Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe
Resource
win7-20240903-en
General
-
Target
39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe
-
Size
70KB
-
MD5
7e1892dcba2692b5898bcb66d7dfafe0
-
SHA1
373dcd6800af2cf82888e953ab343ec4d8188dd8
-
SHA256
39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96
-
SHA512
77a82758e8304b154a6bf945771552d9dc683a340d207752273eb475a4bcb80c89253dddcf9512300b4e50b27a857216888e684bed4589c6740d4fdce8c1366a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicvM:ymb3NkkiQ3mdBjFI4V4cit
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2648-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1004-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-1432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 9vdpj.exe 2804 rxxrxfx.exe 2820 nbnttt.exe 2752 dvvdj.exe 2536 9dvdv.exe 3004 5nbnbh.exe 348 tthnnn.exe 1392 pjdjv.exe 3028 lrlllxl.exe 2144 rrfllrr.exe 808 nhhnnt.exe 484 dvvdp.exe 1656 pdpdj.exe 696 xrflxfx.exe 2724 ffffllr.exe 1004 bbtnhn.exe 804 dpvvj.exe 2360 ddjjp.exe 1192 rfrxrrx.exe 2372 9rlfrlr.exe 2052 hthntt.exe 1152 9dddv.exe 1772 1pjvj.exe 752 xxlrfxf.exe 1956 nhtbnt.exe 2444 hhttbt.exe 2920 jvjpv.exe 2288 pjdjj.exe 1944 rlfrxxf.exe 2668 9bthbn.exe 2740 hbntbh.exe 1512 pdpjv.exe 2704 jdppd.exe 3040 xxrfllr.exe 2652 9lxrrrf.exe 2560 nhtbhh.exe 3056 1nnthn.exe 2660 7pppd.exe 296 pjvdj.exe 908 dvjpd.exe 1948 1rrxlxf.exe 2212 fxlrrrr.exe 3028 bbtbnn.exe 1028 1hhnnt.exe 584 7ddpd.exe 2608 1pvpd.exe 1612 xrffrrx.exe 1348 lxllrlr.exe 1668 bthnbt.exe 1260 5ttbhn.exe 992 pjvdv.exe 1880 ppdjv.exe 316 xrxflrx.exe 2436 1fxrflx.exe 2416 nhnthn.exe 2372 nhthtb.exe 2156 vjddd.exe 2052 dpvpd.exe 1724 3xfllrx.exe 944 lflrxfl.exe 752 1lllxxr.exe 2320 bhbhnb.exe 2280 nhtthb.exe 1204 7vppd.exe -
resource yara_rule behavioral1/memory/2648-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/696-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1004-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-1432-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2768 2648 39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe 30 PID 2648 wrote to memory of 2768 2648 39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe 30 PID 2648 wrote to memory of 2768 2648 39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe 30 PID 2648 wrote to memory of 2768 2648 39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe 30 PID 2768 wrote to memory of 2804 2768 9vdpj.exe 31 PID 2768 wrote to memory of 2804 2768 9vdpj.exe 31 PID 2768 wrote to memory of 2804 2768 9vdpj.exe 31 PID 2768 wrote to memory of 2804 2768 9vdpj.exe 31 PID 2804 wrote to memory of 2820 2804 rxxrxfx.exe 32 PID 2804 wrote to memory of 2820 2804 rxxrxfx.exe 32 PID 2804 wrote to memory of 2820 2804 rxxrxfx.exe 32 PID 2804 wrote to memory of 2820 2804 rxxrxfx.exe 32 PID 2820 wrote to memory of 2752 2820 nbnttt.exe 33 PID 2820 wrote to memory of 2752 2820 nbnttt.exe 33 PID 2820 wrote to memory of 2752 2820 nbnttt.exe 33 PID 2820 wrote to memory of 2752 2820 nbnttt.exe 33 PID 2752 wrote to memory of 2536 2752 dvvdj.exe 34 PID 2752 wrote to memory of 2536 2752 dvvdj.exe 34 PID 2752 wrote to memory of 2536 2752 dvvdj.exe 34 PID 2752 wrote to memory of 2536 2752 dvvdj.exe 34 PID 2536 wrote to memory of 3004 2536 9dvdv.exe 35 PID 2536 wrote to memory of 3004 2536 9dvdv.exe 35 PID 2536 wrote to memory of 3004 2536 9dvdv.exe 35 PID 2536 wrote to memory of 3004 2536 9dvdv.exe 35 PID 3004 wrote to memory of 348 3004 5nbnbh.exe 36 PID 3004 wrote to memory of 348 3004 5nbnbh.exe 36 PID 3004 wrote to memory of 348 3004 5nbnbh.exe 36 PID 3004 wrote to memory of 348 3004 5nbnbh.exe 36 PID 348 wrote to memory of 1392 348 tthnnn.exe 37 PID 348 wrote to memory of 1392 348 tthnnn.exe 37 PID 348 wrote to memory of 1392 348 tthnnn.exe 37 PID 348 wrote to memory of 1392 348 tthnnn.exe 37 PID 1392 wrote to memory of 3028 1392 pjdjv.exe 38 PID 1392 wrote to memory of 3028 1392 pjdjv.exe 38 PID 1392 wrote to memory of 3028 1392 pjdjv.exe 38 PID 1392 wrote to memory of 3028 1392 pjdjv.exe 38 PID 3028 wrote to memory of 2144 3028 lrlllxl.exe 39 PID 3028 wrote to memory of 2144 3028 lrlllxl.exe 39 PID 3028 wrote to memory of 2144 3028 lrlllxl.exe 39 PID 3028 wrote to memory of 2144 3028 lrlllxl.exe 39 PID 2144 wrote to memory of 808 2144 rrfllrr.exe 40 PID 2144 wrote to memory of 808 2144 rrfllrr.exe 40 PID 2144 wrote to memory of 808 2144 rrfllrr.exe 40 PID 2144 wrote to memory of 808 2144 rrfllrr.exe 40 PID 808 wrote to memory of 484 808 nhhnnt.exe 41 PID 808 wrote to memory of 484 808 nhhnnt.exe 41 PID 808 wrote to memory of 484 808 nhhnnt.exe 41 PID 808 wrote to memory of 484 808 nhhnnt.exe 41 PID 484 wrote to memory of 1656 484 dvvdp.exe 42 PID 484 wrote to memory of 1656 484 dvvdp.exe 42 PID 484 wrote to memory of 1656 484 dvvdp.exe 42 PID 484 wrote to memory of 1656 484 dvvdp.exe 42 PID 1656 wrote to memory of 696 1656 pdpdj.exe 43 PID 1656 wrote to memory of 696 1656 pdpdj.exe 43 PID 1656 wrote to memory of 696 1656 pdpdj.exe 43 PID 1656 wrote to memory of 696 1656 pdpdj.exe 43 PID 696 wrote to memory of 2724 696 xrflxfx.exe 44 PID 696 wrote to memory of 2724 696 xrflxfx.exe 44 PID 696 wrote to memory of 2724 696 xrflxfx.exe 44 PID 696 wrote to memory of 2724 696 xrflxfx.exe 44 PID 2724 wrote to memory of 1004 2724 ffffllr.exe 45 PID 2724 wrote to memory of 1004 2724 ffffllr.exe 45 PID 2724 wrote to memory of 1004 2724 ffffllr.exe 45 PID 2724 wrote to memory of 1004 2724 ffffllr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe"C:\Users\Admin\AppData\Local\Temp\39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9vdpj.exec:\9vdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rxxrxfx.exec:\rxxrxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\nbnttt.exec:\nbnttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dvvdj.exec:\dvvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9dvdv.exec:\9dvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\5nbnbh.exec:\5nbnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\tthnnn.exec:\tthnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\pjdjv.exec:\pjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\lrlllxl.exec:\lrlllxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\rrfllrr.exec:\rrfllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nhhnnt.exec:\nhhnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\dvvdp.exec:\dvvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\pdpdj.exec:\pdpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\xrflxfx.exec:\xrflxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\ffffllr.exec:\ffffllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bbtnhn.exec:\bbtnhn.exe17⤵
- Executes dropped EXE
PID:1004 -
\??\c:\dpvvj.exec:\dpvvj.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\ddjjp.exec:\ddjjp.exe19⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe20⤵
- Executes dropped EXE
PID:1192 -
\??\c:\9rlfrlr.exec:\9rlfrlr.exe21⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hthntt.exec:\hthntt.exe22⤵
- Executes dropped EXE
PID:2052 -
\??\c:\9dddv.exec:\9dddv.exe23⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1pjvj.exec:\1pjvj.exe24⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xxlrfxf.exec:\xxlrfxf.exe25⤵
- Executes dropped EXE
PID:752 -
\??\c:\nhtbnt.exec:\nhtbnt.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hhttbt.exec:\hhttbt.exe27⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jvjpv.exec:\jvjpv.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\pjdjj.exec:\pjdjj.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9bthbn.exec:\9bthbn.exe31⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hbntbh.exec:\hbntbh.exe32⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pdpjv.exec:\pdpjv.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jdppd.exec:\jdppd.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xxrfllr.exec:\xxrfllr.exe35⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9lxrrrf.exec:\9lxrrrf.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nhtbhh.exec:\nhtbhh.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1nnthn.exec:\1nnthn.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7pppd.exec:\7pppd.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjvdj.exec:\pjvdj.exe40⤵
- Executes dropped EXE
PID:296 -
\??\c:\dvjpd.exec:\dvjpd.exe41⤵
- Executes dropped EXE
PID:908 -
\??\c:\1rrxlxf.exec:\1rrxlxf.exe42⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fxlrrrr.exec:\fxlrrrr.exe43⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbtbnn.exec:\bbtbnn.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\1hhnnt.exec:\1hhnnt.exe45⤵
- Executes dropped EXE
PID:1028 -
\??\c:\7ddpd.exec:\7ddpd.exe46⤵
- Executes dropped EXE
PID:584 -
\??\c:\1pvpd.exec:\1pvpd.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrffrrx.exec:\xrffrrx.exe48⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxllrlr.exec:\lxllrlr.exe49⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bthnbt.exec:\bthnbt.exe50⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5ttbhn.exec:\5ttbhn.exe51⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pjvdv.exec:\pjvdv.exe52⤵
- Executes dropped EXE
PID:992 -
\??\c:\ppdjv.exec:\ppdjv.exe53⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xrxflrx.exec:\xrxflrx.exe54⤵
- Executes dropped EXE
PID:316 -
\??\c:\1fxrflx.exec:\1fxrflx.exe55⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nhnthn.exec:\nhnthn.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhthtb.exec:\nhthtb.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vjddd.exec:\vjddd.exe58⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dpvpd.exec:\dpvpd.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3xfllrx.exec:\3xfllrx.exe60⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lflrxfl.exec:\lflrxfl.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\1lllxxr.exec:\1lllxxr.exe62⤵
- Executes dropped EXE
PID:752 -
\??\c:\bhbhnb.exec:\bhbhnb.exe63⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhtthb.exec:\nhtthb.exe64⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7vppd.exec:\7vppd.exe65⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dvjvj.exec:\dvjvj.exe66⤵PID:2920
-
\??\c:\xlrflrx.exec:\xlrflrx.exe67⤵PID:3032
-
\??\c:\rlrxxrf.exec:\rlrxxrf.exe68⤵PID:2220
-
\??\c:\htntbb.exec:\htntbb.exe69⤵PID:1064
-
\??\c:\tnbhnt.exec:\tnbhnt.exe70⤵PID:2780
-
\??\c:\dpdjp.exec:\dpdjp.exe71⤵PID:1524
-
\??\c:\jjjpv.exec:\jjjpv.exe72⤵PID:2800
-
\??\c:\fxffllr.exec:\fxffllr.exe73⤵PID:2716
-
\??\c:\rlxfffl.exec:\rlxfffl.exe74⤵PID:2924
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe75⤵PID:2564
-
\??\c:\hbnhnh.exec:\hbnhnh.exe76⤵PID:2604
-
\??\c:\bththh.exec:\bththh.exe77⤵PID:2112
-
\??\c:\jjdvv.exec:\jjdvv.exe78⤵PID:2588
-
\??\c:\jdjpv.exec:\jdjpv.exe79⤵PID:2836
-
\??\c:\btbhnn.exec:\btbhnn.exe80⤵PID:2892
-
\??\c:\bththn.exec:\bththn.exe81⤵PID:1628
-
\??\c:\pjjjj.exec:\pjjjj.exe82⤵PID:2088
-
\??\c:\ddpdj.exec:\ddpdj.exe83⤵PID:2108
-
\??\c:\5xrrxxf.exec:\5xrrxxf.exe84⤵PID:2340
-
\??\c:\1rxlxlr.exec:\1rxlxlr.exe85⤵PID:536
-
\??\c:\bthtbh.exec:\bthtbh.exe86⤵PID:1940
-
\??\c:\ttnhhh.exec:\ttnhhh.exe87⤵PID:1656
-
\??\c:\vvvjv.exec:\vvvjv.exe88⤵PID:1644
-
\??\c:\dvpvj.exec:\dvpvj.exe89⤵PID:2720
-
\??\c:\lfxlxxf.exec:\lfxlxxf.exe90⤵PID:1668
-
\??\c:\1frfllr.exec:\1frfllr.exe91⤵PID:1548
-
\??\c:\1ttnhn.exec:\1ttnhn.exe92⤵PID:2396
-
\??\c:\nhhnhn.exec:\nhhnhn.exe93⤵PID:3064
-
\??\c:\9vjpd.exec:\9vjpd.exe94⤵PID:1932
-
\??\c:\jdjjp.exec:\jdjjp.exe95⤵PID:352
-
\??\c:\xrflrxf.exec:\xrflrxf.exe96⤵PID:2276
-
\??\c:\1rxxfff.exec:\1rxxfff.exe97⤵PID:1284
-
\??\c:\btnttb.exec:\btnttb.exe98⤵PID:1968
-
\??\c:\hbnbhh.exec:\hbnbhh.exe99⤵PID:2848
-
\??\c:\vpvpd.exec:\vpvpd.exe100⤵PID:3068
-
\??\c:\vjpjd.exec:\vjpjd.exe101⤵PID:1076
-
\??\c:\xlfllrx.exec:\xlfllrx.exe102⤵PID:2468
-
\??\c:\rlxflrx.exec:\rlxflrx.exe103⤵PID:2968
-
\??\c:\bbnnhh.exec:\bbnnhh.exe104⤵PID:2040
-
\??\c:\hbhnnn.exec:\hbhnnn.exe105⤵PID:888
-
\??\c:\vppvj.exec:\vppvj.exe106⤵PID:1708
-
\??\c:\dvjpd.exec:\dvjpd.exe107⤵PID:2760
-
\??\c:\lxllrrx.exec:\lxllrrx.exe108⤵PID:2748
-
\??\c:\rllxrfr.exec:\rllxrfr.exe109⤵PID:2744
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe110⤵PID:1512
-
\??\c:\btnbhh.exec:\btnbhh.exe111⤵PID:1604
-
\??\c:\btttbt.exec:\btttbt.exe112⤵PID:2592
-
\??\c:\jdvdj.exec:\jdvdj.exe113⤵PID:2540
-
\??\c:\jjdvv.exec:\jjdvv.exe114⤵PID:2616
-
\??\c:\frllfll.exec:\frllfll.exe115⤵PID:1820
-
\??\c:\lfllxrf.exec:\lfllxrf.exe116⤵PID:3008
-
\??\c:\lxfflfl.exec:\lxfflfl.exe117⤵PID:1388
-
\??\c:\nhbbbh.exec:\nhbbbh.exe118⤵PID:2728
-
\??\c:\7btbhh.exec:\7btbhh.exe119⤵PID:2984
-
\??\c:\5pjdj.exec:\5pjdj.exe120⤵PID:2996
-
\??\c:\jdvjp.exec:\jdvjp.exe121⤵PID:1652
-
\??\c:\vjppp.exec:\vjppp.exe122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-