Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4508b3065128bff4d98c6a13bb8f1fb0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
4508b3065128bff4d98c6a13bb8f1fb0N.exe
-
Size
59KB
-
MD5
4508b3065128bff4d98c6a13bb8f1fb0
-
SHA1
867de64fd52c80d06769b119db92bddab2fa87f0
-
SHA256
a05852291fbc686247cb432de4bf11e79baaed738f38a453699fa2b63dfaa1f5
-
SHA512
7cbd5326476d360a048a5476b99c8f208df8e721d826b15435e301bb07bc3efd267a8fd13fd9a2571a540422c440f57b00c857dd0d42b21045bdd531f1963f7c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb+8RI:ymb3NkkiQ3mdBjFIjRI
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2604-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1780 jjdpv.exe 2304 fxflxrl.exe 2720 htbtht.exe 2664 bthhtb.exe 2676 pjvvd.exe 2804 ttnhnb.exe 2660 pjdjv.exe 2520 dvjpv.exe 2956 3xxlrfx.exe 2972 rrlxllx.exe 1632 5hbnnt.exe 2848 vjjvd.exe 1896 9dvjp.exe 324 9frrlrx.exe 2712 3tnhnb.exe 2856 bhnhtb.exe 1852 bbhnhn.exe 1880 pjdjv.exe 2204 frxlflx.exe 1376 fxlrflr.exe 2112 bhbnbn.exe 2412 thhthb.exe 1156 pdvvd.exe 1200 ffxlxlr.exe 1952 ffxrlrf.exe 1740 thtbnn.exe 380 vppjv.exe 3008 7vdpp.exe 1032 1lfrlxf.exe 1444 7fxrrxf.exe 1276 3nhhnn.exe 2276 hbntbh.exe 2464 ddvjj.exe 1540 jvppd.exe 2632 rllxlrr.exe 2728 xrlrflr.exe 2772 bthnbh.exe 2176 bttbtt.exe 2780 dvjvd.exe 3000 7vdjp.exe 2636 xrffxff.exe 2660 5lffrxr.exe 600 rrllrxr.exe 2220 bbntnt.exe 2260 hbhthn.exe 2972 9jdjv.exe 2840 dppdd.exe 1900 xfxxflx.exe 2760 rllrfrf.exe 1028 xxrfrll.exe 1712 tttnnh.exe 1604 nhttbh.exe 1452 3vpdp.exe 1884 vdppj.exe 3068 jddpd.exe 2196 lfrrxfl.exe 2100 9rrlxfx.exe 1596 tntttb.exe 1420 3vppv.exe 1316 dvjpj.exe 1616 ffxfxxf.exe 1936 9fflxfr.exe 2916 nhnnbt.exe 2328 3nbbbh.exe -
resource yara_rule behavioral1/memory/2604-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-262-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 1780 2604 4508b3065128bff4d98c6a13bb8f1fb0N.exe 31 PID 2604 wrote to memory of 1780 2604 4508b3065128bff4d98c6a13bb8f1fb0N.exe 31 PID 2604 wrote to memory of 1780 2604 4508b3065128bff4d98c6a13bb8f1fb0N.exe 31 PID 2604 wrote to memory of 1780 2604 4508b3065128bff4d98c6a13bb8f1fb0N.exe 31 PID 1780 wrote to memory of 2304 1780 jjdpv.exe 32 PID 1780 wrote to memory of 2304 1780 jjdpv.exe 32 PID 1780 wrote to memory of 2304 1780 jjdpv.exe 32 PID 1780 wrote to memory of 2304 1780 jjdpv.exe 32 PID 2304 wrote to memory of 2720 2304 fxflxrl.exe 33 PID 2304 wrote to memory of 2720 2304 fxflxrl.exe 33 PID 2304 wrote to memory of 2720 2304 fxflxrl.exe 33 PID 2304 wrote to memory of 2720 2304 fxflxrl.exe 33 PID 2720 wrote to memory of 2664 2720 htbtht.exe 34 PID 2720 wrote to memory of 2664 2720 htbtht.exe 34 PID 2720 wrote to memory of 2664 2720 htbtht.exe 34 PID 2720 wrote to memory of 2664 2720 htbtht.exe 34 PID 2664 wrote to memory of 2676 2664 bthhtb.exe 35 PID 2664 wrote to memory of 2676 2664 bthhtb.exe 35 PID 2664 wrote to memory of 2676 2664 bthhtb.exe 35 PID 2664 wrote to memory of 2676 2664 bthhtb.exe 35 PID 2676 wrote to memory of 2804 2676 pjvvd.exe 36 PID 2676 wrote to memory of 2804 2676 pjvvd.exe 36 PID 2676 wrote to memory of 2804 2676 pjvvd.exe 36 PID 2676 wrote to memory of 2804 2676 pjvvd.exe 36 PID 2804 wrote to memory of 2660 2804 ttnhnb.exe 37 PID 2804 wrote to memory of 2660 2804 ttnhnb.exe 37 PID 2804 wrote to memory of 2660 2804 ttnhnb.exe 37 PID 2804 wrote to memory of 2660 2804 ttnhnb.exe 37 PID 2660 wrote to memory of 2520 2660 pjdjv.exe 38 PID 2660 wrote to memory of 2520 2660 pjdjv.exe 38 PID 2660 wrote to memory of 2520 2660 pjdjv.exe 38 PID 2660 wrote to memory of 2520 2660 pjdjv.exe 38 PID 2520 wrote to memory of 2956 2520 dvjpv.exe 39 PID 2520 wrote to memory of 2956 2520 dvjpv.exe 39 PID 2520 wrote to memory of 2956 2520 dvjpv.exe 39 PID 2520 wrote to memory of 2956 2520 dvjpv.exe 39 PID 2956 wrote to memory of 2972 2956 3xxlrfx.exe 40 PID 2956 wrote to memory of 2972 2956 3xxlrfx.exe 40 PID 2956 wrote to memory of 2972 2956 3xxlrfx.exe 40 PID 2956 wrote to memory of 2972 2956 3xxlrfx.exe 40 PID 2972 wrote to memory of 1632 2972 rrlxllx.exe 41 PID 2972 wrote to memory of 1632 2972 rrlxllx.exe 41 PID 2972 wrote to memory of 1632 2972 rrlxllx.exe 41 PID 2972 wrote to memory of 1632 2972 rrlxllx.exe 41 PID 1632 wrote to memory of 2848 1632 5hbnnt.exe 42 PID 1632 wrote to memory of 2848 1632 5hbnnt.exe 42 PID 1632 wrote to memory of 2848 1632 5hbnnt.exe 42 PID 1632 wrote to memory of 2848 1632 5hbnnt.exe 42 PID 2848 wrote to memory of 1896 2848 vjjvd.exe 43 PID 2848 wrote to memory of 1896 2848 vjjvd.exe 43 PID 2848 wrote to memory of 1896 2848 vjjvd.exe 43 PID 2848 wrote to memory of 1896 2848 vjjvd.exe 43 PID 1896 wrote to memory of 324 1896 9dvjp.exe 44 PID 1896 wrote to memory of 324 1896 9dvjp.exe 44 PID 1896 wrote to memory of 324 1896 9dvjp.exe 44 PID 1896 wrote to memory of 324 1896 9dvjp.exe 44 PID 324 wrote to memory of 2712 324 9frrlrx.exe 45 PID 324 wrote to memory of 2712 324 9frrlrx.exe 45 PID 324 wrote to memory of 2712 324 9frrlrx.exe 45 PID 324 wrote to memory of 2712 324 9frrlrx.exe 45 PID 2712 wrote to memory of 2856 2712 3tnhnb.exe 46 PID 2712 wrote to memory of 2856 2712 3tnhnb.exe 46 PID 2712 wrote to memory of 2856 2712 3tnhnb.exe 46 PID 2712 wrote to memory of 2856 2712 3tnhnb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4508b3065128bff4d98c6a13bb8f1fb0N.exe"C:\Users\Admin\AppData\Local\Temp\4508b3065128bff4d98c6a13bb8f1fb0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jjdpv.exec:\jjdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\fxflxrl.exec:\fxflxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\htbtht.exec:\htbtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bthhtb.exec:\bthhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pjvvd.exec:\pjvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ttnhnb.exec:\ttnhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\pjdjv.exec:\pjdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\dvjpv.exec:\dvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3xxlrfx.exec:\3xxlrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rrlxllx.exec:\rrlxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\5hbnnt.exec:\5hbnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\vjjvd.exec:\vjjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9dvjp.exec:\9dvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\9frrlrx.exec:\9frrlrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\3tnhnb.exec:\3tnhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bhnhtb.exec:\bhnhtb.exe17⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bbhnhn.exec:\bbhnhn.exe18⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pjdjv.exec:\pjdjv.exe19⤵
- Executes dropped EXE
PID:1880 -
\??\c:\frxlflx.exec:\frxlflx.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\fxlrflr.exec:\fxlrflr.exe21⤵
- Executes dropped EXE
PID:1376 -
\??\c:\bhbnbn.exec:\bhbnbn.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\thhthb.exec:\thhthb.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pdvvd.exec:\pdvvd.exe24⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ffxlxlr.exec:\ffxlxlr.exe25⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ffxrlrf.exec:\ffxrlrf.exe26⤵
- Executes dropped EXE
PID:1952 -
\??\c:\thtbnn.exec:\thtbnn.exe27⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vppjv.exec:\vppjv.exe28⤵
- Executes dropped EXE
PID:380 -
\??\c:\7vdpp.exec:\7vdpp.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\1lfrlxf.exec:\1lfrlxf.exe30⤵
- Executes dropped EXE
PID:1032 -
\??\c:\7fxrrxf.exec:\7fxrrxf.exe31⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3nhhnn.exec:\3nhhnn.exe32⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbntbh.exec:\hbntbh.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ddvjj.exec:\ddvjj.exe34⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jvppd.exec:\jvppd.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rllxlrr.exec:\rllxlrr.exe36⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrlrflr.exec:\xrlrflr.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bthnbh.exec:\bthnbh.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bttbtt.exec:\bttbtt.exe39⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjvd.exec:\dvjvd.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7vdjp.exec:\7vdjp.exe41⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xrffxff.exec:\xrffxff.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5lffrxr.exec:\5lffrxr.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rrllrxr.exec:\rrllrxr.exe44⤵
- Executes dropped EXE
PID:600 -
\??\c:\bbntnt.exec:\bbntnt.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbhthn.exec:\hbhthn.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9jdjv.exec:\9jdjv.exe47⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dppdd.exec:\dppdd.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xfxxflx.exec:\xfxxflx.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1900 -
\??\c:\rllrfrf.exec:\rllrfrf.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xxrfrll.exec:\xxrfrll.exe51⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tttnnh.exec:\tttnnh.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhttbh.exec:\nhttbh.exe53⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3vpdp.exec:\3vpdp.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vdppj.exec:\vdppj.exe55⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jddpd.exec:\jddpd.exe56⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9rrlxfx.exec:\9rrlxfx.exe58⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tntttb.exec:\tntttb.exe59⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3vppv.exec:\3vppv.exe60⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dvjpj.exec:\dvjpj.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ffxfxxf.exec:\ffxfxxf.exe62⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9fflxfr.exec:\9fflxfr.exe63⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nhnnbt.exec:\nhnnbt.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3nbbbh.exec:\3nbbbh.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hbbnbh.exec:\hbbnbh.exe66⤵PID:1740
-
\??\c:\jjvdp.exec:\jjvdp.exe67⤵PID:380
-
\??\c:\jvvdp.exec:\jvvdp.exe68⤵PID:2068
-
\??\c:\7frrlfl.exec:\7frrlfl.exe69⤵PID:908
-
\??\c:\1llxlll.exec:\1llxlll.exe70⤵PID:1724
-
\??\c:\btthhb.exec:\btthhb.exe71⤵PID:2472
-
\??\c:\5nbbnb.exec:\5nbbnb.exe72⤵PID:2812
-
\??\c:\pjvjp.exec:\pjvjp.exe73⤵PID:396
-
\??\c:\jvjjj.exec:\jvjjj.exe74⤵PID:1544
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe75⤵PID:2240
-
\??\c:\rllxllx.exec:\rllxllx.exe76⤵PID:3060
-
\??\c:\9hbhtb.exec:\9hbhtb.exe77⤵PID:2896
-
\??\c:\htbhhb.exec:\htbhhb.exe78⤵PID:2648
-
\??\c:\nbbtbb.exec:\nbbtbb.exe79⤵PID:2684
-
\??\c:\jjvvj.exec:\jjvvj.exe80⤵PID:2704
-
\??\c:\vjppj.exec:\vjppj.exe81⤵PID:2784
-
\??\c:\rlxfflf.exec:\rlxfflf.exe82⤵PID:2540
-
\??\c:\3thtnt.exec:\3thtnt.exe83⤵PID:2596
-
\??\c:\nhnthn.exec:\nhnthn.exe84⤵PID:2536
-
\??\c:\9tnbhb.exec:\9tnbhb.exe85⤵PID:1580
-
\??\c:\vjpvv.exec:\vjpvv.exe86⤵PID:1788
-
\??\c:\7fxxllr.exec:\7fxxllr.exe87⤵PID:2716
-
\??\c:\fflfrrx.exec:\fflfrrx.exe88⤵PID:2424
-
\??\c:\hthnnh.exec:\hthnnh.exe89⤵PID:676
-
\??\c:\hbnthh.exec:\hbnthh.exe90⤵PID:1912
-
\??\c:\jvpvj.exec:\jvpvj.exe91⤵PID:864
-
\??\c:\frlxffl.exec:\frlxffl.exe92⤵PID:2712
-
\??\c:\7rxrlll.exec:\7rxrlll.exe93⤵PID:332
-
\??\c:\tnhtht.exec:\tnhtht.exe94⤵PID:2092
-
\??\c:\thttnb.exec:\thttnb.exe95⤵PID:2868
-
\??\c:\dvpvj.exec:\dvpvj.exe96⤵PID:2344
-
\??\c:\3dddp.exec:\3dddp.exe97⤵PID:684
-
\??\c:\rllffff.exec:\rllffff.exe98⤵PID:1436
-
\??\c:\lfxxffl.exec:\lfxxffl.exe99⤵PID:2416
-
\??\c:\3tnhtt.exec:\3tnhtt.exe100⤵PID:1792
-
\??\c:\tnbtnn.exec:\tnbtnn.exe101⤵PID:348
-
\??\c:\1pdvd.exec:\1pdvd.exe102⤵PID:1668
-
\??\c:\7jdpj.exec:\7jdpj.exe103⤵PID:804
-
\??\c:\ppdvj.exec:\ppdvj.exe104⤵PID:376
-
\??\c:\rrllflr.exec:\rrllflr.exe105⤵PID:536
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe106⤵PID:2436
-
\??\c:\5bhntn.exec:\5bhntn.exe107⤵PID:2148
-
\??\c:\5tttbb.exec:\5tttbb.exe108⤵PID:3008
-
\??\c:\dvppd.exec:\dvppd.exe109⤵PID:2880
-
\??\c:\ddvpd.exec:\ddvpd.exe110⤵PID:1224
-
\??\c:\5ffflrf.exec:\5ffflrf.exe111⤵PID:768
-
\??\c:\rxxlxfr.exec:\rxxlxfr.exe112⤵PID:316
-
\??\c:\hnbtnb.exec:\hnbtnb.exe113⤵PID:3028
-
\??\c:\vjvdj.exec:\vjvdj.exe114⤵PID:2976
-
\??\c:\pjpdv.exec:\pjpdv.exe115⤵PID:1736
-
\??\c:\rlrlrfl.exec:\rlrlrfl.exe116⤵PID:2748
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe117⤵
- System Location Discovery: System Language Discovery
PID:2736 -
\??\c:\7bbhtt.exec:\7bbhtt.exe118⤵PID:2772
-
\??\c:\7hnthh.exec:\7hnthh.exe119⤵PID:2836
-
\??\c:\jvdjp.exec:\jvdjp.exe120⤵PID:2816
-
\??\c:\pvvjj.exec:\pvvjj.exe121⤵PID:2552
-
\??\c:\pjvvj.exec:\pjvvj.exe122⤵PID:1652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-