Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5eba13d7401d55d653a22f71f988b3d0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
5eba13d7401d55d653a22f71f988b3d0N.exe
-
Size
67KB
-
MD5
5eba13d7401d55d653a22f71f988b3d0
-
SHA1
848e2559b1a8fbdfcadb91fbe038ccf4e4f482d9
-
SHA256
fb19a47d4f412ade50a2dc9a01aeee81204300e5304732627296de2860d77f04
-
SHA512
bc981e830c3fa45265bb77a7be1381224229202031b46ca5b8e3fe07343b7be076397e29be5d522a573dc3b29b8930b9d8b322a6aadc289a6c3e0f3a86f4e2b9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27BqfCe:ymb3NkkiQ3mdBjFI9cqfN
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4780-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3340 rrxxflx.exe 3832 xxxllfx.exe 1664 rfxxfff.exe 2516 3hhhhh.exe 2528 dpvpj.exe 4016 xxrrrrr.exe 3796 nntbbh.exe 3660 jddjj.exe 4284 vpvvj.exe 3204 xxxxlll.exe 4700 hhhbbt.exe 2596 vppdv.exe 4920 xxrlfff.exe 5060 5lxxrxx.exe 4832 btnnhh.exe 3284 jdvvp.exe 4708 frflxxx.exe 3848 5xfxrlx.exe 2028 bnhbtt.exe 4604 ntthbt.exe 4036 vvvjd.exe 4548 fxxrxxl.exe 3556 fxfxffl.exe 4332 bhnnnh.exe 4772 pdjdp.exe 3144 xxlrflr.exe 4980 lxfxrrl.exe 2508 frllfrf.exe 3560 vjpjd.exe 3736 pvvpj.exe 2216 xfxxxxx.exe 2824 7bbbth.exe 3952 jvpdp.exe 4252 dvjdp.exe 3812 lflxxrx.exe 2892 1xxxrrl.exe 3460 lflrrfx.exe 3744 5bhhht.exe 2044 tnhbtt.exe 2080 pjjjd.exe 4476 jppjv.exe 4508 5flflll.exe 4916 1xxrlfx.exe 4196 rlxrlll.exe 3832 hhnnbb.exe 2772 tbtnht.exe 1972 jvvvv.exe 2516 jdvpj.exe 2896 rxxrffx.exe 4360 rffflrl.exe 2640 ttnhbb.exe 3016 3nntnn.exe 860 pddvp.exe 3660 vjjjv.exe 3852 dvpjd.exe 3192 lffrlxx.exe 1224 lflffxx.exe 3060 btnhnb.exe 4688 tbhbnn.exe 4084 pjjdd.exe 3624 pvvpp.exe 3156 jddvp.exe 4144 rxxlxlf.exe 5060 llfxxrx.exe -
resource yara_rule behavioral2/memory/4780-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-193-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 3340 4780 5eba13d7401d55d653a22f71f988b3d0N.exe 83 PID 4780 wrote to memory of 3340 4780 5eba13d7401d55d653a22f71f988b3d0N.exe 83 PID 4780 wrote to memory of 3340 4780 5eba13d7401d55d653a22f71f988b3d0N.exe 83 PID 3340 wrote to memory of 3832 3340 rrxxflx.exe 84 PID 3340 wrote to memory of 3832 3340 rrxxflx.exe 84 PID 3340 wrote to memory of 3832 3340 rrxxflx.exe 84 PID 3832 wrote to memory of 1664 3832 xxxllfx.exe 85 PID 3832 wrote to memory of 1664 3832 xxxllfx.exe 85 PID 3832 wrote to memory of 1664 3832 xxxllfx.exe 85 PID 1664 wrote to memory of 2516 1664 rfxxfff.exe 86 PID 1664 wrote to memory of 2516 1664 rfxxfff.exe 86 PID 1664 wrote to memory of 2516 1664 rfxxfff.exe 86 PID 2516 wrote to memory of 2528 2516 3hhhhh.exe 87 PID 2516 wrote to memory of 2528 2516 3hhhhh.exe 87 PID 2516 wrote to memory of 2528 2516 3hhhhh.exe 87 PID 2528 wrote to memory of 4016 2528 dpvpj.exe 88 PID 2528 wrote to memory of 4016 2528 dpvpj.exe 88 PID 2528 wrote to memory of 4016 2528 dpvpj.exe 88 PID 4016 wrote to memory of 3796 4016 xxrrrrr.exe 89 PID 4016 wrote to memory of 3796 4016 xxrrrrr.exe 89 PID 4016 wrote to memory of 3796 4016 xxrrrrr.exe 89 PID 3796 wrote to memory of 3660 3796 nntbbh.exe 90 PID 3796 wrote to memory of 3660 3796 nntbbh.exe 90 PID 3796 wrote to memory of 3660 3796 nntbbh.exe 90 PID 3660 wrote to memory of 4284 3660 jddjj.exe 91 PID 3660 wrote to memory of 4284 3660 jddjj.exe 91 PID 3660 wrote to memory of 4284 3660 jddjj.exe 91 PID 4284 wrote to memory of 3204 4284 vpvvj.exe 92 PID 4284 wrote to memory of 3204 4284 vpvvj.exe 92 PID 4284 wrote to memory of 3204 4284 vpvvj.exe 92 PID 3204 wrote to memory of 4700 3204 xxxxlll.exe 94 PID 3204 wrote to memory of 4700 3204 xxxxlll.exe 94 PID 3204 wrote to memory of 4700 3204 xxxxlll.exe 94 PID 4700 wrote to memory of 2596 4700 hhhbbt.exe 95 PID 4700 wrote to memory of 2596 4700 hhhbbt.exe 95 PID 4700 wrote to memory of 2596 4700 hhhbbt.exe 95 PID 2596 wrote to memory of 4920 2596 vppdv.exe 96 PID 2596 wrote to memory of 4920 2596 vppdv.exe 96 PID 2596 wrote to memory of 4920 2596 vppdv.exe 96 PID 4920 wrote to memory of 5060 4920 xxrlfff.exe 97 PID 4920 wrote to memory of 5060 4920 xxrlfff.exe 97 PID 4920 wrote to memory of 5060 4920 xxrlfff.exe 97 PID 5060 wrote to memory of 4832 5060 5lxxrxx.exe 98 PID 5060 wrote to memory of 4832 5060 5lxxrxx.exe 98 PID 5060 wrote to memory of 4832 5060 5lxxrxx.exe 98 PID 4832 wrote to memory of 3284 4832 btnnhh.exe 99 PID 4832 wrote to memory of 3284 4832 btnnhh.exe 99 PID 4832 wrote to memory of 3284 4832 btnnhh.exe 99 PID 3284 wrote to memory of 4708 3284 jdvvp.exe 101 PID 3284 wrote to memory of 4708 3284 jdvvp.exe 101 PID 3284 wrote to memory of 4708 3284 jdvvp.exe 101 PID 4708 wrote to memory of 3848 4708 frflxxx.exe 102 PID 4708 wrote to memory of 3848 4708 frflxxx.exe 102 PID 4708 wrote to memory of 3848 4708 frflxxx.exe 102 PID 3848 wrote to memory of 2028 3848 5xfxrlx.exe 103 PID 3848 wrote to memory of 2028 3848 5xfxrlx.exe 103 PID 3848 wrote to memory of 2028 3848 5xfxrlx.exe 103 PID 2028 wrote to memory of 4604 2028 bnhbtt.exe 104 PID 2028 wrote to memory of 4604 2028 bnhbtt.exe 104 PID 2028 wrote to memory of 4604 2028 bnhbtt.exe 104 PID 4604 wrote to memory of 4036 4604 ntthbt.exe 105 PID 4604 wrote to memory of 4036 4604 ntthbt.exe 105 PID 4604 wrote to memory of 4036 4604 ntthbt.exe 105 PID 4036 wrote to memory of 4548 4036 vvvjd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eba13d7401d55d653a22f71f988b3d0N.exe"C:\Users\Admin\AppData\Local\Temp\5eba13d7401d55d653a22f71f988b3d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\rrxxflx.exec:\rrxxflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\xxxllfx.exec:\xxxllfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\rfxxfff.exec:\rfxxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3hhhhh.exec:\3hhhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\dpvpj.exec:\dpvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\nntbbh.exec:\nntbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\jddjj.exec:\jddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\vpvvj.exec:\vpvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\xxxxlll.exec:\xxxxlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\hhhbbt.exec:\hhhbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\vppdv.exec:\vppdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xxrlfff.exec:\xxrlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\5lxxrxx.exec:\5lxxrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\btnnhh.exec:\btnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\jdvvp.exec:\jdvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\frflxxx.exec:\frflxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\5xfxrlx.exec:\5xfxrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\bnhbtt.exec:\bnhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\ntthbt.exec:\ntthbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\vvvjd.exec:\vvvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\fxxrxxl.exec:\fxxrxxl.exe23⤵
- Executes dropped EXE
PID:4548 -
\??\c:\fxfxffl.exec:\fxfxffl.exe24⤵
- Executes dropped EXE
PID:3556 -
\??\c:\bhnnnh.exec:\bhnnnh.exe25⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pdjdp.exec:\pdjdp.exe26⤵
- Executes dropped EXE
PID:4772 -
\??\c:\xxlrflr.exec:\xxlrflr.exe27⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe28⤵
- Executes dropped EXE
PID:4980 -
\??\c:\frllfrf.exec:\frllfrf.exe29⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vjpjd.exec:\vjpjd.exe30⤵
- Executes dropped EXE
PID:3560 -
\??\c:\pvvpj.exec:\pvvpj.exe31⤵
- Executes dropped EXE
PID:3736 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7bbbth.exec:\7bbbth.exe33⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jvpdp.exec:\jvpdp.exe34⤵
- Executes dropped EXE
PID:3952 -
\??\c:\dvjdp.exec:\dvjdp.exe35⤵
- Executes dropped EXE
PID:4252 -
\??\c:\lflxxrx.exec:\lflxxrx.exe36⤵
- Executes dropped EXE
PID:3812 -
\??\c:\1xxxrrl.exec:\1xxxrrl.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lflrrfx.exec:\lflrrfx.exe38⤵
- Executes dropped EXE
PID:3460 -
\??\c:\5bhhht.exec:\5bhhht.exe39⤵
- Executes dropped EXE
PID:3744 -
\??\c:\tnhbtt.exec:\tnhbtt.exe40⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pjjjd.exec:\pjjjd.exe41⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jppjv.exec:\jppjv.exe42⤵
- Executes dropped EXE
PID:4476 -
\??\c:\5flflll.exec:\5flflll.exe43⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1xxrlfx.exec:\1xxrlfx.exe44⤵
- Executes dropped EXE
PID:4916 -
\??\c:\rlxrlll.exec:\rlxrlll.exe45⤵
- Executes dropped EXE
PID:4196 -
\??\c:\hhnnbb.exec:\hhnnbb.exe46⤵
- Executes dropped EXE
PID:3832 -
\??\c:\tbtnht.exec:\tbtnht.exe47⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jvvvv.exec:\jvvvv.exe48⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jdvpj.exec:\jdvpj.exe49⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rxxrffx.exec:\rxxrffx.exe50⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rffflrl.exec:\rffflrl.exe51⤵
- Executes dropped EXE
PID:4360 -
\??\c:\ttnhbb.exec:\ttnhbb.exe52⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3nntnn.exec:\3nntnn.exe53⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pddvp.exec:\pddvp.exe54⤵
- Executes dropped EXE
PID:860 -
\??\c:\vjjjv.exec:\vjjjv.exe55⤵
- Executes dropped EXE
PID:3660 -
\??\c:\dvpjd.exec:\dvpjd.exe56⤵
- Executes dropped EXE
PID:3852 -
\??\c:\lffrlxx.exec:\lffrlxx.exe57⤵
- Executes dropped EXE
PID:3192 -
\??\c:\lflffxx.exec:\lflffxx.exe58⤵
- Executes dropped EXE
PID:1224 -
\??\c:\btnhnb.exec:\btnhnb.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tbhbnn.exec:\tbhbnn.exe60⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pjjdd.exec:\pjjdd.exe61⤵
- Executes dropped EXE
PID:4084 -
\??\c:\pvvpp.exec:\pvvpp.exe62⤵
- Executes dropped EXE
PID:3624 -
\??\c:\jddvp.exec:\jddvp.exe63⤵
- Executes dropped EXE
PID:3156 -
\??\c:\rxxlxlf.exec:\rxxlxlf.exe64⤵
- Executes dropped EXE
PID:4144 -
\??\c:\llfxxrx.exec:\llfxxrx.exe65⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nbhbbt.exec:\nbhbbt.exe66⤵PID:3112
-
\??\c:\bbthht.exec:\bbthht.exe67⤵PID:440
-
\??\c:\vpjjv.exec:\vpjjv.exe68⤵PID:4788
-
\??\c:\vpjpj.exec:\vpjpj.exe69⤵PID:2028
-
\??\c:\lrxxrlf.exec:\lrxxrlf.exe70⤵PID:4040
-
\??\c:\rrxflrx.exec:\rrxflrx.exe71⤵PID:4068
-
\??\c:\5hhbbb.exec:\5hhbbb.exe72⤵PID:2180
-
\??\c:\bbhbbb.exec:\bbhbbb.exe73⤵PID:4812
-
\??\c:\ddjdd.exec:\ddjdd.exe74⤵PID:220
-
\??\c:\pdjjd.exec:\pdjjd.exe75⤵PID:3828
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe76⤵PID:1088
-
\??\c:\fffxrrl.exec:\fffxrrl.exe77⤵PID:3348
-
\??\c:\nhbtnh.exec:\nhbtnh.exe78⤵PID:4148
-
\??\c:\hnnnhh.exec:\hnnnhh.exe79⤵PID:784
-
\??\c:\vpjdp.exec:\vpjdp.exe80⤵PID:1468
-
\??\c:\pddvp.exec:\pddvp.exe81⤵PID:4992
-
\??\c:\rrxrfff.exec:\rrxrfff.exe82⤵PID:2224
-
\??\c:\xllfxxx.exec:\xllfxxx.exe83⤵PID:4556
-
\??\c:\rlffxrl.exec:\rlffxrl.exe84⤵PID:4648
-
\??\c:\1bhbnh.exec:\1bhbnh.exe85⤵PID:3736
-
\??\c:\3pjjd.exec:\3pjjd.exe86⤵PID:4372
-
\??\c:\jdvpp.exec:\jdvpp.exe87⤵PID:1384
-
\??\c:\rfxrffr.exec:\rfxrffr.exe88⤵PID:4724
-
\??\c:\htnnbb.exec:\htnnbb.exe89⤵PID:4676
-
\??\c:\ththhn.exec:\ththhn.exe90⤵PID:1652
-
\??\c:\vddvj.exec:\vddvj.exe91⤵PID:4796
-
\??\c:\ddjdp.exec:\ddjdp.exe92⤵PID:3460
-
\??\c:\frlfrrl.exec:\frlfrrl.exe93⤵PID:3744
-
\??\c:\rllflfr.exec:\rllflfr.exe94⤵PID:4452
-
\??\c:\tnhbbt.exec:\tnhbbt.exe95⤵PID:972
-
\??\c:\tbbhtt.exec:\tbbhtt.exe96⤵PID:3124
-
\??\c:\jvvpp.exec:\jvvpp.exe97⤵PID:3564
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe98⤵PID:2740
-
\??\c:\1rrrffx.exec:\1rrrffx.exe99⤵PID:4196
-
\??\c:\tnhbhb.exec:\tnhbhb.exe100⤵PID:4228
-
\??\c:\tthhbb.exec:\tthhbb.exe101⤵PID:4896
-
\??\c:\7dddd.exec:\7dddd.exe102⤵PID:1496
-
\??\c:\xxxrffx.exec:\xxxrffx.exe103⤵PID:3780
-
\??\c:\3llxxxr.exec:\3llxxxr.exe104⤵PID:3656
-
\??\c:\5nnhbt.exec:\5nnhbt.exe105⤵
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\bhntnh.exec:\bhntnh.exe106⤵PID:4820
-
\??\c:\9jpjp.exec:\9jpjp.exe107⤵PID:368
-
\??\c:\pjvvv.exec:\pjvvv.exe108⤵PID:4072
-
\??\c:\xrrlflf.exec:\xrrlflf.exe109⤵PID:3660
-
\??\c:\7rlfxrl.exec:\7rlfxrl.exe110⤵PID:1228
-
\??\c:\hbttnh.exec:\hbttnh.exe111⤵PID:1508
-
\??\c:\5tbthh.exec:\5tbthh.exe112⤵PID:5036
-
\??\c:\9ddvd.exec:\9ddvd.exe113⤵PID:1076
-
\??\c:\vppjd.exec:\vppjd.exe114⤵PID:4920
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe115⤵PID:872
-
\??\c:\fflfxrl.exec:\fflfxrl.exe116⤵PID:3756
-
\??\c:\5bhhhn.exec:\5bhhhn.exe117⤵PID:3244
-
\??\c:\htnhbt.exec:\htnhbt.exe118⤵PID:4576
-
\??\c:\jjjpj.exec:\jjjpj.exe119⤵PID:316
-
\??\c:\pvdvp.exec:\pvdvp.exe120⤵PID:3464
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe121⤵PID:1164
-
\??\c:\frxrxxr.exec:\frxrxxr.exe122⤵PID:3540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-