Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37e3a9a9a84561752662f01ed2495200N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
37e3a9a9a84561752662f01ed2495200N.exe
-
Size
65KB
-
MD5
37e3a9a9a84561752662f01ed2495200
-
SHA1
f8c3ca95bcca24d1d48e4ba98b65c6978de13a9a
-
SHA256
71a55f3d8cbe5f2ae85be40a1a93201c0f7d05bf130b1972cfab78b8997fa8bb
-
SHA512
58bf401f6f5d8b0c5314579f77b0338ff20382ad2a6e3a8a8a2673a614ed0709d03b130cab294f69d35c2a2cb3c401dbbbf2437af1670a7d63ffd7dd6dc57102
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe6a:ymb3NkkiQ3mdBjF0y7kbUv
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2844-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2844 lllllxx.exe 2900 xlllllr.exe 2740 3tnnbh.exe 2604 5vpvd.exe 2524 5rfflfl.exe 1152 rfxrffr.exe 1120 ttntbn.exe 2264 9pjdp.exe 2064 ffrfrxf.exe 2964 rlfrffl.exe 1304 bnhntb.exe 1916 1vjjj.exe 2848 djdpj.exe 2160 1rrlxxf.exe 2224 hbntbh.exe 1284 hhnnth.exe 1860 dvjdj.exe 2076 dvpjp.exe 2312 fxlrlxf.exe 1456 rlfrxxl.exe 1128 tnbhtn.exe 1076 dvvvv.exe 2532 vpjvj.exe 992 lfrfxxr.exe 1960 xflllxr.exe 2928 nnbbbn.exe 1764 3pjdj.exe 2992 dvjjp.exe 1612 xrxxffl.exe 1512 xrfrxxf.exe 2704 7htttt.exe 1604 nhnthn.exe 2884 vjvjp.exe 2400 pjpdj.exe 2840 lfrflxf.exe 2584 3rxxfxf.exe 2144 hbnnhh.exe 2024 tnbtbb.exe 472 jdjdj.exe 1096 ddjjp.exe 1852 rlxlllr.exe 2168 5xxlfrl.exe 2120 thbthn.exe 2552 tnnhnt.exe 2880 9vpvv.exe 1248 dvpjp.exe 1660 3lrxxfl.exe 2856 9lxxlfl.exe 2924 bbntbh.exe 1188 jvpvp.exe 544 9pjdj.exe 1420 1lffrfl.exe 2280 fxrrffr.exe 2148 btnhnh.exe 2392 jpjdj.exe 1656 xlrllrl.exe 2004 xllxxxx.exe 744 hbhbtn.exe 904 tbbbbb.exe 2972 vppdp.exe 2008 vjpdj.exe 2532 5flllff.exe 1944 3rxxrxf.exe 1636 hthttb.exe -
resource yara_rule behavioral1/memory/2724-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2844 2724 37e3a9a9a84561752662f01ed2495200N.exe 30 PID 2724 wrote to memory of 2844 2724 37e3a9a9a84561752662f01ed2495200N.exe 30 PID 2724 wrote to memory of 2844 2724 37e3a9a9a84561752662f01ed2495200N.exe 30 PID 2724 wrote to memory of 2844 2724 37e3a9a9a84561752662f01ed2495200N.exe 30 PID 2844 wrote to memory of 2900 2844 lllllxx.exe 31 PID 2844 wrote to memory of 2900 2844 lllllxx.exe 31 PID 2844 wrote to memory of 2900 2844 lllllxx.exe 31 PID 2844 wrote to memory of 2900 2844 lllllxx.exe 31 PID 2900 wrote to memory of 2740 2900 xlllllr.exe 32 PID 2900 wrote to memory of 2740 2900 xlllllr.exe 32 PID 2900 wrote to memory of 2740 2900 xlllllr.exe 32 PID 2900 wrote to memory of 2740 2900 xlllllr.exe 32 PID 2740 wrote to memory of 2604 2740 3tnnbh.exe 33 PID 2740 wrote to memory of 2604 2740 3tnnbh.exe 33 PID 2740 wrote to memory of 2604 2740 3tnnbh.exe 33 PID 2740 wrote to memory of 2604 2740 3tnnbh.exe 33 PID 2604 wrote to memory of 2524 2604 5vpvd.exe 34 PID 2604 wrote to memory of 2524 2604 5vpvd.exe 34 PID 2604 wrote to memory of 2524 2604 5vpvd.exe 34 PID 2604 wrote to memory of 2524 2604 5vpvd.exe 34 PID 2524 wrote to memory of 1152 2524 5rfflfl.exe 35 PID 2524 wrote to memory of 1152 2524 5rfflfl.exe 35 PID 2524 wrote to memory of 1152 2524 5rfflfl.exe 35 PID 2524 wrote to memory of 1152 2524 5rfflfl.exe 35 PID 1152 wrote to memory of 1120 1152 rfxrffr.exe 36 PID 1152 wrote to memory of 1120 1152 rfxrffr.exe 36 PID 1152 wrote to memory of 1120 1152 rfxrffr.exe 36 PID 1152 wrote to memory of 1120 1152 rfxrffr.exe 36 PID 1120 wrote to memory of 2264 1120 ttntbn.exe 37 PID 1120 wrote to memory of 2264 1120 ttntbn.exe 37 PID 1120 wrote to memory of 2264 1120 ttntbn.exe 37 PID 1120 wrote to memory of 2264 1120 ttntbn.exe 37 PID 2264 wrote to memory of 2064 2264 9pjdp.exe 38 PID 2264 wrote to memory of 2064 2264 9pjdp.exe 38 PID 2264 wrote to memory of 2064 2264 9pjdp.exe 38 PID 2264 wrote to memory of 2064 2264 9pjdp.exe 38 PID 2064 wrote to memory of 2964 2064 ffrfrxf.exe 39 PID 2064 wrote to memory of 2964 2064 ffrfrxf.exe 39 PID 2064 wrote to memory of 2964 2064 ffrfrxf.exe 39 PID 2064 wrote to memory of 2964 2064 ffrfrxf.exe 39 PID 2964 wrote to memory of 1304 2964 rlfrffl.exe 40 PID 2964 wrote to memory of 1304 2964 rlfrffl.exe 40 PID 2964 wrote to memory of 1304 2964 rlfrffl.exe 40 PID 2964 wrote to memory of 1304 2964 rlfrffl.exe 40 PID 1304 wrote to memory of 1916 1304 bnhntb.exe 41 PID 1304 wrote to memory of 1916 1304 bnhntb.exe 41 PID 1304 wrote to memory of 1916 1304 bnhntb.exe 41 PID 1304 wrote to memory of 1916 1304 bnhntb.exe 41 PID 1916 wrote to memory of 2848 1916 1vjjj.exe 42 PID 1916 wrote to memory of 2848 1916 1vjjj.exe 42 PID 1916 wrote to memory of 2848 1916 1vjjj.exe 42 PID 1916 wrote to memory of 2848 1916 1vjjj.exe 42 PID 2848 wrote to memory of 2160 2848 djdpj.exe 43 PID 2848 wrote to memory of 2160 2848 djdpj.exe 43 PID 2848 wrote to memory of 2160 2848 djdpj.exe 43 PID 2848 wrote to memory of 2160 2848 djdpj.exe 43 PID 2160 wrote to memory of 2224 2160 1rrlxxf.exe 44 PID 2160 wrote to memory of 2224 2160 1rrlxxf.exe 44 PID 2160 wrote to memory of 2224 2160 1rrlxxf.exe 44 PID 2160 wrote to memory of 2224 2160 1rrlxxf.exe 44 PID 2224 wrote to memory of 1284 2224 hbntbh.exe 45 PID 2224 wrote to memory of 1284 2224 hbntbh.exe 45 PID 2224 wrote to memory of 1284 2224 hbntbh.exe 45 PID 2224 wrote to memory of 1284 2224 hbntbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\37e3a9a9a84561752662f01ed2495200N.exe"C:\Users\Admin\AppData\Local\Temp\37e3a9a9a84561752662f01ed2495200N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\lllllxx.exec:\lllllxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xlllllr.exec:\xlllllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\3tnnbh.exec:\3tnnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5vpvd.exec:\5vpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\5rfflfl.exec:\5rfflfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rfxrffr.exec:\rfxrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\ttntbn.exec:\ttntbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\9pjdp.exec:\9pjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\rlfrffl.exec:\rlfrffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bnhntb.exec:\bnhntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\1vjjj.exec:\1vjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\djdpj.exec:\djdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1rrlxxf.exec:\1rrlxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\hbntbh.exec:\hbntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\hhnnth.exec:\hhnnth.exe17⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dvjdj.exec:\dvjdj.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dvpjp.exec:\dvpjp.exe19⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxlrlxf.exec:\fxlrlxf.exe20⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rlfrxxl.exec:\rlfrxxl.exe21⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnbhtn.exec:\tnbhtn.exe22⤵
- Executes dropped EXE
PID:1128 -
\??\c:\dvvvv.exec:\dvvvv.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vpjvj.exec:\vpjvj.exe24⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfrfxxr.exec:\lfrfxxr.exe25⤵
- Executes dropped EXE
PID:992 -
\??\c:\xflllxr.exec:\xflllxr.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nnbbbn.exec:\nnbbbn.exe27⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3pjdj.exec:\3pjdj.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dvjjp.exec:\dvjjp.exe29⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xrxxffl.exec:\xrxxffl.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7htttt.exec:\7htttt.exe32⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhnthn.exec:\nhnthn.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vjvjp.exec:\vjvjp.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pjpdj.exec:\pjpdj.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lfrflxf.exec:\lfrflxf.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3rxxfxf.exec:\3rxxfxf.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbnnhh.exec:\hbnnhh.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tnbtbb.exec:\tnbtbb.exe39⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jdjdj.exec:\jdjdj.exe40⤵
- Executes dropped EXE
PID:472 -
\??\c:\ddjjp.exec:\ddjjp.exe41⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rlxlllr.exec:\rlxlllr.exe42⤵
- Executes dropped EXE
PID:1852 -
\??\c:\5xxlfrl.exec:\5xxlfrl.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\thbthn.exec:\thbthn.exe44⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tnnhnt.exec:\tnnhnt.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\9vpvv.exec:\9vpvv.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dvpjp.exec:\dvpjp.exe47⤵
- Executes dropped EXE
PID:1248 -
\??\c:\3lrxxfl.exec:\3lrxxfl.exe48⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9lxxlfl.exec:\9lxxlfl.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bbntbh.exec:\bbntbh.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvpvp.exec:\jvpvp.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\9pjdj.exec:\9pjdj.exe52⤵
- Executes dropped EXE
PID:544 -
\??\c:\1lffrfl.exec:\1lffrfl.exe53⤵
- Executes dropped EXE
PID:1420 -
\??\c:\fxrrffr.exec:\fxrrffr.exe54⤵
- Executes dropped EXE
PID:2280 -
\??\c:\btnhnh.exec:\btnhnh.exe55⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jpjdj.exec:\jpjdj.exe56⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xlrllrl.exec:\xlrllrl.exe57⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xllxxxx.exec:\xllxxxx.exe58⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbhbtn.exec:\hbhbtn.exe59⤵
- Executes dropped EXE
PID:744 -
\??\c:\tbbbbb.exec:\tbbbbb.exe60⤵
- Executes dropped EXE
PID:904 -
\??\c:\vppdp.exec:\vppdp.exe61⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vjpdj.exec:\vjpdj.exe62⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5flllff.exec:\5flllff.exe63⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3rxxrxf.exec:\3rxxrxf.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hthttb.exec:\hthttb.exe65⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhbnbb.exec:\nhbnbb.exe66⤵PID:2096
-
\??\c:\9pdpj.exec:\9pdpj.exe67⤵PID:2412
-
\??\c:\3vppd.exec:\3vppd.exe68⤵PID:3032
-
\??\c:\dvpjd.exec:\dvpjd.exe69⤵PID:2436
-
\??\c:\lxxxfff.exec:\lxxxfff.exe70⤵PID:868
-
\??\c:\xllrrlr.exec:\xllrrlr.exe71⤵PID:2448
-
\??\c:\bnnnhh.exec:\bnnnhh.exe72⤵PID:2820
-
\??\c:\hbbnhb.exec:\hbbnhb.exe73⤵PID:1716
-
\??\c:\jjvdp.exec:\jjvdp.exe74⤵PID:2596
-
\??\c:\jvvdd.exec:\jvvdd.exe75⤵PID:2892
-
\??\c:\9rllfxl.exec:\9rllfxl.exe76⤵PID:1976
-
\??\c:\ffxlffr.exec:\ffxlffr.exe77⤵PID:2900
-
\??\c:\btnnbb.exec:\btnnbb.exe78⤵PID:3020
-
\??\c:\5hthth.exec:\5hthth.exe79⤵PID:2604
-
\??\c:\pjvdp.exec:\pjvdp.exe80⤵PID:1376
-
\??\c:\1dvjj.exec:\1dvjj.exe81⤵PID:1500
-
\??\c:\frffffl.exec:\frffffl.exe82⤵PID:1856
-
\??\c:\xrlrxfx.exec:\xrlrxfx.exe83⤵
- System Location Discovery: System Language Discovery
PID:2104 -
\??\c:\tnbbbb.exec:\tnbbbb.exe84⤵PID:2052
-
\??\c:\nhtnnh.exec:\nhtnnh.exe85⤵PID:2248
-
\??\c:\jjvjj.exec:\jjvjj.exe86⤵PID:2896
-
\??\c:\vpvpv.exec:\vpvpv.exe87⤵PID:2404
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe88⤵PID:2308
-
\??\c:\fxxxlrr.exec:\fxxxlrr.exe89⤵PID:2864
-
\??\c:\thbnht.exec:\thbnht.exe90⤵PID:2912
-
\??\c:\nbnbtn.exec:\nbnbtn.exe91⤵PID:2196
-
\??\c:\dvpvd.exec:\dvpvd.exe92⤵PID:108
-
\??\c:\vjdpj.exec:\vjdpj.exe93⤵PID:1668
-
\??\c:\rlxfllx.exec:\rlxfllx.exe94⤵PID:2060
-
\??\c:\xrllxxf.exec:\xrllxxf.exe95⤵PID:2760
-
\??\c:\nbntbh.exec:\nbntbh.exe96⤵PID:2388
-
\??\c:\tnbtbb.exec:\tnbtbb.exe97⤵PID:3064
-
\??\c:\pjpvp.exec:\pjpvp.exe98⤵PID:560
-
\??\c:\vpvvd.exec:\vpvvd.exe99⤵PID:1044
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe100⤵PID:1456
-
\??\c:\fxxxffl.exec:\fxxxffl.exe101⤵PID:1032
-
\??\c:\btbnhh.exec:\btbnhh.exe102⤵PID:1076
-
\??\c:\7dddd.exec:\7dddd.exe103⤵PID:1732
-
\??\c:\1dpvv.exec:\1dpvv.exe104⤵PID:1036
-
\??\c:\3fxrxfl.exec:\3fxrxfl.exe105⤵PID:1820
-
\??\c:\rxlxflf.exec:\rxlxflf.exe106⤵PID:2432
-
\??\c:\9ttbbn.exec:\9ttbbn.exe107⤵PID:2928
-
\??\c:\nhthnt.exec:\nhthnt.exe108⤵PID:3056
-
\??\c:\jdjdd.exec:\jdjdd.exe109⤵PID:2980
-
\??\c:\dpjpv.exec:\dpjpv.exe110⤵PID:1784
-
\??\c:\rfxrxxl.exec:\rfxrxxl.exe111⤵PID:2212
-
\??\c:\fffrrlx.exec:\fffrrlx.exe112⤵PID:2292
-
\??\c:\nbbbtt.exec:\nbbbtt.exe113⤵PID:2092
-
\??\c:\bnhhbt.exec:\bnhhbt.exe114⤵PID:2876
-
\??\c:\jdvvv.exec:\jdvvv.exe115⤵PID:2792
-
\??\c:\vvpvv.exec:\vvpvv.exe116⤵PID:2788
-
\??\c:\xlfflrx.exec:\xlfflrx.exe117⤵PID:1976
-
\??\c:\llflrxr.exec:\llflrxr.exe118⤵PID:3012
-
\??\c:\bbhhnt.exec:\bbhhnt.exe119⤵PID:2624
-
\??\c:\5thbhn.exec:\5thbhn.exe120⤵PID:1040
-
\??\c:\7dpvd.exec:\7dpvd.exe121⤵PID:864
-
\??\c:\3jvvd.exec:\3jvvd.exe122⤵PID:1152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-