Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f43f5d72e2322d16d457edb072823c0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
7f43f5d72e2322d16d457edb072823c0N.exe
-
Size
366KB
-
MD5
7f43f5d72e2322d16d457edb072823c0
-
SHA1
830e208c3004fe63e5ffae1bf7f3181c3f260474
-
SHA256
da10c5b6c363461a8373dbe38c2d8313917533d4ad6da5573627894573caa3b4
-
SHA512
672c9fbaf0e26ddc0e8d99290cc15957c9f3a2b4acafd6db7ac72a0ebf863fe90329f39d95d74aefaf9b49fc56555cf46b4962dd2d388a4d9347b94e8434ae76
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjD8296gnzeZhBul:n3C9ytvngQj429nnzeZhBq
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2604-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5024 pppjd.exe 3152 w28266.exe 992 lxfxxxr.exe 2420 ffffllr.exe 3580 jdvpd.exe 3132 6448088.exe 968 jdvpj.exe 3992 bnthbt.exe 2320 04824.exe 4880 2466000.exe 2092 42088.exe 1700 622082.exe 768 c242604.exe 3056 0862468.exe 3000 488046.exe 4748 260444.exe 2524 jvvjv.exe 1332 6608024.exe 4924 rlrrfff.exe 2704 jpvdd.exe 2720 84226.exe 3572 0442604.exe 2960 604666.exe 3636 pdddd.exe 844 4844888.exe 3524 jddvp.exe 3712 jjddd.exe 1464 vpvpp.exe 816 84444.exe 404 00262.exe 4052 flxflxf.exe 3516 u282622.exe 2024 rrrrrrr.exe 5088 4240622.exe 3956 dpdvv.exe 2912 086628.exe 4472 rffxffx.exe 3912 hbntbh.exe 3200 a8048.exe 4300 260468.exe 2300 thntth.exe 760 624428.exe 1936 rfrlflx.exe 5116 3rfxxrx.exe 1940 5tnttb.exe 2524 6424802.exe 2104 vvvvv.exe 1332 fxxrrll.exe 4020 3hnhnn.exe 3076 lffxxrr.exe 4376 g8006.exe 184 rflffxf.exe 556 dpvpv.exe 2280 8248266.exe 5004 rllrrrl.exe 5024 rlxrfxl.exe 5012 264624.exe 3644 jdvvv.exe 2420 hnhhnh.exe 1464 080444.exe 1452 844822.exe 2032 bbhhtt.exe 3616 ffllxrr.exe 2020 2424062.exe -
resource yara_rule behavioral2/memory/2604-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w04860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0466266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8202080.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0426828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6404488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 040444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k06200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 5024 2604 7f43f5d72e2322d16d457edb072823c0N.exe 91 PID 2604 wrote to memory of 5024 2604 7f43f5d72e2322d16d457edb072823c0N.exe 91 PID 2604 wrote to memory of 5024 2604 7f43f5d72e2322d16d457edb072823c0N.exe 91 PID 5024 wrote to memory of 3152 5024 pppjd.exe 92 PID 5024 wrote to memory of 3152 5024 pppjd.exe 92 PID 5024 wrote to memory of 3152 5024 pppjd.exe 92 PID 3152 wrote to memory of 992 3152 w28266.exe 93 PID 3152 wrote to memory of 992 3152 w28266.exe 93 PID 3152 wrote to memory of 992 3152 w28266.exe 93 PID 992 wrote to memory of 2420 992 lxfxxxr.exe 94 PID 992 wrote to memory of 2420 992 lxfxxxr.exe 94 PID 992 wrote to memory of 2420 992 lxfxxxr.exe 94 PID 2420 wrote to memory of 3580 2420 ffffllr.exe 95 PID 2420 wrote to memory of 3580 2420 ffffllr.exe 95 PID 2420 wrote to memory of 3580 2420 ffffllr.exe 95 PID 3580 wrote to memory of 3132 3580 jdvpd.exe 96 PID 3580 wrote to memory of 3132 3580 jdvpd.exe 96 PID 3580 wrote to memory of 3132 3580 jdvpd.exe 96 PID 3132 wrote to memory of 968 3132 6448088.exe 97 PID 3132 wrote to memory of 968 3132 6448088.exe 97 PID 3132 wrote to memory of 968 3132 6448088.exe 97 PID 968 wrote to memory of 3992 968 jdvpj.exe 98 PID 968 wrote to memory of 3992 968 jdvpj.exe 98 PID 968 wrote to memory of 3992 968 jdvpj.exe 98 PID 3992 wrote to memory of 2320 3992 bnthbt.exe 99 PID 3992 wrote to memory of 2320 3992 bnthbt.exe 99 PID 3992 wrote to memory of 2320 3992 bnthbt.exe 99 PID 2320 wrote to memory of 4880 2320 04824.exe 100 PID 2320 wrote to memory of 4880 2320 04824.exe 100 PID 2320 wrote to memory of 4880 2320 04824.exe 100 PID 4880 wrote to memory of 2092 4880 2466000.exe 101 PID 4880 wrote to memory of 2092 4880 2466000.exe 101 PID 4880 wrote to memory of 2092 4880 2466000.exe 101 PID 2092 wrote to memory of 1700 2092 42088.exe 102 PID 2092 wrote to memory of 1700 2092 42088.exe 102 PID 2092 wrote to memory of 1700 2092 42088.exe 102 PID 1700 wrote to memory of 768 1700 622082.exe 103 PID 1700 wrote to memory of 768 1700 622082.exe 103 PID 1700 wrote to memory of 768 1700 622082.exe 103 PID 768 wrote to memory of 3056 768 c242604.exe 105 PID 768 wrote to memory of 3056 768 c242604.exe 105 PID 768 wrote to memory of 3056 768 c242604.exe 105 PID 3056 wrote to memory of 3000 3056 0862468.exe 106 PID 3056 wrote to memory of 3000 3056 0862468.exe 106 PID 3056 wrote to memory of 3000 3056 0862468.exe 106 PID 3000 wrote to memory of 4748 3000 488046.exe 108 PID 3000 wrote to memory of 4748 3000 488046.exe 108 PID 3000 wrote to memory of 4748 3000 488046.exe 108 PID 4748 wrote to memory of 2524 4748 260444.exe 139 PID 4748 wrote to memory of 2524 4748 260444.exe 139 PID 4748 wrote to memory of 2524 4748 260444.exe 139 PID 2524 wrote to memory of 1332 2524 jvvjv.exe 110 PID 2524 wrote to memory of 1332 2524 jvvjv.exe 110 PID 2524 wrote to memory of 1332 2524 jvvjv.exe 110 PID 1332 wrote to memory of 4924 1332 6608024.exe 112 PID 1332 wrote to memory of 4924 1332 6608024.exe 112 PID 1332 wrote to memory of 4924 1332 6608024.exe 112 PID 4924 wrote to memory of 2704 4924 rlrrfff.exe 113 PID 4924 wrote to memory of 2704 4924 rlrrfff.exe 113 PID 4924 wrote to memory of 2704 4924 rlrrfff.exe 113 PID 2704 wrote to memory of 2720 2704 jpvdd.exe 114 PID 2704 wrote to memory of 2720 2704 jpvdd.exe 114 PID 2704 wrote to memory of 2720 2704 jpvdd.exe 114 PID 2720 wrote to memory of 3572 2720 84226.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f43f5d72e2322d16d457edb072823c0N.exe"C:\Users\Admin\AppData\Local\Temp\7f43f5d72e2322d16d457edb072823c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pppjd.exec:\pppjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\w28266.exec:\w28266.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\ffffllr.exec:\ffffllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\jdvpd.exec:\jdvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\6448088.exec:\6448088.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\jdvpj.exec:\jdvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\bnthbt.exec:\bnthbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\04824.exec:\04824.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\2466000.exec:\2466000.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\42088.exec:\42088.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\622082.exec:\622082.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\c242604.exec:\c242604.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\0862468.exec:\0862468.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\488046.exec:\488046.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\260444.exec:\260444.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\jvvjv.exec:\jvvjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\6608024.exec:\6608024.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\rlrrfff.exec:\rlrrfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\jpvdd.exec:\jpvdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\84226.exec:\84226.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\0442604.exec:\0442604.exe23⤵
- Executes dropped EXE
PID:3572 -
\??\c:\604666.exec:\604666.exe24⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pdddd.exec:\pdddd.exe25⤵
- Executes dropped EXE
PID:3636 -
\??\c:\4844888.exec:\4844888.exe26⤵
- Executes dropped EXE
PID:844 -
\??\c:\jddvp.exec:\jddvp.exe27⤵
- Executes dropped EXE
PID:3524 -
\??\c:\jjddd.exec:\jjddd.exe28⤵
- Executes dropped EXE
PID:3712 -
\??\c:\vpvpp.exec:\vpvpp.exe29⤵
- Executes dropped EXE
PID:1464 -
\??\c:\84444.exec:\84444.exe30⤵
- Executes dropped EXE
PID:816 -
\??\c:\00262.exec:\00262.exe31⤵
- Executes dropped EXE
PID:404 -
\??\c:\flxflxf.exec:\flxflxf.exe32⤵
- Executes dropped EXE
PID:4052 -
\??\c:\u282622.exec:\u282622.exe33⤵
- Executes dropped EXE
PID:3516 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\4240622.exec:\4240622.exe35⤵
- Executes dropped EXE
PID:5088 -
\??\c:\dpdvv.exec:\dpdvv.exe36⤵
- Executes dropped EXE
PID:3956 -
\??\c:\086628.exec:\086628.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rffxffx.exec:\rffxffx.exe38⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hbntbh.exec:\hbntbh.exe39⤵
- Executes dropped EXE
PID:3912 -
\??\c:\a8048.exec:\a8048.exe40⤵
- Executes dropped EXE
PID:3200 -
\??\c:\260468.exec:\260468.exe41⤵
- Executes dropped EXE
PID:4300 -
\??\c:\thntth.exec:\thntth.exe42⤵
- Executes dropped EXE
PID:2300 -
\??\c:\624428.exec:\624428.exe43⤵
- Executes dropped EXE
PID:760 -
\??\c:\rfrlflx.exec:\rfrlflx.exe44⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3rfxxrx.exec:\3rfxxrx.exe45⤵
- Executes dropped EXE
PID:5116 -
\??\c:\5tnttb.exec:\5tnttb.exe46⤵
- Executes dropped EXE
PID:1940 -
\??\c:\6424802.exec:\6424802.exe47⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vvvvv.exec:\vvvvv.exe48⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fxxrrll.exec:\fxxrrll.exe49⤵
- Executes dropped EXE
PID:1332 -
\??\c:\3hnhnn.exec:\3hnhnn.exe50⤵
- Executes dropped EXE
PID:4020 -
\??\c:\lffxxrr.exec:\lffxxrr.exe51⤵
- Executes dropped EXE
PID:3076 -
\??\c:\g8006.exec:\g8006.exe52⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rflffxf.exec:\rflffxf.exe53⤵
- Executes dropped EXE
PID:184 -
\??\c:\dpvpv.exec:\dpvpv.exe54⤵
- Executes dropped EXE
PID:556 -
\??\c:\8248266.exec:\8248266.exe55⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rllrrrl.exec:\rllrrrl.exe56⤵
- Executes dropped EXE
PID:5004 -
\??\c:\rlxrfxl.exec:\rlxrfxl.exe57⤵
- Executes dropped EXE
PID:5024 -
\??\c:\264624.exec:\264624.exe58⤵
- Executes dropped EXE
PID:5012 -
\??\c:\jdvvv.exec:\jdvvv.exe59⤵
- Executes dropped EXE
PID:3644 -
\??\c:\hnhhnh.exec:\hnhhnh.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420 -
\??\c:\080444.exec:\080444.exe61⤵
- Executes dropped EXE
PID:1464 -
\??\c:\844822.exec:\844822.exe62⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbhhtt.exec:\bbhhtt.exe63⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ffllxrr.exec:\ffllxrr.exe64⤵
- Executes dropped EXE
PID:3616 -
\??\c:\2424062.exec:\2424062.exe65⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vpvvv.exec:\vpvvv.exe66⤵PID:400
-
\??\c:\c684822.exec:\c684822.exe67⤵PID:4876
-
\??\c:\4280460.exec:\4280460.exe68⤵PID:452
-
\??\c:\tthbbb.exec:\tthbbb.exe69⤵PID:4332
-
\??\c:\rflxffx.exec:\rflxffx.exe70⤵PID:4932
-
\??\c:\thtnhh.exec:\thtnhh.exe71⤵PID:648
-
\??\c:\628246.exec:\628246.exe72⤵PID:4700
-
\??\c:\66042.exec:\66042.exe73⤵PID:2328
-
\??\c:\62482.exec:\62482.exe74⤵PID:3996
-
\??\c:\428600.exec:\428600.exe75⤵PID:3660
-
\??\c:\jdvjd.exec:\jdvjd.exe76⤵PID:3944
-
\??\c:\pjvpd.exec:\pjvpd.exe77⤵PID:5072
-
\??\c:\nbhhbh.exec:\nbhhbh.exe78⤵PID:3004
-
\??\c:\7bnntt.exec:\7bnntt.exe79⤵PID:4656
-
\??\c:\htbthb.exec:\htbthb.exe80⤵PID:1440
-
\??\c:\i626004.exec:\i626004.exe81⤵PID:4904
-
\??\c:\628866.exec:\628866.exe82⤵PID:1536
-
\??\c:\xlrrrll.exec:\xlrrrll.exe83⤵PID:2268
-
\??\c:\6004260.exec:\6004260.exe84⤵PID:2592
-
\??\c:\s6042.exec:\s6042.exe85⤵PID:1592
-
\??\c:\26408.exec:\26408.exe86⤵PID:1688
-
\??\c:\xlllllf.exec:\xlllllf.exe87⤵PID:2316
-
\??\c:\bnnhtt.exec:\bnnhtt.exe88⤵PID:1796
-
\??\c:\jjvjj.exec:\jjvjj.exe89⤵PID:628
-
\??\c:\688204.exec:\688204.exe90⤵PID:3284
-
\??\c:\64880.exec:\64880.exe91⤵PID:3988
-
\??\c:\lxrffxr.exec:\lxrffxr.exe92⤵PID:3132
-
\??\c:\2662006.exec:\2662006.exe93⤵PID:4536
-
\??\c:\648204.exec:\648204.exe94⤵PID:2680
-
\??\c:\2862248.exec:\2862248.exe95⤵PID:1504
-
\??\c:\nhhbtn.exec:\nhhbtn.exe96⤵PID:2488
-
\??\c:\8460404.exec:\8460404.exe97⤵PID:4880
-
\??\c:\vpjdv.exec:\vpjdv.exe98⤵PID:4036
-
\??\c:\48266.exec:\48266.exe99⤵PID:3060
-
\??\c:\fllxrrx.exec:\fllxrrx.exe100⤵PID:1664
-
\??\c:\0622682.exec:\0622682.exe101⤵PID:1808
-
\??\c:\vpdjj.exec:\vpdjj.exe102⤵PID:3500
-
\??\c:\6826082.exec:\6826082.exe103⤵PID:4300
-
\??\c:\426084.exec:\426084.exe104⤵PID:1544
-
\??\c:\822626.exec:\822626.exe105⤵PID:3000
-
\??\c:\06226.exec:\06226.exe106⤵PID:2828
-
\??\c:\42048.exec:\42048.exe107⤵PID:1296
-
\??\c:\ttbnhn.exec:\ttbnhn.exe108⤵PID:2524
-
\??\c:\flrlrlx.exec:\flrlrlx.exe109⤵PID:2104
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe110⤵
- System Location Discovery: System Language Discovery
PID:2100 -
\??\c:\9hnhhh.exec:\9hnhhh.exe111⤵PID:2036
-
\??\c:\w46648.exec:\w46648.exe112⤵PID:4160
-
\??\c:\pvpvd.exec:\pvpvd.exe113⤵PID:640
-
\??\c:\rllxlfx.exec:\rllxlfx.exe114⤵PID:1880
-
\??\c:\8680660.exec:\8680660.exe115⤵PID:1688
-
\??\c:\6002688.exec:\6002688.exe116⤵PID:3444
-
\??\c:\hbttnh.exec:\hbttnh.exe117⤵PID:3712
-
\??\c:\862644.exec:\862644.exe118⤵PID:2416
-
\??\c:\lflflll.exec:\lflflll.exe119⤵PID:3516
-
\??\c:\tnbntn.exec:\tnbntn.exe120⤵PID:3256
-
\??\c:\rllfrlf.exec:\rllfrlf.exe121⤵PID:5088
-
\??\c:\thnbtn.exec:\thnbtn.exe122⤵PID:4580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-