Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 01:49
Static task
static1
Behavioral task
behavioral1
Sample
6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe
Resource
win7-20240903-en
General
-
Target
6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe
-
Size
107KB
-
MD5
7461f95eb1b187083c509b60cfdec670
-
SHA1
1baa81647383f00fe47a80dd1d722c15a112ae01
-
SHA256
6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75
-
SHA512
4b235c62e255f3d2f64268dcb4c94988c66b538bce2b951d7fb8b4ffce6b38e23d3f4767ae0d7fb9f578c7370e76790d8154d7096083101f5277cb93708ea368
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3Cme:n3C9BRo7MlrWKVT+buBGu3PHe
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2796 hbhbtn.exe 2284 9dpvv.exe 2620 lxlrxrf.exe 3052 hhnthn.exe 484 1jvpv.exe 1500 rlrlrxl.exe 1864 nhtthh.exe 768 dvpvj.exe 1736 xlxflfr.exe 2520 lxrxlrf.exe 2792 btbhnt.exe 3024 7vvdv.exe 2480 jjvdp.exe 1532 rfrfrrf.exe 1404 hbthnt.exe 2340 nnbhnn.exe 1940 pdpvj.exe 888 pdjdd.exe 1932 llxlflf.exe 1676 bntttt.exe 2584 9thbbt.exe 2424 ppppp.exe 2016 lxfflrx.exe 1068 frfffll.exe 1356 htnntb.exe 2052 pdjjp.exe 2376 jjvvj.exe 2452 1fxrxxf.exe 2536 btnhtt.exe 2776 nhtntn.exe 2568 dvjpj.exe 2640 tthbtb.exe 2752 9thbbh.exe 2736 jdjpj.exe 2244 lrlffxf.exe 3052 xrrxxxf.exe 1084 lfllrrx.exe 548 tnbbbb.exe 2272 pdpjj.exe 2324 vjppd.exe 2596 xrxfxff.exe 768 xlxrxrx.exe 1824 hhnntt.exe 1256 nbttbt.exe 2812 pjvpp.exe 2676 jdjdj.exe 3024 9rrrxll.exe 836 rxxlxlf.exe 1740 7httbb.exe 1440 thttbb.exe 2256 thttbb.exe 2356 jvvvv.exe 704 vddvp.exe 3008 xlrrrrx.exe 2140 xrlrflx.exe 2472 7nhnbh.exe 996 btbbbt.exe 1144 pjjpd.exe 2580 vpjvj.exe 1360 ffllffl.exe 1720 lxrrxll.exe 1564 tnnnnh.exe 2556 7tbhhh.exe 2268 vpjpd.exe -
resource yara_rule behavioral1/memory/2036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2796 2036 6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe 30 PID 2036 wrote to memory of 2796 2036 6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe 30 PID 2036 wrote to memory of 2796 2036 6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe 30 PID 2036 wrote to memory of 2796 2036 6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe 30 PID 2796 wrote to memory of 2284 2796 hbhbtn.exe 31 PID 2796 wrote to memory of 2284 2796 hbhbtn.exe 31 PID 2796 wrote to memory of 2284 2796 hbhbtn.exe 31 PID 2796 wrote to memory of 2284 2796 hbhbtn.exe 31 PID 2284 wrote to memory of 2620 2284 9dpvv.exe 32 PID 2284 wrote to memory of 2620 2284 9dpvv.exe 32 PID 2284 wrote to memory of 2620 2284 9dpvv.exe 32 PID 2284 wrote to memory of 2620 2284 9dpvv.exe 32 PID 2620 wrote to memory of 3052 2620 lxlrxrf.exe 33 PID 2620 wrote to memory of 3052 2620 lxlrxrf.exe 33 PID 2620 wrote to memory of 3052 2620 lxlrxrf.exe 33 PID 2620 wrote to memory of 3052 2620 lxlrxrf.exe 33 PID 3052 wrote to memory of 484 3052 hhnthn.exe 34 PID 3052 wrote to memory of 484 3052 hhnthn.exe 34 PID 3052 wrote to memory of 484 3052 hhnthn.exe 34 PID 3052 wrote to memory of 484 3052 hhnthn.exe 34 PID 484 wrote to memory of 1500 484 1jvpv.exe 35 PID 484 wrote to memory of 1500 484 1jvpv.exe 35 PID 484 wrote to memory of 1500 484 1jvpv.exe 35 PID 484 wrote to memory of 1500 484 1jvpv.exe 35 PID 1500 wrote to memory of 1864 1500 rlrlrxl.exe 36 PID 1500 wrote to memory of 1864 1500 rlrlrxl.exe 36 PID 1500 wrote to memory of 1864 1500 rlrlrxl.exe 36 PID 1500 wrote to memory of 1864 1500 rlrlrxl.exe 36 PID 1864 wrote to memory of 768 1864 nhtthh.exe 37 PID 1864 wrote to memory of 768 1864 nhtthh.exe 37 PID 1864 wrote to memory of 768 1864 nhtthh.exe 37 PID 1864 wrote to memory of 768 1864 nhtthh.exe 37 PID 768 wrote to memory of 1736 768 dvpvj.exe 38 PID 768 wrote to memory of 1736 768 dvpvj.exe 38 PID 768 wrote to memory of 1736 768 dvpvj.exe 38 PID 768 wrote to memory of 1736 768 dvpvj.exe 38 PID 1736 wrote to memory of 2520 1736 xlxflfr.exe 39 PID 1736 wrote to memory of 2520 1736 xlxflfr.exe 39 PID 1736 wrote to memory of 2520 1736 xlxflfr.exe 39 PID 1736 wrote to memory of 2520 1736 xlxflfr.exe 39 PID 2520 wrote to memory of 2792 2520 lxrxlrf.exe 40 PID 2520 wrote to memory of 2792 2520 lxrxlrf.exe 40 PID 2520 wrote to memory of 2792 2520 lxrxlrf.exe 40 PID 2520 wrote to memory of 2792 2520 lxrxlrf.exe 40 PID 2792 wrote to memory of 3024 2792 btbhnt.exe 41 PID 2792 wrote to memory of 3024 2792 btbhnt.exe 41 PID 2792 wrote to memory of 3024 2792 btbhnt.exe 41 PID 2792 wrote to memory of 3024 2792 btbhnt.exe 41 PID 3024 wrote to memory of 2480 3024 7vvdv.exe 42 PID 3024 wrote to memory of 2480 3024 7vvdv.exe 42 PID 3024 wrote to memory of 2480 3024 7vvdv.exe 42 PID 3024 wrote to memory of 2480 3024 7vvdv.exe 42 PID 2480 wrote to memory of 1532 2480 jjvdp.exe 43 PID 2480 wrote to memory of 1532 2480 jjvdp.exe 43 PID 2480 wrote to memory of 1532 2480 jjvdp.exe 43 PID 2480 wrote to memory of 1532 2480 jjvdp.exe 43 PID 1532 wrote to memory of 1404 1532 rfrfrrf.exe 44 PID 1532 wrote to memory of 1404 1532 rfrfrrf.exe 44 PID 1532 wrote to memory of 1404 1532 rfrfrrf.exe 44 PID 1532 wrote to memory of 1404 1532 rfrfrrf.exe 44 PID 1404 wrote to memory of 2340 1404 hbthnt.exe 45 PID 1404 wrote to memory of 2340 1404 hbthnt.exe 45 PID 1404 wrote to memory of 2340 1404 hbthnt.exe 45 PID 1404 wrote to memory of 2340 1404 hbthnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe"C:\Users\Admin\AppData\Local\Temp\6558b1f2294480b5cd30587ba2ba3718657082a9fbf29734e7d3173ba94d0d75N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hbhbtn.exec:\hbhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9dpvv.exec:\9dpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\lxlrxrf.exec:\lxlrxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hhnthn.exec:\hhnthn.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\1jvpv.exec:\1jvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\rlrlrxl.exec:\rlrlrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\nhtthh.exec:\nhtthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\dvpvj.exec:\dvpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\xlxflfr.exec:\xlxflfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\lxrxlrf.exec:\lxrxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\btbhnt.exec:\btbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7vvdv.exec:\7vvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jjvdp.exec:\jjvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rfrfrrf.exec:\rfrfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\hbthnt.exec:\hbthnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\nnbhnn.exec:\nnbhnn.exe17⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pdpvj.exec:\pdpvj.exe18⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pdjdd.exec:\pdjdd.exe19⤵
- Executes dropped EXE
PID:888 -
\??\c:\llxlflf.exec:\llxlflf.exe20⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bntttt.exec:\bntttt.exe21⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9thbbt.exec:\9thbbt.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ppppp.exec:\ppppp.exe23⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lxfflrx.exec:\lxfflrx.exe24⤵
- Executes dropped EXE
PID:2016 -
\??\c:\frfffll.exec:\frfffll.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\htnntb.exec:\htnntb.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\pdjjp.exec:\pdjjp.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jjvvj.exec:\jjvvj.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1fxrxxf.exec:\1fxrxxf.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\btnhtt.exec:\btnhtt.exe30⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhtntn.exec:\nhtntn.exe31⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dvjpj.exec:\dvjpj.exe32⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tthbtb.exec:\tthbtb.exe33⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9thbbh.exec:\9thbbh.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdjpj.exec:\jdjpj.exe35⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lrlffxf.exec:\lrlffxf.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\lfllrrx.exec:\lfllrrx.exe38⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tnbbbb.exec:\tnbbbb.exe39⤵
- Executes dropped EXE
PID:548 -
\??\c:\pdpjj.exec:\pdpjj.exe40⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vjppd.exec:\vjppd.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xrxfxff.exec:\xrxfxff.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xlxrxrx.exec:\xlxrxrx.exe43⤵
- Executes dropped EXE
PID:768 -
\??\c:\hhnntt.exec:\hhnntt.exe44⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nbttbt.exec:\nbttbt.exe45⤵
- Executes dropped EXE
PID:1256 -
\??\c:\pjvpp.exec:\pjvpp.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jdjdj.exec:\jdjdj.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9rrrxll.exec:\9rrrxll.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rxxlxlf.exec:\rxxlxlf.exe49⤵
- Executes dropped EXE
PID:836 -
\??\c:\7httbb.exec:\7httbb.exe50⤵
- Executes dropped EXE
PID:1740 -
\??\c:\thttbb.exec:\thttbb.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\thttbb.exec:\thttbb.exe52⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jvvvv.exec:\jvvvv.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vddvp.exec:\vddvp.exe54⤵
- Executes dropped EXE
PID:704 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe55⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xrlrflx.exec:\xrlrflx.exe56⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7nhnbh.exec:\7nhnbh.exe57⤵
- Executes dropped EXE
PID:2472 -
\??\c:\btbbbt.exec:\btbbbt.exe58⤵
- Executes dropped EXE
PID:996 -
\??\c:\pjjpd.exec:\pjjpd.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1144 -
\??\c:\vpjvj.exec:\vpjvj.exe60⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ffllffl.exec:\ffllffl.exe61⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lxrrxll.exec:\lxrrxll.exe62⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tnnnnh.exec:\tnnnnh.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7tbhhh.exec:\7tbhhh.exe64⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vpjpd.exec:\vpjpd.exe65⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vpvvj.exec:\vpvvj.exe66⤵PID:1100
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe67⤵PID:2264
-
\??\c:\fxfllrx.exec:\fxfllrx.exe68⤵PID:1284
-
\??\c:\hthntb.exec:\hthntb.exe69⤵PID:2732
-
\??\c:\5nhhtt.exec:\5nhhtt.exe70⤵PID:2644
-
\??\c:\dvjpj.exec:\dvjpj.exe71⤵PID:1616
-
\??\c:\jdppp.exec:\jdppp.exe72⤵PID:2516
-
\??\c:\rlxflfr.exec:\rlxflfr.exe73⤵PID:2636
-
\??\c:\frrfffr.exec:\frrfffr.exe74⤵PID:2284
-
\??\c:\bnthnt.exec:\bnthnt.exe75⤵PID:600
-
\??\c:\bbnhnn.exec:\bbnhnn.exe76⤵PID:780
-
\??\c:\1dppd.exec:\1dppd.exe77⤵PID:1488
-
\??\c:\9dvjd.exec:\9dvjd.exe78⤵PID:592
-
\??\c:\rlxfffl.exec:\rlxfffl.exe79⤵
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\lllrflx.exec:\lllrflx.exe80⤵PID:2444
-
\??\c:\xrfxfxl.exec:\xrfxfxl.exe81⤵PID:2984
-
\??\c:\btntbb.exec:\btntbb.exe82⤵PID:2832
-
\??\c:\nhttbb.exec:\nhttbb.exe83⤵PID:3056
-
\??\c:\jdvpv.exec:\jdvpv.exe84⤵PID:1324
-
\??\c:\3frrrrf.exec:\3frrrrf.exe85⤵PID:1980
-
\??\c:\9frrxxf.exec:\9frrxxf.exe86⤵PID:1332
-
\??\c:\7lxllll.exec:\7lxllll.exe87⤵PID:2056
-
\??\c:\nnbnbh.exec:\nnbnbh.exe88⤵PID:2480
-
\??\c:\btnntn.exec:\btnntn.exe89⤵PID:856
-
\??\c:\dvjvd.exec:\dvjvd.exe90⤵PID:1740
-
\??\c:\pdppd.exec:\pdppd.exe91⤵PID:1440
-
\??\c:\7xlfflr.exec:\7xlfflr.exe92⤵PID:2208
-
\??\c:\frrrxxf.exec:\frrrxxf.exe93⤵PID:1940
-
\??\c:\bbhnbh.exec:\bbhnbh.exe94⤵PID:2008
-
\??\c:\nhnbtb.exec:\nhnbtb.exe95⤵PID:1952
-
\??\c:\vpjpv.exec:\vpjpv.exe96⤵PID:1536
-
\??\c:\vpjjv.exec:\vpjjv.exe97⤵PID:2400
-
\??\c:\lfrfrxl.exec:\lfrfrxl.exe98⤵PID:1300
-
\??\c:\fxfffll.exec:\fxfffll.exe99⤵PID:2372
-
\??\c:\3nhbbt.exec:\3nhbbt.exe100⤵PID:2200
-
\??\c:\btbhtb.exec:\btbhtb.exe101⤵PID:2500
-
\??\c:\5pddj.exec:\5pddj.exe102⤵PID:908
-
\??\c:\7dvpv.exec:\7dvpv.exe103⤵PID:1356
-
\??\c:\dpvvj.exec:\dpvvj.exe104⤵PID:1748
-
\??\c:\9xlfflx.exec:\9xlfflx.exe105⤵
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\rlxxffr.exec:\rlxxffr.exe106⤵PID:1512
-
\??\c:\bnbtbb.exec:\bnbtbb.exe107⤵PID:2540
-
\??\c:\bbnnbb.exec:\bbnnbb.exe108⤵PID:2704
-
\??\c:\9ppvv.exec:\9ppvv.exe109⤵PID:2652
-
\??\c:\jjddv.exec:\jjddv.exe110⤵PID:1596
-
\??\c:\vpvdj.exec:\vpvdj.exe111⤵PID:2672
-
\??\c:\lxllllr.exec:\lxllllr.exe112⤵PID:2692
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe113⤵PID:2620
-
\??\c:\3hbhtn.exec:\3hbhtn.exe114⤵PID:264
-
\??\c:\bthbhn.exec:\bthbhn.exe115⤵PID:880
-
\??\c:\9jdjv.exec:\9jdjv.exe116⤵PID:484
-
\??\c:\lxxxrfl.exec:\lxxxrfl.exe117⤵PID:2828
-
\??\c:\1xrxffl.exec:\1xrxffl.exe118⤵PID:1272
-
\??\c:\nhttbt.exec:\nhttbt.exe119⤵PID:2404
-
\??\c:\hnbbbt.exec:\hnbbbt.exe120⤵PID:2988
-
\??\c:\dvjvd.exec:\dvjvd.exe121⤵PID:2108
-
\??\c:\7vvvj.exec:\7vvvj.exe122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-