Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b58fff930e892b84635f2a3054693a70N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
b58fff930e892b84635f2a3054693a70N.exe
-
Size
261KB
-
MD5
b58fff930e892b84635f2a3054693a70
-
SHA1
6531e70cd467de9461d1362cf2bf764d80ab4ec7
-
SHA256
1a773e6696b1afe09189e023a3e5be75f303df90692ae6cbbee8c543c228ade7
-
SHA512
a0f08f1fde5a8cdd0791f99c2fe8a4bf1e7995eca0beb1f0d0095097565b3f62c0092761fa0bb38098151101fe5e2fc06e1b4c5e2e86da8e9781045ab0672dce
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0qF:n3C9ytvn8whkb4i3e3GF/F
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3988-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2604 3hnbtn.exe 3964 jjdvp.exe 4724 lrxfxrf.exe 4736 lffxlff.exe 3260 nbhhtn.exe 3620 1hhthh.exe 4428 djpdp.exe 2528 xlrrlff.exe 864 nbhhnn.exe 5016 pvvpp.exe 4828 fllllfx.exe 4644 nhbnbn.exe 2972 5vvpj.exe 2296 bbbtnn.exe 3992 3nhtbt.exe 2944 pjdvj.exe 1844 tbhtnn.exe 2952 djdvp.exe 4508 tbhbtn.exe 4060 vdjjd.exe 4500 3xffxxl.exe 2712 1fxrfxx.exe 1564 nhbbnn.exe 876 7nhbnn.exe 4976 vppjv.exe 4760 1bhbbb.exe 3488 jdpdv.exe 984 fffrlfx.exe 4404 nnnnhb.exe 4892 nbhhbt.exe 1480 5nnhtt.exe 2804 vvvpj.exe 1504 lxxrfxr.exe 5060 tnttnh.exe 3620 dvvpd.exe 3960 vjjvj.exe 2708 3flxfxf.exe 2688 httnbb.exe 4036 bbnhbt.exe 4632 7vpdv.exe 3032 dpjvp.exe 3440 5rrfxrl.exe 3668 3tnhbt.exe 5016 bhnbbt.exe 4828 1ppdj.exe 2768 xxrfxlf.exe 2784 rffrlfx.exe 5104 3ttnhb.exe 2416 7ntnhn.exe 2404 jvvvv.exe 2332 1jjpj.exe 3876 rrrlrrl.exe 1596 tbtttt.exe 3464 thtnnt.exe 2952 pdjdd.exe 1808 jddvv.exe 1940 rlrfffr.exe 3708 tnnhbb.exe 796 bbbttt.exe 4928 pvppp.exe 2144 jjddv.exe 1540 rlrrlrr.exe 4976 xfrxxxx.exe 5012 9htbnt.exe -
resource yara_rule behavioral2/memory/3988-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3988 wrote to memory of 2604 3988 b58fff930e892b84635f2a3054693a70N.exe 86 PID 3988 wrote to memory of 2604 3988 b58fff930e892b84635f2a3054693a70N.exe 86 PID 3988 wrote to memory of 2604 3988 b58fff930e892b84635f2a3054693a70N.exe 86 PID 2604 wrote to memory of 3964 2604 3hnbtn.exe 87 PID 2604 wrote to memory of 3964 2604 3hnbtn.exe 87 PID 2604 wrote to memory of 3964 2604 3hnbtn.exe 87 PID 3964 wrote to memory of 4724 3964 jjdvp.exe 88 PID 3964 wrote to memory of 4724 3964 jjdvp.exe 88 PID 3964 wrote to memory of 4724 3964 jjdvp.exe 88 PID 4724 wrote to memory of 4736 4724 lrxfxrf.exe 89 PID 4724 wrote to memory of 4736 4724 lrxfxrf.exe 89 PID 4724 wrote to memory of 4736 4724 lrxfxrf.exe 89 PID 4736 wrote to memory of 3260 4736 lffxlff.exe 90 PID 4736 wrote to memory of 3260 4736 lffxlff.exe 90 PID 4736 wrote to memory of 3260 4736 lffxlff.exe 90 PID 3260 wrote to memory of 3620 3260 nbhhtn.exe 91 PID 3260 wrote to memory of 3620 3260 nbhhtn.exe 91 PID 3260 wrote to memory of 3620 3260 nbhhtn.exe 91 PID 3620 wrote to memory of 4428 3620 1hhthh.exe 92 PID 3620 wrote to memory of 4428 3620 1hhthh.exe 92 PID 3620 wrote to memory of 4428 3620 1hhthh.exe 92 PID 4428 wrote to memory of 2528 4428 djpdp.exe 93 PID 4428 wrote to memory of 2528 4428 djpdp.exe 93 PID 4428 wrote to memory of 2528 4428 djpdp.exe 93 PID 2528 wrote to memory of 864 2528 xlrrlff.exe 94 PID 2528 wrote to memory of 864 2528 xlrrlff.exe 94 PID 2528 wrote to memory of 864 2528 xlrrlff.exe 94 PID 864 wrote to memory of 5016 864 nbhhnn.exe 95 PID 864 wrote to memory of 5016 864 nbhhnn.exe 95 PID 864 wrote to memory of 5016 864 nbhhnn.exe 95 PID 5016 wrote to memory of 4828 5016 pvvpp.exe 96 PID 5016 wrote to memory of 4828 5016 pvvpp.exe 96 PID 5016 wrote to memory of 4828 5016 pvvpp.exe 96 PID 4828 wrote to memory of 4644 4828 fllllfx.exe 97 PID 4828 wrote to memory of 4644 4828 fllllfx.exe 97 PID 4828 wrote to memory of 4644 4828 fllllfx.exe 97 PID 4644 wrote to memory of 2972 4644 nhbnbn.exe 98 PID 4644 wrote to memory of 2972 4644 nhbnbn.exe 98 PID 4644 wrote to memory of 2972 4644 nhbnbn.exe 98 PID 2972 wrote to memory of 2296 2972 5vvpj.exe 99 PID 2972 wrote to memory of 2296 2972 5vvpj.exe 99 PID 2972 wrote to memory of 2296 2972 5vvpj.exe 99 PID 2296 wrote to memory of 3992 2296 bbbtnn.exe 100 PID 2296 wrote to memory of 3992 2296 bbbtnn.exe 100 PID 2296 wrote to memory of 3992 2296 bbbtnn.exe 100 PID 3992 wrote to memory of 2944 3992 3nhtbt.exe 101 PID 3992 wrote to memory of 2944 3992 3nhtbt.exe 101 PID 3992 wrote to memory of 2944 3992 3nhtbt.exe 101 PID 2944 wrote to memory of 1844 2944 pjdvj.exe 103 PID 2944 wrote to memory of 1844 2944 pjdvj.exe 103 PID 2944 wrote to memory of 1844 2944 pjdvj.exe 103 PID 1844 wrote to memory of 2952 1844 tbhtnn.exe 104 PID 1844 wrote to memory of 2952 1844 tbhtnn.exe 104 PID 1844 wrote to memory of 2952 1844 tbhtnn.exe 104 PID 2952 wrote to memory of 4508 2952 djdvp.exe 105 PID 2952 wrote to memory of 4508 2952 djdvp.exe 105 PID 2952 wrote to memory of 4508 2952 djdvp.exe 105 PID 4508 wrote to memory of 4060 4508 tbhbtn.exe 107 PID 4508 wrote to memory of 4060 4508 tbhbtn.exe 107 PID 4508 wrote to memory of 4060 4508 tbhbtn.exe 107 PID 4060 wrote to memory of 4500 4060 vdjjd.exe 108 PID 4060 wrote to memory of 4500 4060 vdjjd.exe 108 PID 4060 wrote to memory of 4500 4060 vdjjd.exe 108 PID 4500 wrote to memory of 2712 4500 3xffxxl.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58fff930e892b84635f2a3054693a70N.exe"C:\Users\Admin\AppData\Local\Temp\b58fff930e892b84635f2a3054693a70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\3hnbtn.exec:\3hnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jjdvp.exec:\jjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\lrxfxrf.exec:\lrxfxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\lffxlff.exec:\lffxlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\nbhhtn.exec:\nbhhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\1hhthh.exec:\1hhthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\djpdp.exec:\djpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\xlrrlff.exec:\xlrrlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nbhhnn.exec:\nbhhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\pvvpp.exec:\pvvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\fllllfx.exec:\fllllfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\nhbnbn.exec:\nhbnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\5vvpj.exec:\5vvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\bbbtnn.exec:\bbbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\3nhtbt.exec:\3nhtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\pjdvj.exec:\pjdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tbhtnn.exec:\tbhtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\djdvp.exec:\djdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\tbhbtn.exec:\tbhbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\vdjjd.exec:\vdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\3xffxxl.exec:\3xffxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\1fxrfxx.exec:\1fxrfxx.exe23⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhbbnn.exec:\nhbbnn.exe24⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7nhbnn.exec:\7nhbnn.exe25⤵
- Executes dropped EXE
PID:876 -
\??\c:\vppjv.exec:\vppjv.exe26⤵
- Executes dropped EXE
PID:4976 -
\??\c:\1bhbbb.exec:\1bhbbb.exe27⤵
- Executes dropped EXE
PID:4760 -
\??\c:\jdpdv.exec:\jdpdv.exe28⤵
- Executes dropped EXE
PID:3488 -
\??\c:\fffrlfx.exec:\fffrlfx.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\nnnnhb.exec:\nnnnhb.exe30⤵
- Executes dropped EXE
PID:4404 -
\??\c:\nbhhbt.exec:\nbhhbt.exe31⤵
- Executes dropped EXE
PID:4892 -
\??\c:\5nnhtt.exec:\5nnhtt.exe32⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vvvpj.exec:\vvvpj.exe33⤵
- Executes dropped EXE
PID:2804 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe34⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tnttnh.exec:\tnttnh.exe35⤵
- Executes dropped EXE
PID:5060 -
\??\c:\dvvpd.exec:\dvvpd.exe36⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vjjvj.exec:\vjjvj.exe37⤵
- Executes dropped EXE
PID:3960 -
\??\c:\3flxfxf.exec:\3flxfxf.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\httnbb.exec:\httnbb.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bbnhbt.exec:\bbnhbt.exe40⤵
- Executes dropped EXE
PID:4036 -
\??\c:\7vpdv.exec:\7vpdv.exe41⤵
- Executes dropped EXE
PID:4632 -
\??\c:\dpjvp.exec:\dpjvp.exe42⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5rrfxrl.exec:\5rrfxrl.exe43⤵
- Executes dropped EXE
PID:3440 -
\??\c:\3tnhbt.exec:\3tnhbt.exe44⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bhnbbt.exec:\bhnbbt.exe45⤵
- Executes dropped EXE
PID:5016 -
\??\c:\1ppdj.exec:\1ppdj.exe46⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xxrfxlf.exec:\xxrfxlf.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rffrlfx.exec:\rffrlfx.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\3ttnhb.exec:\3ttnhb.exe49⤵
- Executes dropped EXE
PID:5104 -
\??\c:\7ntnhn.exec:\7ntnhn.exe50⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jvvvv.exec:\jvvvv.exe51⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1jjpj.exec:\1jjpj.exe52⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rrrlrrl.exec:\rrrlrrl.exe53⤵
- Executes dropped EXE
PID:3876 -
\??\c:\tbtttt.exec:\tbtttt.exe54⤵
- Executes dropped EXE
PID:1596 -
\??\c:\thtnnt.exec:\thtnnt.exe55⤵
- Executes dropped EXE
PID:3464 -
\??\c:\pdjdd.exec:\pdjdd.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jddvv.exec:\jddvv.exe57⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rlrfffr.exec:\rlrfffr.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tnnhbb.exec:\tnnhbb.exe59⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bbbttt.exec:\bbbttt.exe60⤵
- Executes dropped EXE
PID:796 -
\??\c:\pvppp.exec:\pvppp.exe61⤵
- Executes dropped EXE
PID:4928 -
\??\c:\jjddv.exec:\jjddv.exe62⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xfrxxxx.exec:\xfrxxxx.exe64⤵
- Executes dropped EXE
PID:4976 -
\??\c:\9htbnt.exec:\9htbnt.exe65⤵
- Executes dropped EXE
PID:5012 -
\??\c:\dvjpp.exec:\dvjpp.exe66⤵PID:1288
-
\??\c:\pvddd.exec:\pvddd.exe67⤵PID:3868
-
\??\c:\lfllrxf.exec:\lfllrxf.exe68⤵PID:4452
-
\??\c:\lxffxxx.exec:\lxffxxx.exe69⤵PID:4912
-
\??\c:\nhtttt.exec:\nhtttt.exe70⤵PID:4312
-
\??\c:\djvpj.exec:\djvpj.exe71⤵PID:2816
-
\??\c:\vjddv.exec:\vjddv.exe72⤵PID:4708
-
\??\c:\flrlfll.exec:\flrlfll.exe73⤵PID:1480
-
\??\c:\lrllflf.exec:\lrllflf.exe74⤵PID:1640
-
\??\c:\hhhhnh.exec:\hhhhnh.exe75⤵PID:2804
-
\??\c:\5bhbbb.exec:\5bhbbb.exe76⤵
- System Location Discovery: System Language Discovery
PID:4736 -
\??\c:\pjvvp.exec:\pjvvp.exe77⤵PID:1624
-
\??\c:\9rflfrr.exec:\9rflfrr.exe78⤵PID:4288
-
\??\c:\xffffll.exec:\xffffll.exe79⤵PID:5028
-
\??\c:\hnnttt.exec:\hnnttt.exe80⤵PID:1824
-
\??\c:\1nnhbb.exec:\1nnhbb.exe81⤵PID:1868
-
\??\c:\vddvd.exec:\vddvd.exe82⤵PID:2112
-
\??\c:\rfrllll.exec:\rfrllll.exe83⤵PID:1568
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe84⤵PID:3160
-
\??\c:\9nbtbb.exec:\9nbtbb.exe85⤵PID:4516
-
\??\c:\vvddv.exec:\vvddv.exe86⤵PID:3440
-
\??\c:\pddvj.exec:\pddvj.exe87⤵PID:2152
-
\??\c:\lxllrlx.exec:\lxllrlx.exe88⤵PID:3164
-
\??\c:\ttbtnh.exec:\ttbtnh.exe89⤵PID:3596
-
\??\c:\vpddv.exec:\vpddv.exe90⤵PID:2348
-
\??\c:\vddvv.exec:\vddvv.exe91⤵PID:5008
-
\??\c:\fxxllfx.exec:\fxxllfx.exe92⤵PID:2780
-
\??\c:\1nthhh.exec:\1nthhh.exe93⤵PID:3992
-
\??\c:\nhnhbb.exec:\nhnhbb.exe94⤵PID:64
-
\??\c:\7jjvj.exec:\7jjvj.exe95⤵PID:4620
-
\??\c:\rlrlllf.exec:\rlrlllf.exe96⤵PID:4836
-
\??\c:\5hhhbb.exec:\5hhhbb.exe97⤵PID:3544
-
\??\c:\vvdvd.exec:\vvdvd.exe98⤵PID:844
-
\??\c:\dvddv.exec:\dvddv.exe99⤵PID:2188
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe100⤵PID:4060
-
\??\c:\rxffxff.exec:\rxffxff.exe101⤵PID:1908
-
\??\c:\nnnbtt.exec:\nnnbtt.exe102⤵PID:4192
-
\??\c:\dvjvp.exec:\dvjvp.exe103⤵PID:1548
-
\??\c:\ddddd.exec:\ddddd.exe104⤵PID:4776
-
\??\c:\llrllff.exec:\llrllff.exe105⤵PID:1236
-
\??\c:\xfllrff.exec:\xfllrff.exe106⤵PID:4280
-
\??\c:\3bbtnt.exec:\3bbtnt.exe107⤵PID:3088
-
\??\c:\vpvjd.exec:\vpvjd.exe108⤵PID:3592
-
\??\c:\ddppv.exec:\ddppv.exe109⤵PID:4400
-
\??\c:\7frlfff.exec:\7frlfff.exe110⤵PID:3840
-
\??\c:\9fflffr.exec:\9fflffr.exe111⤵PID:2168
-
\??\c:\vjjdv.exec:\vjjdv.exe112⤵PID:212
-
\??\c:\rlrlllf.exec:\rlrlllf.exe113⤵PID:1524
-
\??\c:\tthntt.exec:\tthntt.exe114⤵PID:4136
-
\??\c:\pvjdd.exec:\pvjdd.exe115⤵PID:1228
-
\??\c:\pjddj.exec:\pjddj.exe116⤵PID:4804
-
\??\c:\llrrxlr.exec:\llrrxlr.exe117⤵PID:4692
-
\??\c:\btbbbb.exec:\btbbbb.exe118⤵PID:4636
-
\??\c:\nhttnn.exec:\nhttnn.exe119⤵PID:4156
-
\??\c:\jjpjj.exec:\jjpjj.exe120⤵PID:4880
-
\??\c:\dpjjd.exec:\dpjjd.exe121⤵PID:3396
-
\??\c:\lxrrlll.exec:\lxrrlll.exe122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-