Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe
Resource
win7-20240704-en
General
-
Target
9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe
-
Size
436KB
-
MD5
0712e0b4c599d79044fb56d09b506390
-
SHA1
7a83fdf989ce43dc6c0e3f2f12cee8c79d61a272
-
SHA256
9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9
-
SHA512
84d5033fd8b39bb7b4f087bef9592b5132cc31b14fc546c659866c5b28c6c025e430c32d64bd9b83b6bb9f6ab98d315d0f0a4ec37c1f581797847faa39a794e9
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl888888888888888888nE:ShPh2kkkkK4kXkkkkkkkkm
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1692-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2556 jvjjd.exe 2144 rlfflrf.exe 2800 jdjjp.exe 2748 804062.exe 2808 042080.exe 2724 8084680.exe 2720 88246.exe 2728 20400.exe 3052 220240.exe 1672 rrlrllf.exe 1032 lfrrxfl.exe 844 xxrxllx.exe 1048 frxxllx.exe 1916 rlffrrl.exe 1700 nnhtnn.exe 1944 2644068.exe 2856 42064.exe 616 3pjdd.exe 2356 jpjjd.exe 1040 08624.exe 2096 e24428.exe 2092 6064848.exe 2940 82464.exe 1960 82064.exe 2272 nhthnt.exe 2508 jjjjd.exe 1552 bbbbtb.exe 1616 4246880.exe 1952 4206662.exe 2152 bthtnn.exe 2072 86402.exe 2316 82066.exe 2376 frffrxf.exe 2712 1vpdp.exe 2884 820022.exe 2736 3pvvj.exe 2920 7rflllr.exe 2156 xxllrxf.exe 2724 1nttbh.exe 2520 tnhhhh.exe 2620 7hhnbh.exe 672 608200.exe 1124 642248.exe 1392 044028.exe 1332 08668.exe 1232 tnbhhh.exe 112 0402002.exe 1728 llxxffl.exe 2576 9xlfxll.exe 1188 a8806.exe 1640 tthnnt.exe 2860 vvpdp.exe 2472 hthbtt.exe 1804 02446.exe 1624 ddvpd.exe 1340 3thtbh.exe 2096 86440.exe 900 ppjpd.exe 1776 1ddjd.exe 1620 tnhhnn.exe 2304 bnhnbb.exe 2564 rlxfxrf.exe 2540 2084024.exe 1968 i084008.exe -
resource yara_rule behavioral1/memory/1692-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6028406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2604624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k46626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o248440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2556 1692 9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe 30 PID 1692 wrote to memory of 2556 1692 9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe 30 PID 1692 wrote to memory of 2556 1692 9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe 30 PID 1692 wrote to memory of 2556 1692 9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe 30 PID 2556 wrote to memory of 2144 2556 jvjjd.exe 31 PID 2556 wrote to memory of 2144 2556 jvjjd.exe 31 PID 2556 wrote to memory of 2144 2556 jvjjd.exe 31 PID 2556 wrote to memory of 2144 2556 jvjjd.exe 31 PID 2144 wrote to memory of 2800 2144 rlfflrf.exe 32 PID 2144 wrote to memory of 2800 2144 rlfflrf.exe 32 PID 2144 wrote to memory of 2800 2144 rlfflrf.exe 32 PID 2144 wrote to memory of 2800 2144 rlfflrf.exe 32 PID 2800 wrote to memory of 2748 2800 jdjjp.exe 33 PID 2800 wrote to memory of 2748 2800 jdjjp.exe 33 PID 2800 wrote to memory of 2748 2800 jdjjp.exe 33 PID 2800 wrote to memory of 2748 2800 jdjjp.exe 33 PID 2748 wrote to memory of 2808 2748 804062.exe 34 PID 2748 wrote to memory of 2808 2748 804062.exe 34 PID 2748 wrote to memory of 2808 2748 804062.exe 34 PID 2748 wrote to memory of 2808 2748 804062.exe 34 PID 2808 wrote to memory of 2724 2808 042080.exe 36 PID 2808 wrote to memory of 2724 2808 042080.exe 36 PID 2808 wrote to memory of 2724 2808 042080.exe 36 PID 2808 wrote to memory of 2724 2808 042080.exe 36 PID 2724 wrote to memory of 2720 2724 8084680.exe 37 PID 2724 wrote to memory of 2720 2724 8084680.exe 37 PID 2724 wrote to memory of 2720 2724 8084680.exe 37 PID 2724 wrote to memory of 2720 2724 8084680.exe 37 PID 2720 wrote to memory of 2728 2720 88246.exe 38 PID 2720 wrote to memory of 2728 2720 88246.exe 38 PID 2720 wrote to memory of 2728 2720 88246.exe 38 PID 2720 wrote to memory of 2728 2720 88246.exe 38 PID 2728 wrote to memory of 3052 2728 20400.exe 39 PID 2728 wrote to memory of 3052 2728 20400.exe 39 PID 2728 wrote to memory of 3052 2728 20400.exe 39 PID 2728 wrote to memory of 3052 2728 20400.exe 39 PID 3052 wrote to memory of 1672 3052 220240.exe 40 PID 3052 wrote to memory of 1672 3052 220240.exe 40 PID 3052 wrote to memory of 1672 3052 220240.exe 40 PID 3052 wrote to memory of 1672 3052 220240.exe 40 PID 1672 wrote to memory of 1032 1672 rrlrllf.exe 41 PID 1672 wrote to memory of 1032 1672 rrlrllf.exe 41 PID 1672 wrote to memory of 1032 1672 rrlrllf.exe 41 PID 1672 wrote to memory of 1032 1672 rrlrllf.exe 41 PID 1032 wrote to memory of 844 1032 lfrrxfl.exe 42 PID 1032 wrote to memory of 844 1032 lfrrxfl.exe 42 PID 1032 wrote to memory of 844 1032 lfrrxfl.exe 42 PID 1032 wrote to memory of 844 1032 lfrrxfl.exe 42 PID 844 wrote to memory of 1048 844 xxrxllx.exe 43 PID 844 wrote to memory of 1048 844 xxrxllx.exe 43 PID 844 wrote to memory of 1048 844 xxrxllx.exe 43 PID 844 wrote to memory of 1048 844 xxrxllx.exe 43 PID 1048 wrote to memory of 1916 1048 frxxllx.exe 44 PID 1048 wrote to memory of 1916 1048 frxxllx.exe 44 PID 1048 wrote to memory of 1916 1048 frxxllx.exe 44 PID 1048 wrote to memory of 1916 1048 frxxllx.exe 44 PID 1916 wrote to memory of 1700 1916 rlffrrl.exe 45 PID 1916 wrote to memory of 1700 1916 rlffrrl.exe 45 PID 1916 wrote to memory of 1700 1916 rlffrrl.exe 45 PID 1916 wrote to memory of 1700 1916 rlffrrl.exe 45 PID 1700 wrote to memory of 1944 1700 nnhtnn.exe 46 PID 1700 wrote to memory of 1944 1700 nnhtnn.exe 46 PID 1700 wrote to memory of 1944 1700 nnhtnn.exe 46 PID 1700 wrote to memory of 1944 1700 nnhtnn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe"C:\Users\Admin\AppData\Local\Temp\9752afb716058c6c11257512c9b965d92bd109326bd36256ff03023630ab73d9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\jvjjd.exec:\jvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rlfflrf.exec:\rlfflrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jdjjp.exec:\jdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\804062.exec:\804062.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\042080.exec:\042080.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\8084680.exec:\8084680.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\88246.exec:\88246.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\20400.exec:\20400.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\220240.exec:\220240.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rrlrllf.exec:\rrlrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\xxrxllx.exec:\xxrxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\frxxllx.exec:\frxxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\rlffrrl.exec:\rlffrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\nnhtnn.exec:\nnhtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\2644068.exec:\2644068.exe17⤵
- Executes dropped EXE
PID:1944 -
\??\c:\42064.exec:\42064.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3pjdd.exec:\3pjdd.exe19⤵
- Executes dropped EXE
PID:616 -
\??\c:\jpjjd.exec:\jpjjd.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\08624.exec:\08624.exe21⤵
- Executes dropped EXE
PID:1040 -
\??\c:\e24428.exec:\e24428.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\6064848.exec:\6064848.exe23⤵
- Executes dropped EXE
PID:2092 -
\??\c:\82464.exec:\82464.exe24⤵
- Executes dropped EXE
PID:2940 -
\??\c:\82064.exec:\82064.exe25⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhthnt.exec:\nhthnt.exe26⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jjjjd.exec:\jjjjd.exe27⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bbbbtb.exec:\bbbbtb.exe28⤵
- Executes dropped EXE
PID:1552 -
\??\c:\4246880.exec:\4246880.exe29⤵
- Executes dropped EXE
PID:1616 -
\??\c:\4206662.exec:\4206662.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bthtnn.exec:\bthtnn.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\86402.exec:\86402.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\82066.exec:\82066.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\frffrxf.exec:\frffrxf.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1vpdp.exec:\1vpdp.exe35⤵
- Executes dropped EXE
PID:2712 -
\??\c:\820022.exec:\820022.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3pvvj.exec:\3pvvj.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7rflllr.exec:\7rflllr.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xxllrxf.exec:\xxllrxf.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1nttbh.exec:\1nttbh.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tnhhhh.exec:\tnhhhh.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7hhnbh.exec:\7hhnbh.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\608200.exec:\608200.exe43⤵
- Executes dropped EXE
PID:672 -
\??\c:\642248.exec:\642248.exe44⤵
- Executes dropped EXE
PID:1124 -
\??\c:\044028.exec:\044028.exe45⤵
- Executes dropped EXE
PID:1392 -
\??\c:\08668.exec:\08668.exe46⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tnbhhh.exec:\tnbhhh.exe47⤵
- Executes dropped EXE
PID:1232 -
\??\c:\0402002.exec:\0402002.exe48⤵
- Executes dropped EXE
PID:112 -
\??\c:\llxxffl.exec:\llxxffl.exe49⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9xlfxll.exec:\9xlfxll.exe50⤵
- Executes dropped EXE
PID:2576 -
\??\c:\a8806.exec:\a8806.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tthnnt.exec:\tthnnt.exe52⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvpdp.exec:\vvpdp.exe53⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hthbtt.exec:\hthbtt.exe54⤵
- Executes dropped EXE
PID:2472 -
\??\c:\02446.exec:\02446.exe55⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ddvpd.exec:\ddvpd.exe56⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3thtbh.exec:\3thtbh.exe57⤵
- Executes dropped EXE
PID:1340 -
\??\c:\86440.exec:\86440.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ppjpd.exec:\ppjpd.exe59⤵
- Executes dropped EXE
PID:900 -
\??\c:\1ddjd.exec:\1ddjd.exe60⤵
- Executes dropped EXE
PID:1776 -
\??\c:\tnhhnn.exec:\tnhhnn.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\bnhnbb.exec:\bnhnbb.exe62⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe63⤵
- Executes dropped EXE
PID:2564 -
\??\c:\2084024.exec:\2084024.exe64⤵
- Executes dropped EXE
PID:2540 -
\??\c:\i084008.exec:\i084008.exe65⤵
- Executes dropped EXE
PID:1968 -
\??\c:\6044064.exec:\6044064.exe66⤵PID:1744
-
\??\c:\20440.exec:\20440.exe67⤵PID:2288
-
\??\c:\e62222.exec:\e62222.exe68⤵PID:3032
-
\??\c:\llflllr.exec:\llflllr.exe69⤵PID:2496
-
\??\c:\fxllxrf.exec:\fxllxrf.exe70⤵PID:1572
-
\??\c:\3dppv.exec:\3dppv.exe71⤵PID:2264
-
\??\c:\flrlfxx.exec:\flrlfxx.exe72⤵PID:2936
-
\??\c:\bbnbnt.exec:\bbnbnt.exe73⤵PID:780
-
\??\c:\26002.exec:\26002.exe74⤵PID:2800
-
\??\c:\006248.exec:\006248.exe75⤵PID:2764
-
\??\c:\486628.exec:\486628.exe76⤵PID:2740
-
\??\c:\jdvvv.exec:\jdvvv.exe77⤵PID:2828
-
\??\c:\6046884.exec:\6046884.exe78⤵PID:2780
-
\??\c:\9nhhnn.exec:\9nhhnn.exe79⤵PID:2612
-
\??\c:\2206840.exec:\2206840.exe80⤵PID:2656
-
\??\c:\6462886.exec:\6462886.exe81⤵PID:2528
-
\??\c:\86446.exec:\86446.exe82⤵PID:876
-
\??\c:\206868.exec:\206868.exe83⤵PID:1072
-
\??\c:\dpdpv.exec:\dpdpv.exe84⤵PID:2032
-
\??\c:\1tntnt.exec:\1tntnt.exe85⤵PID:1428
-
\??\c:\82462.exec:\82462.exe86⤵PID:1708
-
\??\c:\864062.exec:\864062.exe87⤵PID:2204
-
\??\c:\0468480.exec:\0468480.exe88⤵PID:1080
-
\??\c:\q82800.exec:\q82800.exe89⤵PID:1248
-
\??\c:\6028446.exec:\6028446.exe90⤵PID:860
-
\??\c:\4240846.exec:\4240846.exe91⤵PID:2668
-
\??\c:\202240.exec:\202240.exe92⤵PID:2676
-
\??\c:\5dppv.exec:\5dppv.exe93⤵PID:1792
-
\??\c:\6268622.exec:\6268622.exe94⤵PID:2212
-
\??\c:\fxlllrx.exec:\fxlllrx.exe95⤵PID:2988
-
\??\c:\9dddp.exec:\9dddp.exe96⤵PID:2040
-
\??\c:\nhtbhh.exec:\nhtbhh.exe97⤵PID:2792
-
\??\c:\8641xlf.exec:\8641xlf.exe98⤵PID:748
-
\??\c:\lffrflx.exec:\lffrflx.exe99⤵PID:900
-
\??\c:\646284.exec:\646284.exe100⤵PID:2940
-
\??\c:\08202.exec:\08202.exe101⤵PID:1960
-
\??\c:\486462.exec:\486462.exe102⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\602882.exec:\602882.exe103⤵PID:1720
-
\??\c:\2022840.exec:\2022840.exe104⤵PID:2252
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe105⤵PID:1844
-
\??\c:\9xlrxxl.exec:\9xlrxxl.exe106⤵PID:2068
-
\??\c:\c046662.exec:\c046662.exe107⤵PID:2100
-
\??\c:\4488440.exec:\4488440.exe108⤵PID:2084
-
\??\c:\g6884.exec:\g6884.exe109⤵PID:2056
-
\??\c:\2066846.exec:\2066846.exe110⤵PID:2256
-
\??\c:\046244.exec:\046244.exe111⤵PID:1420
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe112⤵PID:2376
-
\??\c:\tbnhhb.exec:\tbnhhb.exe113⤵PID:2804
-
\??\c:\1hnttb.exec:\1hnttb.exe114⤵PID:2732
-
\??\c:\6428846.exec:\6428846.exe115⤵PID:2808
-
\??\c:\7tnttt.exec:\7tnttt.exe116⤵PID:2696
-
\??\c:\24888.exec:\24888.exe117⤵PID:2664
-
\??\c:\xrfxlrx.exec:\xrfxlrx.exe118⤵PID:2076
-
\??\c:\9nbbnn.exec:\9nbbnn.exe119⤵PID:2520
-
\??\c:\2066446.exec:\2066446.exe120⤵PID:1484
-
\??\c:\5pvvv.exec:\5pvvv.exe121⤵PID:556
-
\??\c:\3vjpd.exec:\3vjpd.exe122⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-