Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7f88c32a84d0749d4bd5a9a45e8d150N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
c7f88c32a84d0749d4bd5a9a45e8d150N.exe
-
Size
93KB
-
MD5
c7f88c32a84d0749d4bd5a9a45e8d150
-
SHA1
77538844c4dd3b3c7d36b5981b3103b09bf331ff
-
SHA256
de82ce87a4bc0524ff90e1dc9ee8ff43d152208150d8d119dbc1621a268fc385
-
SHA512
343c3b1f687653f2b4bbf9d4dc4752bbe56b6ff983c075a875950a570a4839e8d361f580da0b070b8dd899a2faa4752cdc44a473efe84809566e8f8700bf72f2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xQ5z:ymb3NkkiQ3mdBjF+3TU20LQR
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1808-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2116 bhhtnn.exe 4432 pjpdd.exe 4900 flrlffx.exe 3044 rxlrlll.exe 536 dvvvp.exe 5040 7djdp.exe 448 rffrllr.exe 1732 vjdvd.exe 4408 llxrllf.exe 4440 frxrrrr.exe 1288 thhbtn.exe 856 pvvvp.exe 3280 jvvpv.exe 4492 xrrllll.exe 3124 jddvp.exe 4564 3lffxff.exe 2956 bbhbhn.exe 2580 pppvp.exe 4652 ddvpj.exe 4756 xlxrffx.exe 2656 9lrlfxr.exe 4468 bnttnh.exe 1524 dvdpd.exe 4416 jdvdd.exe 3600 lxlffll.exe 5068 hhbbtt.exe 1016 htbnht.exe 4320 pvpdv.exe 4288 5flrlll.exe 3148 1frfxrr.exe 2244 tnhbtn.exe 2128 ppjvp.exe 864 rlrlxrl.exe 4456 ttbttn.exe 916 hntnbb.exe 5080 jdvpv.exe 4432 jvvpd.exe 1792 rfrlxxr.exe 548 nnnnhh.exe 4404 7hbbtt.exe 4928 jpjdv.exe 2004 xxxxxfx.exe 1104 xllfflr.exe 5028 nbbbhb.exe 2164 1tbnhh.exe 1680 xllfxrl.exe 1216 rlfrllf.exe 2496 nhhbtt.exe 2240 bnhhbb.exe 1312 pjppd.exe 3280 7vppj.exe 2376 llrxrrr.exe 844 fxllfff.exe 3124 7htbtt.exe 4564 thhhht.exe 4604 7vjpp.exe 1292 pvvjd.exe 3164 rffxxrx.exe 1488 nhhhbh.exe 4804 tbtttt.exe 2656 pjppj.exe 4468 ddppd.exe 1584 rrlllxl.exe 3496 lllllrr.exe -
resource yara_rule behavioral2/memory/1808-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2116 1808 c7f88c32a84d0749d4bd5a9a45e8d150N.exe 84 PID 1808 wrote to memory of 2116 1808 c7f88c32a84d0749d4bd5a9a45e8d150N.exe 84 PID 1808 wrote to memory of 2116 1808 c7f88c32a84d0749d4bd5a9a45e8d150N.exe 84 PID 2116 wrote to memory of 4432 2116 bhhtnn.exe 85 PID 2116 wrote to memory of 4432 2116 bhhtnn.exe 85 PID 2116 wrote to memory of 4432 2116 bhhtnn.exe 85 PID 4432 wrote to memory of 4900 4432 pjpdd.exe 86 PID 4432 wrote to memory of 4900 4432 pjpdd.exe 86 PID 4432 wrote to memory of 4900 4432 pjpdd.exe 86 PID 4900 wrote to memory of 3044 4900 flrlffx.exe 87 PID 4900 wrote to memory of 3044 4900 flrlffx.exe 87 PID 4900 wrote to memory of 3044 4900 flrlffx.exe 87 PID 3044 wrote to memory of 536 3044 rxlrlll.exe 88 PID 3044 wrote to memory of 536 3044 rxlrlll.exe 88 PID 3044 wrote to memory of 536 3044 rxlrlll.exe 88 PID 536 wrote to memory of 5040 536 dvvvp.exe 89 PID 536 wrote to memory of 5040 536 dvvvp.exe 89 PID 536 wrote to memory of 5040 536 dvvvp.exe 89 PID 5040 wrote to memory of 448 5040 7djdp.exe 90 PID 5040 wrote to memory of 448 5040 7djdp.exe 90 PID 5040 wrote to memory of 448 5040 7djdp.exe 90 PID 448 wrote to memory of 1732 448 rffrllr.exe 91 PID 448 wrote to memory of 1732 448 rffrllr.exe 91 PID 448 wrote to memory of 1732 448 rffrllr.exe 91 PID 1732 wrote to memory of 4408 1732 vjdvd.exe 92 PID 1732 wrote to memory of 4408 1732 vjdvd.exe 92 PID 1732 wrote to memory of 4408 1732 vjdvd.exe 92 PID 4408 wrote to memory of 4440 4408 llxrllf.exe 93 PID 4408 wrote to memory of 4440 4408 llxrllf.exe 93 PID 4408 wrote to memory of 4440 4408 llxrllf.exe 93 PID 4440 wrote to memory of 1288 4440 frxrrrr.exe 94 PID 4440 wrote to memory of 1288 4440 frxrrrr.exe 94 PID 4440 wrote to memory of 1288 4440 frxrrrr.exe 94 PID 1288 wrote to memory of 856 1288 thhbtn.exe 95 PID 1288 wrote to memory of 856 1288 thhbtn.exe 95 PID 1288 wrote to memory of 856 1288 thhbtn.exe 95 PID 856 wrote to memory of 3280 856 pvvvp.exe 96 PID 856 wrote to memory of 3280 856 pvvvp.exe 96 PID 856 wrote to memory of 3280 856 pvvvp.exe 96 PID 3280 wrote to memory of 4492 3280 jvvpv.exe 97 PID 3280 wrote to memory of 4492 3280 jvvpv.exe 97 PID 3280 wrote to memory of 4492 3280 jvvpv.exe 97 PID 4492 wrote to memory of 3124 4492 xrrllll.exe 98 PID 4492 wrote to memory of 3124 4492 xrrllll.exe 98 PID 4492 wrote to memory of 3124 4492 xrrllll.exe 98 PID 3124 wrote to memory of 4564 3124 jddvp.exe 99 PID 3124 wrote to memory of 4564 3124 jddvp.exe 99 PID 3124 wrote to memory of 4564 3124 jddvp.exe 99 PID 4564 wrote to memory of 2956 4564 3lffxff.exe 100 PID 4564 wrote to memory of 2956 4564 3lffxff.exe 100 PID 4564 wrote to memory of 2956 4564 3lffxff.exe 100 PID 2956 wrote to memory of 2580 2956 bbhbhn.exe 101 PID 2956 wrote to memory of 2580 2956 bbhbhn.exe 101 PID 2956 wrote to memory of 2580 2956 bbhbhn.exe 101 PID 2580 wrote to memory of 4652 2580 pppvp.exe 102 PID 2580 wrote to memory of 4652 2580 pppvp.exe 102 PID 2580 wrote to memory of 4652 2580 pppvp.exe 102 PID 4652 wrote to memory of 4756 4652 ddvpj.exe 103 PID 4652 wrote to memory of 4756 4652 ddvpj.exe 103 PID 4652 wrote to memory of 4756 4652 ddvpj.exe 103 PID 4756 wrote to memory of 2656 4756 xlxrffx.exe 104 PID 4756 wrote to memory of 2656 4756 xlxrffx.exe 104 PID 4756 wrote to memory of 2656 4756 xlxrffx.exe 104 PID 2656 wrote to memory of 4468 2656 9lrlfxr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f88c32a84d0749d4bd5a9a45e8d150N.exe"C:\Users\Admin\AppData\Local\Temp\c7f88c32a84d0749d4bd5a9a45e8d150N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\bhhtnn.exec:\bhhtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\pjpdd.exec:\pjpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\flrlffx.exec:\flrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\rxlrlll.exec:\rxlrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\dvvvp.exec:\dvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\7djdp.exec:\7djdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\rffrllr.exec:\rffrllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vjdvd.exec:\vjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\llxrllf.exec:\llxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\frxrrrr.exec:\frxrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\thhbtn.exec:\thhbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\pvvvp.exec:\pvvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\jvvpv.exec:\jvvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\xrrllll.exec:\xrrllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\3lffxff.exec:\3lffxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\bbhbhn.exec:\bbhbhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pppvp.exec:\pppvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ddvpj.exec:\ddvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\xlxrffx.exec:\xlxrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\9lrlfxr.exec:\9lrlfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bnttnh.exec:\bnttnh.exe23⤵
- Executes dropped EXE
PID:4468 -
\??\c:\dvdpd.exec:\dvdpd.exe24⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jdvdd.exec:\jdvdd.exe25⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lxlffll.exec:\lxlffll.exe26⤵
- Executes dropped EXE
PID:3600 -
\??\c:\hhbbtt.exec:\hhbbtt.exe27⤵
- Executes dropped EXE
PID:5068 -
\??\c:\htbnht.exec:\htbnht.exe28⤵
- Executes dropped EXE
PID:1016 -
\??\c:\pvpdv.exec:\pvpdv.exe29⤵
- Executes dropped EXE
PID:4320 -
\??\c:\5flrlll.exec:\5flrlll.exe30⤵
- Executes dropped EXE
PID:4288 -
\??\c:\1frfxrr.exec:\1frfxrr.exe31⤵
- Executes dropped EXE
PID:3148 -
\??\c:\tnhbtn.exec:\tnhbtn.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ppjvp.exec:\ppjvp.exe33⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlrlxrl.exec:\rlrlxrl.exe34⤵
- Executes dropped EXE
PID:864 -
\??\c:\ttbttn.exec:\ttbttn.exe35⤵
- Executes dropped EXE
PID:4456 -
\??\c:\hntnbb.exec:\hntnbb.exe36⤵
- Executes dropped EXE
PID:916 -
\??\c:\jdvpv.exec:\jdvpv.exe37⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jvvpd.exec:\jvvpd.exe38⤵
- Executes dropped EXE
PID:4432 -
\??\c:\rfrlxxr.exec:\rfrlxxr.exe39⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nnnnhh.exec:\nnnnhh.exe40⤵
- Executes dropped EXE
PID:548 -
\??\c:\7hbbtt.exec:\7hbbtt.exe41⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jpjdv.exec:\jpjdv.exe42⤵
- Executes dropped EXE
PID:4928 -
\??\c:\xxxxxfx.exec:\xxxxxfx.exe43⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xllfflr.exec:\xllfflr.exe44⤵
- Executes dropped EXE
PID:1104 -
\??\c:\nbbbhb.exec:\nbbbhb.exe45⤵
- Executes dropped EXE
PID:5028 -
\??\c:\1tbnhh.exec:\1tbnhh.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xllfxrl.exec:\xllfxrl.exe47⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rlfrllf.exec:\rlfrllf.exe48⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nhhbtt.exec:\nhhbtt.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bnhhbb.exec:\bnhhbb.exe50⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pjppd.exec:\pjppd.exe51⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7vppj.exec:\7vppj.exe52⤵
- Executes dropped EXE
PID:3280 -
\??\c:\llrxrrr.exec:\llrxrrr.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fxllfff.exec:\fxllfff.exe54⤵
- Executes dropped EXE
PID:844 -
\??\c:\7htbtt.exec:\7htbtt.exe55⤵
- Executes dropped EXE
PID:3124 -
\??\c:\thhhht.exec:\thhhht.exe56⤵
- Executes dropped EXE
PID:4564 -
\??\c:\7vjpp.exec:\7vjpp.exe57⤵
- Executes dropped EXE
PID:4604 -
\??\c:\pvvjd.exec:\pvvjd.exe58⤵
- Executes dropped EXE
PID:1292 -
\??\c:\rffxxrx.exec:\rffxxrx.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164 -
\??\c:\nhhhbh.exec:\nhhhbh.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tbtttt.exec:\tbtttt.exe61⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pjppj.exec:\pjppj.exe62⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ddppd.exec:\ddppd.exe63⤵
- Executes dropped EXE
PID:4468 -
\??\c:\rrlllxl.exec:\rrlllxl.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lllllrr.exec:\lllllrr.exe65⤵
- Executes dropped EXE
PID:3496 -
\??\c:\bhbtbb.exec:\bhbtbb.exe66⤵PID:2220
-
\??\c:\bnttnh.exec:\bnttnh.exe67⤵PID:4776
-
\??\c:\jjdvd.exec:\jjdvd.exe68⤵PID:2372
-
\??\c:\dvdjj.exec:\dvdjj.exe69⤵PID:4896
-
\??\c:\xrlllll.exec:\xrlllll.exe70⤵PID:2416
-
\??\c:\xlllflf.exec:\xlllflf.exe71⤵PID:2140
-
\??\c:\nbhhhh.exec:\nbhhhh.exe72⤵PID:4288
-
\??\c:\bbbbbb.exec:\bbbbbb.exe73⤵PID:4704
-
\??\c:\dvdpp.exec:\dvdpp.exe74⤵PID:3688
-
\??\c:\dvjjj.exec:\dvjjj.exe75⤵PID:800
-
\??\c:\xrlrrfr.exec:\xrlrrfr.exe76⤵PID:512
-
\??\c:\lrxxxfx.exec:\lrxxxfx.exe77⤵PID:3060
-
\??\c:\7bnntb.exec:\7bnntb.exe78⤵PID:184
-
\??\c:\ttnnhh.exec:\ttnnhh.exe79⤵PID:1452
-
\??\c:\dpdvp.exec:\dpdvp.exe80⤵PID:5100
-
\??\c:\jdjdd.exec:\jdjdd.exe81⤵PID:2492
-
\??\c:\frxxrrr.exec:\frxxrrr.exe82⤵PID:2188
-
\??\c:\tthbtt.exec:\tthbtt.exe83⤵PID:208
-
\??\c:\bbnhtt.exec:\bbnhtt.exe84⤵PID:2288
-
\??\c:\djppj.exec:\djppj.exe85⤵PID:400
-
\??\c:\pjppp.exec:\pjppp.exe86⤵PID:2160
-
\??\c:\jvddj.exec:\jvddj.exe87⤵
- System Location Discovery: System Language Discovery
PID:4640 -
\??\c:\rxlllrr.exec:\rxlllrr.exe88⤵PID:1528
-
\??\c:\hbbbtb.exec:\hbbbtb.exe89⤵PID:1112
-
\??\c:\bnnnhb.exec:\bnnnhb.exe90⤵PID:2420
-
\??\c:\vvpjj.exec:\vvpjj.exe91⤵PID:1376
-
\??\c:\3jddj.exec:\3jddj.exe92⤵PID:2496
-
\??\c:\rrxrfll.exec:\rrxrfll.exe93⤵PID:3808
-
\??\c:\7hhhhh.exec:\7hhhhh.exe94⤵PID:3036
-
\??\c:\hbbnbh.exec:\hbbnbh.exe95⤵PID:3928
-
\??\c:\hhnhbb.exec:\hhnhbb.exe96⤵PID:2324
-
\??\c:\pddvv.exec:\pddvv.exe97⤵PID:2016
-
\??\c:\ppdvd.exec:\ppdvd.exe98⤵PID:4420
-
\??\c:\llllrrl.exec:\llllrrl.exe99⤵
- System Location Discovery: System Language Discovery
PID:4564 -
\??\c:\lflxlxl.exec:\lflxlxl.exe100⤵PID:4604
-
\??\c:\ttbbhh.exec:\ttbbhh.exe101⤵PID:920
-
\??\c:\tthbbb.exec:\tthbbb.exe102⤵PID:940
-
\??\c:\pjppd.exec:\pjppd.exe103⤵PID:1944
-
\??\c:\djpjd.exec:\djpjd.exe104⤵PID:2508
-
\??\c:\rfxlrxx.exec:\rfxlrxx.exe105⤵PID:3224
-
\??\c:\xrxfxfx.exec:\xrxfxfx.exe106⤵PID:1524
-
\??\c:\ttnnhh.exec:\ttnnhh.exe107⤵PID:4656
-
\??\c:\ntbhhn.exec:\ntbhhn.exe108⤵PID:3496
-
\??\c:\bbnhbh.exec:\bbnhbh.exe109⤵PID:2872
-
\??\c:\vvvvj.exec:\vvvvj.exe110⤵PID:3848
-
\??\c:\dvdvv.exec:\dvdvv.exe111⤵PID:3428
-
\??\c:\xrrrlll.exec:\xrrrlll.exe112⤵PID:5004
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe113⤵PID:3608
-
\??\c:\ttntth.exec:\ttntth.exe114⤵PID:2624
-
\??\c:\bbnnbb.exec:\bbnnbb.exe115⤵PID:1520
-
\??\c:\ddjjj.exec:\ddjjj.exe116⤵PID:3148
-
\??\c:\vvddv.exec:\vvddv.exe117⤵PID:4032
-
\??\c:\flfxrfx.exec:\flfxrfx.exe118⤵PID:1232
-
\??\c:\xxrllll.exec:\xxrllll.exe119⤵PID:864
-
\??\c:\lffffll.exec:\lffffll.exe120⤵PID:1864
-
\??\c:\hntnnh.exec:\hntnnh.exe121⤵PID:4944
-
\??\c:\jpddv.exec:\jpddv.exe122⤵PID:5080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-