Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c3f32f78534112015cf4d699f5b04710N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
c3f32f78534112015cf4d699f5b04710N.exe
-
Size
70KB
-
MD5
c3f32f78534112015cf4d699f5b04710
-
SHA1
4a74121c472eef06276f865230593a02beb0fc96
-
SHA256
6429b64f6c646bd62be3c16f90547fd09697f52db30ba13ba606592e01660af8
-
SHA512
bd16b68dbf9d8301aaf05da86da21f10daad4d3b7520a0bae4ebc3e4642c5d015156b9cef41e2a62eedcf4ec33cebe091d309d16f138ecf8bdbaa7d737029453
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjR:ymb3NkkiQ3mdBjFI4Vh
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/3068-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/660-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2632 hthnbb.exe 2676 hnntnt.exe 2528 vjvdp.exe 2700 fffrflx.exe 2576 9xxxlrx.exe 2596 3nhbnn.exe 2988 jdvjp.exe 2560 vppvj.exe 2160 xxlxlrl.exe 2812 bbbnth.exe 2212 9bbbnt.exe 2256 ppdvv.exe 784 9jdvv.exe 2960 xrxlrfx.exe 2412 1rlrrrf.exe 592 7nthnb.exe 644 5nttbt.exe 2220 1ddvv.exe 2248 1pjpv.exe 2944 lllrllf.exe 1836 xfxflxl.exe 1004 bttttn.exe 1524 5jddp.exe 944 jdjvv.exe 1376 lllrlrx.exe 1056 lffrffr.exe 3032 hhtnnb.exe 1492 nnnthb.exe 2324 5djvd.exe 2604 9pppv.exe 660 lxlxlfx.exe 2672 hnbnbt.exe 1444 1tnhnt.exe 2768 pjvpv.exe 2712 9dvdj.exe 2684 llxlrxf.exe 2660 xrffrrf.exe 2636 rrrrlrl.exe 2644 nhbntb.exe 2552 bntbhh.exe 2000 dvjjj.exe 340 jvjdp.exe 2408 5lflllr.exe 2164 hhbtbn.exe 2060 bthtbh.exe 596 ddvjj.exe 380 vpjpd.exe 1664 llfrxrx.exe 1660 tthntb.exe 2580 hnnbbn.exe 2864 dvpjj.exe 2412 pjvjv.exe 1032 xflffxr.exe 696 lfxlfff.exe 644 ttthnb.exe 2252 htnntb.exe 1608 7pjjv.exe 448 dvjdj.exe 2116 9lflxxf.exe 1836 fflrfrf.exe 1936 bhhnbh.exe 968 nntntn.exe 1240 1pvpv.exe 980 dvpdp.exe -
resource yara_rule behavioral1/memory/3068-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/660-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2632 3068 c3f32f78534112015cf4d699f5b04710N.exe 30 PID 3068 wrote to memory of 2632 3068 c3f32f78534112015cf4d699f5b04710N.exe 30 PID 3068 wrote to memory of 2632 3068 c3f32f78534112015cf4d699f5b04710N.exe 30 PID 3068 wrote to memory of 2632 3068 c3f32f78534112015cf4d699f5b04710N.exe 30 PID 2632 wrote to memory of 2676 2632 hthnbb.exe 31 PID 2632 wrote to memory of 2676 2632 hthnbb.exe 31 PID 2632 wrote to memory of 2676 2632 hthnbb.exe 31 PID 2632 wrote to memory of 2676 2632 hthnbb.exe 31 PID 2676 wrote to memory of 2528 2676 hnntnt.exe 32 PID 2676 wrote to memory of 2528 2676 hnntnt.exe 32 PID 2676 wrote to memory of 2528 2676 hnntnt.exe 32 PID 2676 wrote to memory of 2528 2676 hnntnt.exe 32 PID 2528 wrote to memory of 2700 2528 vjvdp.exe 33 PID 2528 wrote to memory of 2700 2528 vjvdp.exe 33 PID 2528 wrote to memory of 2700 2528 vjvdp.exe 33 PID 2528 wrote to memory of 2700 2528 vjvdp.exe 33 PID 2700 wrote to memory of 2576 2700 fffrflx.exe 34 PID 2700 wrote to memory of 2576 2700 fffrflx.exe 34 PID 2700 wrote to memory of 2576 2700 fffrflx.exe 34 PID 2700 wrote to memory of 2576 2700 fffrflx.exe 34 PID 2576 wrote to memory of 2596 2576 9xxxlrx.exe 35 PID 2576 wrote to memory of 2596 2576 9xxxlrx.exe 35 PID 2576 wrote to memory of 2596 2576 9xxxlrx.exe 35 PID 2576 wrote to memory of 2596 2576 9xxxlrx.exe 35 PID 2596 wrote to memory of 2988 2596 3nhbnn.exe 36 PID 2596 wrote to memory of 2988 2596 3nhbnn.exe 36 PID 2596 wrote to memory of 2988 2596 3nhbnn.exe 36 PID 2596 wrote to memory of 2988 2596 3nhbnn.exe 36 PID 2988 wrote to memory of 2560 2988 jdvjp.exe 37 PID 2988 wrote to memory of 2560 2988 jdvjp.exe 37 PID 2988 wrote to memory of 2560 2988 jdvjp.exe 37 PID 2988 wrote to memory of 2560 2988 jdvjp.exe 37 PID 2560 wrote to memory of 2160 2560 vppvj.exe 38 PID 2560 wrote to memory of 2160 2560 vppvj.exe 38 PID 2560 wrote to memory of 2160 2560 vppvj.exe 38 PID 2560 wrote to memory of 2160 2560 vppvj.exe 38 PID 2160 wrote to memory of 2812 2160 xxlxlrl.exe 39 PID 2160 wrote to memory of 2812 2160 xxlxlrl.exe 39 PID 2160 wrote to memory of 2812 2160 xxlxlrl.exe 39 PID 2160 wrote to memory of 2812 2160 xxlxlrl.exe 39 PID 2812 wrote to memory of 2212 2812 bbbnth.exe 40 PID 2812 wrote to memory of 2212 2812 bbbnth.exe 40 PID 2812 wrote to memory of 2212 2812 bbbnth.exe 40 PID 2812 wrote to memory of 2212 2812 bbbnth.exe 40 PID 2212 wrote to memory of 2256 2212 9bbbnt.exe 41 PID 2212 wrote to memory of 2256 2212 9bbbnt.exe 41 PID 2212 wrote to memory of 2256 2212 9bbbnt.exe 41 PID 2212 wrote to memory of 2256 2212 9bbbnt.exe 41 PID 2256 wrote to memory of 784 2256 ppdvv.exe 42 PID 2256 wrote to memory of 784 2256 ppdvv.exe 42 PID 2256 wrote to memory of 784 2256 ppdvv.exe 42 PID 2256 wrote to memory of 784 2256 ppdvv.exe 42 PID 784 wrote to memory of 2960 784 9jdvv.exe 43 PID 784 wrote to memory of 2960 784 9jdvv.exe 43 PID 784 wrote to memory of 2960 784 9jdvv.exe 43 PID 784 wrote to memory of 2960 784 9jdvv.exe 43 PID 2960 wrote to memory of 2412 2960 xrxlrfx.exe 44 PID 2960 wrote to memory of 2412 2960 xrxlrfx.exe 44 PID 2960 wrote to memory of 2412 2960 xrxlrfx.exe 44 PID 2960 wrote to memory of 2412 2960 xrxlrfx.exe 44 PID 2412 wrote to memory of 592 2412 1rlrrrf.exe 45 PID 2412 wrote to memory of 592 2412 1rlrrrf.exe 45 PID 2412 wrote to memory of 592 2412 1rlrrrf.exe 45 PID 2412 wrote to memory of 592 2412 1rlrrrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3f32f78534112015cf4d699f5b04710N.exe"C:\Users\Admin\AppData\Local\Temp\c3f32f78534112015cf4d699f5b04710N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\hthnbb.exec:\hthnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hnntnt.exec:\hnntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vjvdp.exec:\vjvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\fffrflx.exec:\fffrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\9xxxlrx.exec:\9xxxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\3nhbnn.exec:\3nhbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jdvjp.exec:\jdvjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vppvj.exec:\vppvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xxlxlrl.exec:\xxlxlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\bbbnth.exec:\bbbnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9bbbnt.exec:\9bbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ppdvv.exec:\ppdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\9jdvv.exec:\9jdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\xrxlrfx.exec:\xrxlrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\1rlrrrf.exec:\1rlrrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\7nthnb.exec:\7nthnb.exe17⤵
- Executes dropped EXE
PID:592 -
\??\c:\5nttbt.exec:\5nttbt.exe18⤵
- Executes dropped EXE
PID:644 -
\??\c:\1ddvv.exec:\1ddvv.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1pjpv.exec:\1pjpv.exe20⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lllrllf.exec:\lllrllf.exe21⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xfxflxl.exec:\xfxflxl.exe22⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bttttn.exec:\bttttn.exe23⤵
- Executes dropped EXE
PID:1004 -
\??\c:\5jddp.exec:\5jddp.exe24⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jdjvv.exec:\jdjvv.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\lllrlrx.exec:\lllrlrx.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lffrffr.exec:\lffrffr.exe27⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hhtnnb.exec:\hhtnnb.exe28⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nnnthb.exec:\nnnthb.exe29⤵
- Executes dropped EXE
PID:1492 -
\??\c:\5djvd.exec:\5djvd.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9pppv.exec:\9pppv.exe31⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lxlxlfx.exec:\lxlxlfx.exe32⤵
- Executes dropped EXE
PID:660 -
\??\c:\hnbnbt.exec:\hnbnbt.exe33⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1tnhnt.exec:\1tnhnt.exe34⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pjvpv.exec:\pjvpv.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9dvdj.exec:\9dvdj.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\llxlrxf.exec:\llxlrxf.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xrffrrf.exec:\xrffrrf.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nhbntb.exec:\nhbntb.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bntbhh.exec:\bntbhh.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvjjj.exec:\dvjjj.exe42⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jvjdp.exec:\jvjdp.exe43⤵
- Executes dropped EXE
PID:340 -
\??\c:\5lflllr.exec:\5lflllr.exe44⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hhbtbn.exec:\hhbtbn.exe45⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bthtbh.exec:\bthtbh.exe46⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddvjj.exec:\ddvjj.exe47⤵
- Executes dropped EXE
PID:596 -
\??\c:\vpjpd.exec:\vpjpd.exe48⤵
- Executes dropped EXE
PID:380 -
\??\c:\llfrxrx.exec:\llfrxrx.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1664 -
\??\c:\tthntb.exec:\tthntb.exe50⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hnnbbn.exec:\hnnbbn.exe51⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvpjj.exec:\dvpjj.exe52⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pjvjv.exec:\pjvjv.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xflffxr.exec:\xflffxr.exe54⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lfxlfff.exec:\lfxlfff.exe55⤵
- Executes dropped EXE
PID:696 -
\??\c:\ttthnb.exec:\ttthnb.exe56⤵
- Executes dropped EXE
PID:644 -
\??\c:\htnntb.exec:\htnntb.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7pjjv.exec:\7pjjv.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dvjdj.exec:\dvjdj.exe59⤵
- Executes dropped EXE
PID:448 -
\??\c:\9lflxxf.exec:\9lflxxf.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fflrfrf.exec:\fflrfrf.exe61⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bhhnbh.exec:\bhhnbh.exe62⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nntntn.exec:\nntntn.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\1pvpv.exec:\1pvpv.exe64⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dvpdp.exec:\dvpdp.exe65⤵
- Executes dropped EXE
PID:980 -
\??\c:\rlrxflx.exec:\rlrxflx.exe66⤵PID:776
-
\??\c:\tnthhn.exec:\tnthhn.exe67⤵PID:1216
-
\??\c:\thbhnt.exec:\thbhnt.exe68⤵PID:2156
-
\??\c:\7vvvd.exec:\7vvvd.exe69⤵PID:1952
-
\??\c:\vvpdj.exec:\vvpdj.exe70⤵PID:1956
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe71⤵PID:2292
-
\??\c:\xrrlfrf.exec:\xrrlfrf.exe72⤵PID:1644
-
\??\c:\bbhbbt.exec:\bbhbbt.exe73⤵PID:1288
-
\??\c:\1hhhbb.exec:\1hhhbb.exe74⤵PID:2732
-
\??\c:\jjdjj.exec:\jjdjj.exe75⤵PID:2764
-
\??\c:\lxffxlx.exec:\lxffxlx.exe76⤵PID:2268
-
\??\c:\7lllxlr.exec:\7lllxlr.exe77⤵PID:2680
-
\??\c:\hthttt.exec:\hthttt.exe78⤵PID:2192
-
\??\c:\9nhhnb.exec:\9nhhnb.exe79⤵PID:2696
-
\??\c:\jjdvj.exec:\jjdvj.exe80⤵PID:2840
-
\??\c:\dvjvv.exec:\dvjvv.exe81⤵PID:2564
-
\??\c:\ffffflx.exec:\ffffflx.exe82⤵PID:2668
-
\??\c:\xrlfxxf.exec:\xrlfxxf.exe83⤵PID:1748
-
\??\c:\5lxfxlr.exec:\5lxfxlr.exe84⤵PID:3008
-
\??\c:\bbtthn.exec:\bbtthn.exe85⤵PID:2400
-
\??\c:\nbnntb.exec:\nbnntb.exe86⤵PID:2200
-
\??\c:\5vpdd.exec:\5vpdd.exe87⤵PID:2344
-
\??\c:\jdpdp.exec:\jdpdp.exe88⤵PID:2332
-
\??\c:\3rfllxf.exec:\3rfllxf.exe89⤵PID:1672
-
\??\c:\xrlfrff.exec:\xrlfrff.exe90⤵PID:568
-
\??\c:\thtntt.exec:\thtntt.exe91⤵PID:2592
-
\??\c:\dvpdp.exec:\dvpdp.exe92⤵PID:2956
-
\??\c:\dvpvd.exec:\dvpvd.exe93⤵PID:2008
-
\??\c:\xxxllfr.exec:\xxxllfr.exe94⤵PID:2864
-
\??\c:\3lrflxx.exec:\3lrflxx.exe95⤵PID:2368
-
\??\c:\9lxflrf.exec:\9lxflrf.exe96⤵PID:1032
-
\??\c:\nhthbh.exec:\nhthbh.exe97⤵PID:3064
-
\??\c:\9bntbh.exec:\9bntbh.exe98⤵PID:2220
-
\??\c:\dvpdv.exec:\dvpdv.exe99⤵PID:2740
-
\??\c:\pdpvv.exec:\pdpvv.exe100⤵PID:1060
-
\??\c:\rrfxllf.exec:\rrfxllf.exe101⤵PID:2204
-
\??\c:\lrllxfl.exec:\lrllxfl.exe102⤵PID:1632
-
\??\c:\bbtbtt.exec:\bbtbtt.exe103⤵PID:316
-
\??\c:\hhbhtt.exec:\hhbhtt.exe104⤵PID:564
-
\??\c:\hhhtbh.exec:\hhhtbh.exe105⤵PID:1788
-
\??\c:\5vpvd.exec:\5vpvd.exe106⤵PID:3028
-
\??\c:\pjdpv.exec:\pjdpv.exe107⤵PID:1656
-
\??\c:\rlrxrfr.exec:\rlrxrfr.exe108⤵PID:1056
-
\??\c:\xrlfllr.exec:\xrlfllr.exe109⤵PID:2360
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe110⤵PID:2156
-
\??\c:\btbhtb.exec:\btbhtb.exe111⤵PID:276
-
\??\c:\hbtbhh.exec:\hbtbhh.exe112⤵PID:900
-
\??\c:\dvjvd.exec:\dvjvd.exe113⤵PID:2244
-
\??\c:\dpddj.exec:\dpddj.exe114⤵PID:2716
-
\??\c:\rrlfxlr.exec:\rrlfxlr.exe115⤵PID:2720
-
\??\c:\rllrlfr.exec:\rllrlfr.exe116⤵PID:2632
-
\??\c:\xxllxfx.exec:\xxllxfx.exe117⤵PID:1564
-
\??\c:\ttttht.exec:\ttttht.exe118⤵PID:2640
-
\??\c:\thntnb.exec:\thntnb.exe119⤵PID:2780
-
\??\c:\vjvjp.exec:\vjvjp.exe120⤵PID:2660
-
\??\c:\rffxllr.exec:\rffxllr.exe121⤵PID:2524
-
\??\c:\rlxlflr.exec:\rlxlflr.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-