Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/08/2024, 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70f755519abfcc428a7f683731952ce0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
70f755519abfcc428a7f683731952ce0N.exe
-
Size
59KB
-
MD5
70f755519abfcc428a7f683731952ce0
-
SHA1
6ae39ee07e1b2e0c3334f71adeb86d8d510c5424
-
SHA256
ccc4a2857e6e4aa78beef83bd2271ad0d473cd92d703868f3b852495e35892ca
-
SHA512
7bb57e8ff496c448f0b0c7ed13da349b6e3fb8627aecac380da47b6e24c25f8a920d43fac9e54671d6fe17edf6055477087a334139f8b43d4c35c9b5fe71242a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVn9PG:ymb3NkkiQ3mdBjF0crg
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2640-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/660-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2468 tthbhb.exe 2104 bnbbnt.exe 2668 7ffxlfr.exe 2796 xrxfllx.exe 2764 htnnbt.exe 2720 bnhhhh.exe 2696 1jjjj.exe 2572 xxlfllx.exe 2128 3hnthn.exe 832 5nhthn.exe 2924 jjpdj.exe 2748 pjvvd.exe 2840 3rfxrxf.exe 1612 nhtbnn.exe 660 9hhhnn.exe 1880 1pvvp.exe 992 jvpvj.exe 1648 rrxflrf.exe 480 1tnhtt.exe 1636 9ddjj.exe 2996 jdvdj.exe 1516 fxrlrfx.exe 2060 3xlllxf.exe 1544 btnnnn.exe 1328 7dvvv.exe 2200 jdpjp.exe 568 3frxxfl.exe 304 nnnhnt.exe 2312 tbhhhb.exe 3064 1dppj.exe 2032 1lrlrrx.exe 1568 9rrffxf.exe 2652 hnhntt.exe 2664 vpppd.exe 2792 pvjpd.exe 2716 9vjdv.exe 2740 lxrxxxl.exe 2764 nbnnth.exe 2588 9hbttt.exe 1960 3dpjp.exe 2592 dpppj.exe 2820 lrlrffr.exe 3060 xflffxx.exe 1140 htntnt.exe 1264 nhthhn.exe 2660 djvvj.exe 2620 pddjd.exe 1852 lxfxxxf.exe 2600 hbhntt.exe 1404 nbhhhb.exe 2656 7pvvd.exe 1880 3jpjj.exe 2072 lrlxflr.exe 716 5flllrr.exe 2544 hbthbb.exe 1964 jvvvd.exe 1796 vvvvp.exe 2996 jvvpp.exe 2288 xlrrfxr.exe 2536 3hbbhb.exe 692 nbhhnn.exe 664 jpddj.exe 1328 dvvjp.exe 2272 rxlllrr.exe -
resource yara_rule behavioral1/memory/2640-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/660-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2468 2640 70f755519abfcc428a7f683731952ce0N.exe 30 PID 2640 wrote to memory of 2468 2640 70f755519abfcc428a7f683731952ce0N.exe 30 PID 2640 wrote to memory of 2468 2640 70f755519abfcc428a7f683731952ce0N.exe 30 PID 2640 wrote to memory of 2468 2640 70f755519abfcc428a7f683731952ce0N.exe 30 PID 2468 wrote to memory of 2104 2468 tthbhb.exe 31 PID 2468 wrote to memory of 2104 2468 tthbhb.exe 31 PID 2468 wrote to memory of 2104 2468 tthbhb.exe 31 PID 2468 wrote to memory of 2104 2468 tthbhb.exe 31 PID 2104 wrote to memory of 2668 2104 bnbbnt.exe 32 PID 2104 wrote to memory of 2668 2104 bnbbnt.exe 32 PID 2104 wrote to memory of 2668 2104 bnbbnt.exe 32 PID 2104 wrote to memory of 2668 2104 bnbbnt.exe 32 PID 2668 wrote to memory of 2796 2668 7ffxlfr.exe 33 PID 2668 wrote to memory of 2796 2668 7ffxlfr.exe 33 PID 2668 wrote to memory of 2796 2668 7ffxlfr.exe 33 PID 2668 wrote to memory of 2796 2668 7ffxlfr.exe 33 PID 2796 wrote to memory of 2764 2796 xrxfllx.exe 34 PID 2796 wrote to memory of 2764 2796 xrxfllx.exe 34 PID 2796 wrote to memory of 2764 2796 xrxfllx.exe 34 PID 2796 wrote to memory of 2764 2796 xrxfllx.exe 34 PID 2764 wrote to memory of 2720 2764 htnnbt.exe 35 PID 2764 wrote to memory of 2720 2764 htnnbt.exe 35 PID 2764 wrote to memory of 2720 2764 htnnbt.exe 35 PID 2764 wrote to memory of 2720 2764 htnnbt.exe 35 PID 2720 wrote to memory of 2696 2720 bnhhhh.exe 36 PID 2720 wrote to memory of 2696 2720 bnhhhh.exe 36 PID 2720 wrote to memory of 2696 2720 bnhhhh.exe 36 PID 2720 wrote to memory of 2696 2720 bnhhhh.exe 36 PID 2696 wrote to memory of 2572 2696 1jjjj.exe 37 PID 2696 wrote to memory of 2572 2696 1jjjj.exe 37 PID 2696 wrote to memory of 2572 2696 1jjjj.exe 37 PID 2696 wrote to memory of 2572 2696 1jjjj.exe 37 PID 2572 wrote to memory of 2128 2572 xxlfllx.exe 38 PID 2572 wrote to memory of 2128 2572 xxlfllx.exe 38 PID 2572 wrote to memory of 2128 2572 xxlfllx.exe 38 PID 2572 wrote to memory of 2128 2572 xxlfllx.exe 38 PID 2128 wrote to memory of 832 2128 3hnthn.exe 39 PID 2128 wrote to memory of 832 2128 3hnthn.exe 39 PID 2128 wrote to memory of 832 2128 3hnthn.exe 39 PID 2128 wrote to memory of 832 2128 3hnthn.exe 39 PID 832 wrote to memory of 2924 832 5nhthn.exe 40 PID 832 wrote to memory of 2924 832 5nhthn.exe 40 PID 832 wrote to memory of 2924 832 5nhthn.exe 40 PID 832 wrote to memory of 2924 832 5nhthn.exe 40 PID 2924 wrote to memory of 2748 2924 jjpdj.exe 41 PID 2924 wrote to memory of 2748 2924 jjpdj.exe 41 PID 2924 wrote to memory of 2748 2924 jjpdj.exe 41 PID 2924 wrote to memory of 2748 2924 jjpdj.exe 41 PID 2748 wrote to memory of 2840 2748 pjvvd.exe 42 PID 2748 wrote to memory of 2840 2748 pjvvd.exe 42 PID 2748 wrote to memory of 2840 2748 pjvvd.exe 42 PID 2748 wrote to memory of 2840 2748 pjvvd.exe 42 PID 2840 wrote to memory of 1612 2840 3rfxrxf.exe 43 PID 2840 wrote to memory of 1612 2840 3rfxrxf.exe 43 PID 2840 wrote to memory of 1612 2840 3rfxrxf.exe 43 PID 2840 wrote to memory of 1612 2840 3rfxrxf.exe 43 PID 1612 wrote to memory of 660 1612 nhtbnn.exe 44 PID 1612 wrote to memory of 660 1612 nhtbnn.exe 44 PID 1612 wrote to memory of 660 1612 nhtbnn.exe 44 PID 1612 wrote to memory of 660 1612 nhtbnn.exe 44 PID 660 wrote to memory of 1880 660 9hhhnn.exe 45 PID 660 wrote to memory of 1880 660 9hhhnn.exe 45 PID 660 wrote to memory of 1880 660 9hhhnn.exe 45 PID 660 wrote to memory of 1880 660 9hhhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\70f755519abfcc428a7f683731952ce0N.exe"C:\Users\Admin\AppData\Local\Temp\70f755519abfcc428a7f683731952ce0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tthbhb.exec:\tthbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\bnbbnt.exec:\bnbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7ffxlfr.exec:\7ffxlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xrxfllx.exec:\xrxfllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\htnnbt.exec:\htnnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bnhhhh.exec:\bnhhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\1jjjj.exec:\1jjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xxlfllx.exec:\xxlfllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\3hnthn.exec:\3hnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\5nhthn.exec:\5nhthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\jjpdj.exec:\jjpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pjvvd.exec:\pjvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\3rfxrxf.exec:\3rfxrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\nhtbnn.exec:\nhtbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\9hhhnn.exec:\9hhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\1pvvp.exec:\1pvvp.exe17⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jvpvj.exec:\jvpvj.exe18⤵
- Executes dropped EXE
PID:992 -
\??\c:\rrxflrf.exec:\rrxflrf.exe19⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1tnhtt.exec:\1tnhtt.exe20⤵
- Executes dropped EXE
PID:480 -
\??\c:\9ddjj.exec:\9ddjj.exe21⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jdvdj.exec:\jdvdj.exe22⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fxrlrfx.exec:\fxrlrfx.exe23⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3xlllxf.exec:\3xlllxf.exe24⤵
- Executes dropped EXE
PID:2060 -
\??\c:\btnnnn.exec:\btnnnn.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7dvvv.exec:\7dvvv.exe26⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jdpjp.exec:\jdpjp.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\3frxxfl.exec:\3frxxfl.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\nnnhnt.exec:\nnnhnt.exe29⤵
- Executes dropped EXE
PID:304 -
\??\c:\tbhhhb.exec:\tbhhhb.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1dppj.exec:\1dppj.exe31⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1lrlrrx.exec:\1lrlrrx.exe32⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9rrffxf.exec:\9rrffxf.exe33⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hnhntt.exec:\hnhntt.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vpppd.exec:\vpppd.exe35⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pvjpd.exec:\pvjpd.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9vjdv.exec:\9vjdv.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lxrxxxl.exec:\lxrxxxl.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nbnnth.exec:\nbnnth.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9hbttt.exec:\9hbttt.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3dpjp.exec:\3dpjp.exe41⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dpppj.exec:\dpppj.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lrlrffr.exec:\lrlrffr.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xflffxx.exec:\xflffxx.exe44⤵
- Executes dropped EXE
PID:3060 -
\??\c:\htntnt.exec:\htntnt.exe45⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nhthhn.exec:\nhthhn.exe46⤵
- Executes dropped EXE
PID:1264 -
\??\c:\djvvj.exec:\djvvj.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pddjd.exec:\pddjd.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe49⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hbhntt.exec:\hbhntt.exe50⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nbhhhb.exec:\nbhhhb.exe51⤵
- Executes dropped EXE
PID:1404 -
\??\c:\7pvvd.exec:\7pvvd.exe52⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3jpjj.exec:\3jpjj.exe53⤵
- Executes dropped EXE
PID:1880 -
\??\c:\lrlxflr.exec:\lrlxflr.exe54⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5flllrr.exec:\5flllrr.exe55⤵
- Executes dropped EXE
PID:716 -
\??\c:\hbthbb.exec:\hbthbb.exe56⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jvvvd.exec:\jvvvd.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvvvp.exec:\vvvvp.exe58⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jvvpp.exec:\jvvpp.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xlrrfxr.exec:\xlrrfxr.exe60⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3hbbhb.exec:\3hbbhb.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nbhhnn.exec:\nbhhnn.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\jpddj.exec:\jpddj.exe63⤵
- Executes dropped EXE
PID:664 -
\??\c:\dvvjp.exec:\dvvjp.exe64⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rxlllrr.exec:\rxlllrr.exe65⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rffrrll.exec:\rffrrll.exe66⤵PID:760
-
\??\c:\ffllrxl.exec:\ffllrxl.exe67⤵PID:2328
-
\??\c:\9hbhhb.exec:\9hbhhb.exe68⤵PID:880
-
\??\c:\pdpvj.exec:\pdpvj.exe69⤵PID:2320
-
\??\c:\5vjdj.exec:\5vjdj.exe70⤵PID:2744
-
\??\c:\lfrxxff.exec:\lfrxxff.exe71⤵PID:2032
-
\??\c:\rrxlrrf.exec:\rrxlrrf.exe72⤵PID:1600
-
\??\c:\nttntt.exec:\nttntt.exe73⤵PID:1704
-
\??\c:\3bnntn.exec:\3bnntn.exe74⤵PID:2104
-
\??\c:\3pdjv.exec:\3pdjv.exe75⤵PID:2712
-
\??\c:\vpvpj.exec:\vpvpj.exe76⤵PID:2692
-
\??\c:\9xrxxxf.exec:\9xrxxxf.exe77⤵PID:2676
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe78⤵PID:2776
-
\??\c:\5bnbhh.exec:\5bnbhh.exe79⤵PID:2724
-
\??\c:\ntbbhn.exec:\ntbbhn.exe80⤵PID:2556
-
\??\c:\9vpdd.exec:\9vpdd.exe81⤵PID:1336
-
\??\c:\7dpdv.exec:\7dpdv.exe82⤵PID:2396
-
\??\c:\frxrlff.exec:\frxrlff.exe83⤵PID:2128
-
\??\c:\rfrfrxr.exec:\rfrfrxr.exe84⤵PID:980
-
\??\c:\httbhn.exec:\httbhn.exe85⤵PID:2928
-
\??\c:\1hbhnt.exec:\1hbhnt.exe86⤵PID:2888
-
\??\c:\vpdvd.exec:\vpdvd.exe87⤵PID:3040
-
\??\c:\jvdpd.exec:\jvdpd.exe88⤵PID:2316
-
\??\c:\xllfxxf.exec:\xllfxxf.exe89⤵PID:2548
-
\??\c:\1xlrffr.exec:\1xlrffr.exe90⤵PID:2600
-
\??\c:\bnbbnt.exec:\bnbbnt.exe91⤵PID:1956
-
\??\c:\jpppp.exec:\jpppp.exe92⤵PID:2368
-
\??\c:\jjdvj.exec:\jjdvj.exe93⤵PID:1928
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe94⤵PID:1648
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe95⤵PID:784
-
\??\c:\nbbnbh.exec:\nbbnbh.exe96⤵PID:1476
-
\??\c:\tnbttt.exec:\tnbttt.exe97⤵PID:268
-
\??\c:\vpjvp.exec:\vpjvp.exe98⤵PID:2304
-
\??\c:\dpppp.exec:\dpppp.exe99⤵PID:1516
-
\??\c:\lflfrrx.exec:\lflfrrx.exe100⤵PID:1684
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe101⤵PID:1284
-
\??\c:\htnnbb.exec:\htnnbb.exe102⤵PID:1092
-
\??\c:\nbhbbh.exec:\nbhbbh.exe103⤵PID:3012
-
\??\c:\jjppv.exec:\jjppv.exe104⤵PID:3004
-
\??\c:\jvdvd.exec:\jvdvd.exe105⤵PID:1504
-
\??\c:\rflxxlf.exec:\rflxxlf.exe106⤵PID:2344
-
\??\c:\5jdjp.exec:\5jdjp.exe107⤵PID:2432
-
\??\c:\lxlrflx.exec:\lxlrflx.exe108⤵PID:2464
-
\??\c:\rlrlflr.exec:\rlrlflr.exe109⤵PID:1716
-
\??\c:\btnbtt.exec:\btnbtt.exe110⤵PID:1988
-
\??\c:\tbnnbt.exec:\tbnnbt.exe111⤵PID:2828
-
\??\c:\tnbbhn.exec:\tnbbhn.exe112⤵PID:2708
-
\??\c:\7pdpj.exec:\7pdpj.exe113⤵PID:2844
-
\??\c:\1dvdj.exec:\1dvdj.exe114⤵PID:2984
-
\??\c:\xxrlffx.exec:\xxrlffx.exe115⤵PID:2568
-
\??\c:\1lxxffr.exec:\1lxxffr.exe116⤵PID:2296
-
\??\c:\5bnnhh.exec:\5bnnhh.exe117⤵PID:2968
-
\??\c:\9htbhn.exec:\9htbhn.exe118⤵PID:2136
-
\??\c:\tnbbbh.exec:\tnbbbh.exe119⤵PID:2816
-
\??\c:\7djvd.exec:\7djvd.exe120⤵PID:2612
-
\??\c:\vvdjv.exec:\vvdjv.exe121⤵PID:3048
-
\??\c:\rlllrxl.exec:\rlllrxl.exe122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-