Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe
Resource
win7-20240903-en
General
-
Target
6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe
-
Size
79KB
-
MD5
f80cfb91ff24007a8869eaeb5a423900
-
SHA1
0d301c578e0ec5e4dce34d3e3f3b81c0f4cb4dd2
-
SHA256
6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6
-
SHA512
b5549713a5e94d5a74034144acff3c214876d5de9276c6ac995e29172a6c19f613651bce60794d3f99715839bf11da139401341bc4ba4a66371037b163f5d63c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeF:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4i
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2316-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2952 bthhtt.exe 2084 dppdv.exe 3048 llflfrf.exe 2392 bbtbhn.exe 2900 jvdjd.exe 2780 jdpdp.exe 2568 xfrlrrx.exe 2540 hbnthn.exe 3012 dpjvp.exe 1056 xrlfllx.exe 1352 ffrrxfl.exe 952 nnnntn.exe 1156 vvvdv.exe 540 pvppd.exe 2520 xlflflx.exe 1268 xrfflrf.exe 2776 tnbntt.exe 272 5nhbtb.exe 2400 1jdpp.exe 2144 rflllxf.exe 772 lllrffl.exe 344 7hhhtn.exe 1124 bthnbt.exe 1740 pjvpp.exe 600 jddpd.exe 3032 ffffxfr.exe 1696 nhhnnb.exe 2308 bbbnbb.exe 1992 5vdjd.exe 2936 vvvpd.exe 2940 3lfrflx.exe 2880 rlfrflx.exe 2164 hbtbnt.exe 1700 hthtnh.exe 2704 vpdjv.exe 2808 vpjjp.exe 2672 rlxflxl.exe 2708 xxrflrx.exe 2728 7rfrrff.exe 2592 bnhnhh.exe 2716 bttbtt.exe 2668 jjvjj.exe 2984 ppjpj.exe 1008 7xrxflr.exe 1108 xrlrxff.exe 396 fxlrllx.exe 1704 btnnhn.exe 1152 nhbnbn.exe 1488 pvvvd.exe 980 vjvvp.exe 2520 rlxflrx.exe 2616 hnttbb.exe 2800 hbbhtb.exe 2948 jdpjv.exe 1996 3dvvd.exe 1648 rffxllx.exe 748 lfrxfrx.exe 2724 hnbntn.exe 1632 thnbnt.exe 344 ppjvv.exe 1124 5ppdj.exe 928 lfflrxl.exe 940 xxfrxfl.exe 2068 3xffxfr.exe -
resource yara_rule behavioral1/memory/2316-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-254-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2952 2316 6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe 31 PID 2316 wrote to memory of 2952 2316 6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe 31 PID 2316 wrote to memory of 2952 2316 6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe 31 PID 2316 wrote to memory of 2952 2316 6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe 31 PID 2952 wrote to memory of 2084 2952 bthhtt.exe 32 PID 2952 wrote to memory of 2084 2952 bthhtt.exe 32 PID 2952 wrote to memory of 2084 2952 bthhtt.exe 32 PID 2952 wrote to memory of 2084 2952 bthhtt.exe 32 PID 2084 wrote to memory of 3048 2084 dppdv.exe 33 PID 2084 wrote to memory of 3048 2084 dppdv.exe 33 PID 2084 wrote to memory of 3048 2084 dppdv.exe 33 PID 2084 wrote to memory of 3048 2084 dppdv.exe 33 PID 3048 wrote to memory of 2392 3048 llflfrf.exe 34 PID 3048 wrote to memory of 2392 3048 llflfrf.exe 34 PID 3048 wrote to memory of 2392 3048 llflfrf.exe 34 PID 3048 wrote to memory of 2392 3048 llflfrf.exe 34 PID 2392 wrote to memory of 2900 2392 bbtbhn.exe 35 PID 2392 wrote to memory of 2900 2392 bbtbhn.exe 35 PID 2392 wrote to memory of 2900 2392 bbtbhn.exe 35 PID 2392 wrote to memory of 2900 2392 bbtbhn.exe 35 PID 2900 wrote to memory of 2780 2900 jvdjd.exe 36 PID 2900 wrote to memory of 2780 2900 jvdjd.exe 36 PID 2900 wrote to memory of 2780 2900 jvdjd.exe 36 PID 2900 wrote to memory of 2780 2900 jvdjd.exe 36 PID 2780 wrote to memory of 2568 2780 jdpdp.exe 37 PID 2780 wrote to memory of 2568 2780 jdpdp.exe 37 PID 2780 wrote to memory of 2568 2780 jdpdp.exe 37 PID 2780 wrote to memory of 2568 2780 jdpdp.exe 37 PID 2568 wrote to memory of 2540 2568 xfrlrrx.exe 38 PID 2568 wrote to memory of 2540 2568 xfrlrrx.exe 38 PID 2568 wrote to memory of 2540 2568 xfrlrrx.exe 38 PID 2568 wrote to memory of 2540 2568 xfrlrrx.exe 38 PID 2540 wrote to memory of 3012 2540 hbnthn.exe 39 PID 2540 wrote to memory of 3012 2540 hbnthn.exe 39 PID 2540 wrote to memory of 3012 2540 hbnthn.exe 39 PID 2540 wrote to memory of 3012 2540 hbnthn.exe 39 PID 3012 wrote to memory of 1056 3012 dpjvp.exe 40 PID 3012 wrote to memory of 1056 3012 dpjvp.exe 40 PID 3012 wrote to memory of 1056 3012 dpjvp.exe 40 PID 3012 wrote to memory of 1056 3012 dpjvp.exe 40 PID 1056 wrote to memory of 1352 1056 xrlfllx.exe 41 PID 1056 wrote to memory of 1352 1056 xrlfllx.exe 41 PID 1056 wrote to memory of 1352 1056 xrlfllx.exe 41 PID 1056 wrote to memory of 1352 1056 xrlfllx.exe 41 PID 1352 wrote to memory of 952 1352 ffrrxfl.exe 42 PID 1352 wrote to memory of 952 1352 ffrrxfl.exe 42 PID 1352 wrote to memory of 952 1352 ffrrxfl.exe 42 PID 1352 wrote to memory of 952 1352 ffrrxfl.exe 42 PID 952 wrote to memory of 1156 952 nnnntn.exe 43 PID 952 wrote to memory of 1156 952 nnnntn.exe 43 PID 952 wrote to memory of 1156 952 nnnntn.exe 43 PID 952 wrote to memory of 1156 952 nnnntn.exe 43 PID 1156 wrote to memory of 540 1156 vvvdv.exe 44 PID 1156 wrote to memory of 540 1156 vvvdv.exe 44 PID 1156 wrote to memory of 540 1156 vvvdv.exe 44 PID 1156 wrote to memory of 540 1156 vvvdv.exe 44 PID 540 wrote to memory of 2520 540 pvppd.exe 45 PID 540 wrote to memory of 2520 540 pvppd.exe 45 PID 540 wrote to memory of 2520 540 pvppd.exe 45 PID 540 wrote to memory of 2520 540 pvppd.exe 45 PID 2520 wrote to memory of 1268 2520 xlflflx.exe 46 PID 2520 wrote to memory of 1268 2520 xlflflx.exe 46 PID 2520 wrote to memory of 1268 2520 xlflflx.exe 46 PID 2520 wrote to memory of 1268 2520 xlflflx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe"C:\Users\Admin\AppData\Local\Temp\6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\bthhtt.exec:\bthhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\dppdv.exec:\dppdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\llflfrf.exec:\llflfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bbtbhn.exec:\bbtbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\jvdjd.exec:\jvdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jdpdp.exec:\jdpdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xfrlrrx.exec:\xfrlrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hbnthn.exec:\hbnthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dpjvp.exec:\dpjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xrlfllx.exec:\xrlfllx.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\nnnntn.exec:\nnnntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\vvvdv.exec:\vvvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\pvppd.exec:\pvppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\xlflflx.exec:\xlflflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xrfflrf.exec:\xrfflrf.exe17⤵
- Executes dropped EXE
PID:1268 -
\??\c:\tnbntt.exec:\tnbntt.exe18⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5nhbtb.exec:\5nhbtb.exe19⤵
- Executes dropped EXE
PID:272 -
\??\c:\1jdpp.exec:\1jdpp.exe20⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rflllxf.exec:\rflllxf.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lllrffl.exec:\lllrffl.exe22⤵
- Executes dropped EXE
PID:772 -
\??\c:\7hhhtn.exec:\7hhhtn.exe23⤵
- Executes dropped EXE
PID:344 -
\??\c:\bthnbt.exec:\bthnbt.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\pjvpp.exec:\pjvpp.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jddpd.exec:\jddpd.exe26⤵
- Executes dropped EXE
PID:600 -
\??\c:\ffffxfr.exec:\ffffxfr.exe27⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nhhnnb.exec:\nhhnnb.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bbbnbb.exec:\bbbnbb.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5vdjd.exec:\5vdjd.exe30⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vvvpd.exec:\vvvpd.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3lfrflx.exec:\3lfrflx.exe32⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rlfrflx.exec:\rlfrflx.exe33⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbtbnt.exec:\hbtbnt.exe34⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hthtnh.exec:\hthtnh.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vpdjv.exec:\vpdjv.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vpjjp.exec:\vpjjp.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rlxflxl.exec:\rlxflxl.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xxrflrx.exec:\xxrflrx.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7rfrrff.exec:\7rfrrff.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bnhnhh.exec:\bnhnhh.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bttbtt.exec:\bttbtt.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jjvjj.exec:\jjvjj.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ppjpj.exec:\ppjpj.exe44⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7xrxflr.exec:\7xrxflr.exe45⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xrlrxff.exec:\xrlrxff.exe46⤵
- Executes dropped EXE
PID:1108 -
\??\c:\fxlrllx.exec:\fxlrllx.exe47⤵
- Executes dropped EXE
PID:396 -
\??\c:\btnnhn.exec:\btnnhn.exe48⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nhbnbn.exec:\nhbnbn.exe49⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pvvvd.exec:\pvvvd.exe50⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vjvvp.exec:\vjvvp.exe51⤵
- Executes dropped EXE
PID:980 -
\??\c:\rlxflrx.exec:\rlxflrx.exe52⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hnttbb.exec:\hnttbb.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbbhtb.exec:\hbbhtb.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jdpjv.exec:\jdpjv.exe55⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3dvvd.exec:\3dvvd.exe56⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rffxllx.exec:\rffxllx.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe58⤵
- Executes dropped EXE
PID:748 -
\??\c:\hnbntn.exec:\hnbntn.exe59⤵
- Executes dropped EXE
PID:2724 -
\??\c:\thnbnt.exec:\thnbnt.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ppjvv.exec:\ppjvv.exe61⤵
- Executes dropped EXE
PID:344 -
\??\c:\5ppdj.exec:\5ppdj.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lfflrxl.exec:\lfflrxl.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\xxfrxfl.exec:\xxfrxfl.exe64⤵
- Executes dropped EXE
PID:940 -
\??\c:\3xffxfr.exec:\3xffxfr.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7hbttb.exec:\7hbttb.exe66⤵PID:2304
-
\??\c:\5hbbtt.exec:\5hbbtt.exe67⤵PID:1696
-
\??\c:\vppvd.exec:\vppvd.exe68⤵PID:2448
-
\??\c:\lfrxflx.exec:\lfrxflx.exe69⤵PID:2932
-
\??\c:\5rxfrlr.exec:\5rxfrlr.exe70⤵PID:1608
-
\??\c:\btbntb.exec:\btbntb.exe71⤵PID:1588
-
\??\c:\bbhhth.exec:\bbhhth.exe72⤵PID:1804
-
\??\c:\vdjdj.exec:\vdjdj.exe73⤵PID:1364
-
\??\c:\pjddp.exec:\pjddp.exe74⤵PID:1948
-
\??\c:\lllllxl.exec:\lllllxl.exe75⤵PID:3044
-
\??\c:\hbtnnb.exec:\hbtnnb.exe76⤵PID:2892
-
\??\c:\pddjd.exec:\pddjd.exe77⤵PID:2812
-
\??\c:\vvjpd.exec:\vvjpd.exe78⤵PID:2552
-
\??\c:\pdvpp.exec:\pdvpp.exe79⤵PID:2324
-
\??\c:\frlxflx.exec:\frlxflx.exe80⤵PID:2576
-
\??\c:\btbhbb.exec:\btbhbb.exe81⤵PID:2820
-
\??\c:\bhhnnh.exec:\bhhnnh.exe82⤵PID:2328
-
\??\c:\dvvvp.exec:\dvvvp.exe83⤵
- System Location Discovery: System Language Discovery
PID:1436 -
\??\c:\vjdjv.exec:\vjdjv.exe84⤵PID:1088
-
\??\c:\frfxxxf.exec:\frfxxxf.exe85⤵PID:264
-
\??\c:\bnbnbb.exec:\bnbnbb.exe86⤵PID:1028
-
\??\c:\btbnnh.exec:\btbnnh.exe87⤵PID:1256
-
\??\c:\3dpvv.exec:\3dpvv.exe88⤵PID:760
-
\??\c:\jvddd.exec:\jvddd.exe89⤵PID:1520
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe90⤵PID:2052
-
\??\c:\fxrxrlr.exec:\fxrxrlr.exe91⤵PID:2040
-
\??\c:\bnhhhn.exec:\bnhhhn.exe92⤵PID:2532
-
\??\c:\hntbbb.exec:\hntbbb.exe93⤵PID:332
-
\??\c:\9pjjd.exec:\9pjjd.exe94⤵PID:2872
-
\??\c:\9jppp.exec:\9jppp.exe95⤵PID:2864
-
\??\c:\1xlffll.exec:\1xlffll.exe96⤵PID:1792
-
\??\c:\1rflrrx.exec:\1rflrrx.exe97⤵PID:912
-
\??\c:\bhhbhb.exec:\bhhbhb.exe98⤵PID:748
-
\??\c:\thnhht.exec:\thnhht.exe99⤵PID:1864
-
\??\c:\jpvpd.exec:\jpvpd.exe100⤵PID:2416
-
\??\c:\pdppd.exec:\pdppd.exe101⤵PID:1512
-
\??\c:\7xrxxll.exec:\7xrxxll.exe102⤵PID:2868
-
\??\c:\flfrffx.exec:\flfrffx.exe103⤵PID:2912
-
\??\c:\bnbttn.exec:\bnbttn.exe104⤵PID:600
-
\??\c:\hbhtbt.exec:\hbhtbt.exe105⤵PID:1324
-
\??\c:\7jpjp.exec:\7jpjp.exe106⤵PID:1328
-
\??\c:\jddjj.exec:\jddjj.exe107⤵PID:2308
-
\??\c:\xlffxff.exec:\xlffxff.exe108⤵PID:2448
-
\??\c:\5xffflr.exec:\5xffflr.exe109⤵PID:1620
-
\??\c:\1bnhtn.exec:\1bnhtn.exe110⤵PID:2104
-
\??\c:\5nhhhn.exec:\5nhhhn.exe111⤵PID:1404
-
\??\c:\pdvvj.exec:\pdvvj.exe112⤵PID:2332
-
\??\c:\dpppp.exec:\dpppp.exe113⤵PID:2688
-
\??\c:\rlfffff.exec:\rlfffff.exe114⤵PID:2788
-
\??\c:\1lrffxf.exec:\1lrffxf.exe115⤵PID:2704
-
\??\c:\nbhnnn.exec:\nbhnnn.exe116⤵PID:2756
-
\??\c:\bhhhhb.exec:\bhhhhb.exe117⤵PID:2808
-
\??\c:\jvvvp.exec:\jvvvp.exe118⤵PID:2384
-
\??\c:\fxrlrxr.exec:\fxrlrxr.exe119⤵PID:2572
-
\??\c:\frlxfxx.exec:\frlxfxx.exe120⤵PID:652
-
\??\c:\bnthnh.exec:\bnthnh.exe121⤵PID:2544
-
\??\c:\hthntt.exec:\hthntt.exe122⤵PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-