thbbhb.exe 272 pjdvv.exe 1752 jjpdv.exe 900 fflxrfr.exe 2024 xrlllfr.exe 1056 3thbhb.exe 1988 nbhtnn.exe 2336 vvvvj.exe 2384 jdvpd.exe 2440 1rxflll.exe 2208 ffrffff.exe 2176 5bnhnb.exe 1996 dvjpj.exe 2508 vvpdd.exe 3008 lxlllfl.exe 584 rfxrllx.exe 1740 vpvvd.exe 2472 7xrxrfl.exe 2344 lxfllll.exe -
resource yara_rule behavioral1/memory/2536-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-311-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2260 2536 b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe 29 PID 2536 wrote to memory of 2260 2536 b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe 29 PID 2536 wrote to memory of 2260 2536 b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe 29 PID 2536 wrote to memory of 2260 2536 b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe 29 PID 2260 wrote to memory of 2736 2260 bntbhb.exe 30 PID 2260 wrote to memory of 2736 2260 bntbhb.exe 30 PID 2260 wrote to memory of 2736 2260 bntbhb.exe 30 PID 2260 wrote to memory of 2736 2260 bntbhb.exe 30 PID 2736 wrote to memory of 2844 2736 9dpdj.exe 31 PID 2736 wrote to memory of 2844 2736 9dpdj.exe 31 PID 2736 wrote to memory of 2844 2736 9dpdj.exe 31 PID 2736 wrote to memory of 2844 2736 9dpdj.exe 31 PID 2844 wrote to memory of 2884 2844 5fflrrf.exe 32 PID 2844 wrote to memory of 2884 2844 5fflrrf.exe 32 PID 2844 wrote to memory of 2884 2844 5fflrrf.exe 32 PID 2844 wrote to memory of 2884 2844 5fflrrf.exe 32 PID 2884 wrote to memory of 2636 2884 tnbhnt.exe 33 PID 2884 wrote to memory of 2636 2884 tnbhnt.exe 33 PID 2884 wrote to memory of 2636 2884 tnbhnt.exe 33 PID 2884 wrote to memory of 2636 2884 tnbhnt.exe 33 PID 2636 wrote to memory of 2784 2636 dvjjp.exe 34 PID 2636 wrote to memory of 2784 2636 dvjjp.exe 34 PID 2636 wrote to memory of 2784 2636 dvjjp.exe 34 PID 2636 wrote to memory of 2784 2636 dvjjp.exe 34 PID 2784 wrote to memory of 2780 2784 fxllrff.exe 35 PID 2784 wrote to memory of 2780 2784 fxllrff.exe 35 PID 2784 wrote to memory of 2780 2784 fxllrff.exe 35 PID 2784 wrote to memory of 2780 2784 fxllrff.exe 35 PID 2780 wrote to memory of 3060 2780 bbntbn.exe 36 PID 2780 wrote to memory of 3060 2780 bbntbn.exe 36 PID 2780 wrote to memory of 3060 2780 bbntbn.exe 36 PID 2780 wrote to memory of 3060 2780 bbntbn.exe 36 PID 3060 wrote to memory of 2940 3060 vjvdj.exe 37 PID 3060 wrote to memory of 2940 3060 vjvdj.exe 37 PID 3060 wrote to memory of 2940 3060 vjvdj.exe 37 PID 3060 wrote to memory of 2940 3060 vjvdj.exe 37 PID 2940 wrote to memory of 1772 2940 rfxxxxl.exe 38 PID 2940 wrote to memory of 1772 2940 rfxxxxl.exe 38 PID 2940 wrote to memory of 1772 2940 rfxxxxl.exe 38 PID 2940 wrote to memory of 1772 2940 rfxxxxl.exe 38 PID 1772 wrote to memory of 2796 1772 5lrxrxl.exe 39 PID 1772 wrote to memory of 2796 1772 5lrxrxl.exe 39 PID 1772 wrote to memory of 2796 1772 5lrxrxl.exe 39 PID 1772 wrote to memory of 2796 1772 5lrxrxl.exe 39 PID 2796 wrote to memory of 1940 2796 bthnnt.exe 40 PID 2796 wrote to memory of 1940 2796 bthnnt.exe 40 PID 2796 wrote to memory of 1940 2796 bthnnt.exe 40 PID 2796 wrote to memory of 1940 2796 bthnnt.exe 40 PID 1940 wrote to memory of 2856 1940 3nhntt.exe 41 PID 1940 wrote to memory of 2856 1940 3nhntt.exe 41 PID 1940 wrote to memory of 2856 1940 3nhntt.exe 41 PID 1940 wrote to memory of 2856 1940 3nhntt.exe 41 PID 2856 wrote to memory of 2024 2856 jdjjj.exe 42 PID 2856 wrote to memory of 2024 2856 jdjjj.exe 42 PID 2856 wrote to memory of 2024 2856 jdjjj.exe 42 PID 2856 wrote to memory of 2024 2856 jdjjj.exe 42 PID 2024 wrote to memory of 2908 2024 ffrrrrx.exe 43 PID 2024 wrote to memory of 2908 2024 ffrrrrx.exe 43 PID 2024 wrote to memory of 2908 2024 ffrrrrx.exe 43 PID 2024 wrote to memory of 2908 2024 ffrrrrx.exe 43 PID 2908 wrote to memory of 1584 2908 9xffrrx.exe 44 PID 2908 wrote to memory of 1584 2908 9xffrrx.exe 44 PID 2908 wrote to memory of 1584 2908 9xffrrx.exe 44 PID 2908 wrote to memory of 1584 2908 9xffrrx.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe"C:\Users\Admin\AppData\Local\Temp\b69d26d08a193aa53d5a21592ee29fef8be0c25f6d445b5b8cf35128e9766d7dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bntbhb.exec:\bntbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\9dpdj.exec:\9dpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\5fflrrf.exec:\5fflrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tnbhnt.exec:\tnbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dvjjp.exec:\dvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\fxllrff.exec:\fxllrff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bbntbn.exec:\bbntbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vjvdj.exec:\vjvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rfxxxxl.exec:\rfxxxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5lrxrxl.exec:\5lrxrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\bthnnt.exec:\bthnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3nhntt.exec:\3nhntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\jdjjj.exec:\jdjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\9xffrrx.exec:\9xffrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\hnthhb.exec:\hnthhb.exe17⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jdjvv.exec:\jdjvv.exe18⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe19⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlxrllr.exec:\rlxrllr.exe20⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9nttbt.exec:\9nttbt.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\tnbnnt.exec:\tnbnnt.exe22⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pdjjp.exec:\pdjjp.exe23⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jpvdd.exec:\jpvdd.exe24⤵
- Executes dropped EXE
PID:2492 -
\??\c:\fxlxflr.exec:\fxlxflr.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\htbttt.exec:\htbttt.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pjjjp.exec:\pjjjp.exe27⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xlrllxf.exec:\xlrllxf.exe28⤵
- Executes dropped EXE
PID:1400 -
\??\c:\9rflxxf.exec:\9rflxxf.exe29⤵
- Executes dropped EXE
PID:876 -
\??\c:\hbttnn.exec:\hbttnn.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9hthtn.exec:\9hthtn.exe31⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jvppp.exec:\jvppp.exe32⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dpdpp.exec:\dpdpp.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1xlflff.exec:\1xlflff.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bbnbhn.exec:\bbnbhn.exe35⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jdvdd.exec:\jdvdd.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1dvdj.exec:\1dvdj.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9rfllrx.exec:\9rfllrx.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fxffffr.exec:\fxffffr.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3htnbh.exec:\3htnbh.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1bbbhh.exec:\1bbbhh.exe41⤵
- Executes dropped EXE
PID:3056 -
\??\c:\vdpvv.exec:\vdpvv.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\llrffxr.exec:\llrffxr.exe43⤵
- Executes dropped EXE
PID:2952 -
\??\c:\flrrfrr.exec:\flrrfrr.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1xflllr.exec:\1xflllr.exe45⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9tnttb.exec:\9tnttb.exe46⤵
- Executes dropped EXE
PID:1980 -
\??\c:\thbbhb.exec:\thbbhb.exe47⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjdvv.exec:\pjdvv.exe48⤵
- Executes dropped EXE
PID:272 -
\??\c:\jjpdv.exec:\jjpdv.exe49⤵
- Executes dropped EXE
PID:1752 -
\??\c:\fflxrfr.exec:\fflxrfr.exe50⤵
- Executes dropped EXE
PID:900 -
\??\c:\xrlllfr.exec:\xrlllfr.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3thbhb.exec:\3thbhb.exe52⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nbhtnn.exec:\nbhtnn.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vvvvj.exec:\vvvvj.exe54⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdvpd.exec:\jdvpd.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1rxflll.exec:\1rxflll.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ffrffff.exec:\ffrffff.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5bnhnb.exec:\5bnhnb.exe58⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjpj.exec:\dvjpj.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vvpdd.exec:\vvpdd.exe60⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lxlllfl.exec:\lxlllfl.exe61⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rfxrllx.exec:\rfxrllx.exe62⤵
- Executes dropped EXE
PID:584 -
\??\c:\vpvvd.exec:\vpvvd.exe63⤵
- Executes dropped EXE
PID:1740 -
\??\c:\7xrxrfl.exec:\7xrxrfl.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lxfllll.exec:\lxfllll.exe65⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hbtnhh.exec:\hbtnhh.exe66⤵PID:2476
-
\??\c:\9nhnnb.exec:\9nhnnb.exe67⤵PID:1464
-
\??\c:\vpdjv.exec:\vpdjv.exe68⤵PID:2128
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe69⤵PID:2956
-
\??\c:\ffrxfrx.exec:\ffrxfrx.exe70⤵PID:1596
-
\??\c:\hbbbbb.exec:\hbbbbb.exe71⤵PID:2892
-
\??\c:\hhnnhh.exec:\hhnnhh.exe72⤵PID:2720
-
\??\c:\jpvpv.exec:\jpvpv.exe73⤵PID:2756
-
\??\c:\jvjpv.exec:\jvjpv.exe74⤵PID:2832
-
\??\c:\xrllrxl.exec:\xrllrxl.exe75⤵PID:2972
-
\??\c:\lxllrlr.exec:\lxllrlr.exe76⤵PID:2968
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe77⤵PID:2900
-
\??\c:\3bthhn.exec:\3bthhn.exe78⤵PID:2840
-
\??\c:\5tnhnh.exec:\5tnhnh.exe79⤵
- System Location Discovery: System Language Discovery
PID:1068 -
\??\c:\ddjpj.exec:\ddjpj.exe80⤵
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\ddjjj.exec:\ddjjj.exe81⤵PID:2248
-
\??\c:\lffrffr.exec:\lffrffr.exe82⤵PID:2780
-
\??\c:\5xllrrl.exec:\5xllrrl.exe83⤵PID:2792
-
\??\c:\xlffrrx.exec:\xlffrrx.exe84⤵PID:2240
-
\??\c:\ntnnht.exec:\ntnnht.exe85⤵PID:2084
-
\??\c:\5bnbhn.exec:\5bnbhn.exe86⤵PID:2680
-
\??\c:\vvjvv.exec:\vvjvv.exe87⤵PID:1528
-
\??\c:\5jdjp.exec:\5jdjp.exe88⤵PID:2520
-
\??\c:\rlffllr.exec:\rlffllr.exe89⤵PID:1604
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe90⤵PID:900
-
\??\c:\xrrlrlr.exec:\xrrlrlr.exe91⤵PID:2156
-
\??\c:\bnhhtn.exec:\bnhhtn.exe92⤵PID:1812
-
\??\c:\3nttbn.exec:\3nttbn.exe93⤵PID:1080
-
\??\c:\jdjjp.exec:\jdjjp.exe94⤵PID:1072
-
\??\c:\pdpdp.exec:\pdpdp.exe95⤵PID:2592
-
\??\c:\9vppp.exec:\9vppp.exe96⤵PID:2296
-
\??\c:\ffffxxx.exec:\ffffxxx.exe97⤵PID:2208
-
\??\c:\llxflfr.exec:\llxflfr.exe98⤵PID:648
-
\??\c:\7btbbh.exec:\7btbbh.exe99⤵PID:1996
-
\??\c:\btnntt.exec:\btnntt.exe100⤵PID:2508
-
\??\c:\vvjpv.exec:\vvjpv.exe101⤵PID:2976
-
\??\c:\dvddj.exec:\dvddj.exe102⤵PID:584
-
\??\c:\3rxxrrl.exec:\3rxxrrl.exe103⤵PID:1740
-
\??\c:\flxxxxr.exec:\flxxxxr.exe104⤵PID:2472
-
\??\c:\xxlllrx.exec:\xxlllrx.exe105⤵PID:2344
-
\??\c:\7bnntb.exec:\7bnntb.exe106⤵PID:2476
-
\??\c:\httttn.exec:\httttn.exe107⤵PID:1464
-
\??\c:\1nnbhn.exec:\1nnbhn.exe108⤵PID:2128
-
\??\c:\3djjj.exec:\3djjj.exe109⤵PID:2956
-
\??\c:\jdjjj.exec:\jdjjj.exe110⤵PID:1596
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe111⤵PID:2836
-
\??\c:\frfflrr.exec:\frfflrr.exe112⤵PID:2720
-
\??\c:\hbhbnh.exec:\hbhbnh.exe113⤵PID:2756
-
\??\c:\hbttbt.exec:\hbttbt.exe114⤵PID:2848
-
\??\c:\9tntth.exec:\9tntth.exe115⤵PID:2972
-
\??\c:\dpjjj.exec:\dpjjj.exe116⤵PID:2968
-
\??\c:\pdvvd.exec:\pdvvd.exe117⤵PID:2900
-
\??\c:\pjppp.exec:\pjppp.exe118⤵PID:2840
-
\??\c:\7lfrxxx.exec:\7lfrxxx.exe119⤵PID:1068
-
\??\c:\rlflllx.exec:\rlflllx.exe120⤵PID:2668
-
\??\c:\thbhnn.exec:\thbhnn.exe121⤵PID:2248
-
\??\c:\hhtbnn.exec:\hhtbnn.exe122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-