Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
611add48cf659fa4a6b087e5e24760c0N.exe
Resource
win7-20240729-en
General
-
Target
611add48cf659fa4a6b087e5e24760c0N.exe
-
Size
74KB
-
MD5
611add48cf659fa4a6b087e5e24760c0
-
SHA1
08234f9d305a7e7901b5b91c0d72d816713d8476
-
SHA256
b99adcc758adb65c1a32f4b55473160a24699c7e631aea031f16faf428d5347d
-
SHA512
d048599818e5819e6b73561383cd7f27ea2aa477ce0474159a61c41a6628d054300d1bf11c996f722deec75b7388572bf19c1580dd6ce06a441d78ea193649a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPS:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHv
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/568-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/404-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/472-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1908 llxlxfl.exe 1436 3nnthh.exe 2700 pvddd.exe 2704 hbntbb.exe 2860 vvpdp.exe 2732 ttbbbb.exe 2616 dvjvj.exe 2384 rfrffxf.exe 404 bbntbb.exe 1716 jdvpd.exe 2460 llrlrfl.exe 1952 5bthbb.exe 2424 bbntbn.exe 2428 9jpvd.exe 2480 lfllffr.exe 472 3bhthn.exe 1848 5tthht.exe 2980 pjdjd.exe 2140 7ffxrrl.exe 2364 thbttb.exe 2016 hbntnb.exe 2176 3ddpj.exe 756 rrrrflr.exe 1212 fxxllrf.exe 1784 tbbnhn.exe 2936 dddjv.exe 1316 5rlfrlx.exe 2332 bbhhtt.exe 1896 pjpvj.exe 1232 vddpj.exe 2452 rrlrrxx.exe 2724 tnhttb.exe 2808 9jvjv.exe 2824 flflxfx.exe 2720 rlxfrrl.exe 3032 tnnbnt.exe 2784 1vvpd.exe 2684 vvpdj.exe 2708 fxfllrl.exe 2732 xrfxfll.exe 2716 btnbtb.exe 2068 dvddj.exe 1032 ddvdv.exe 804 9rlrlrf.exe 1840 9lffrlf.exe 1512 hhtbnb.exe 2160 jjdjd.exe 1952 dvdjj.exe 2636 rrxxfrf.exe 1860 btnnhh.exe 2116 nnhnnb.exe 684 jjdjd.exe 1492 flxfxxx.exe 2180 xrllrxl.exe 2356 nthhth.exe 2388 jjppv.exe 2188 pvjjj.exe 2208 7xxflll.exe 1016 xxrxrxl.exe 948 hbntbh.exe 980 hnhbnb.exe 1696 vvpjj.exe 1260 lfrxffl.exe 1712 llflxfr.exe -
resource yara_rule behavioral1/memory/568-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/404-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/472-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 568 wrote to memory of 1908 568 611add48cf659fa4a6b087e5e24760c0N.exe 30 PID 568 wrote to memory of 1908 568 611add48cf659fa4a6b087e5e24760c0N.exe 30 PID 568 wrote to memory of 1908 568 611add48cf659fa4a6b087e5e24760c0N.exe 30 PID 568 wrote to memory of 1908 568 611add48cf659fa4a6b087e5e24760c0N.exe 30 PID 1908 wrote to memory of 1436 1908 llxlxfl.exe 31 PID 1908 wrote to memory of 1436 1908 llxlxfl.exe 31 PID 1908 wrote to memory of 1436 1908 llxlxfl.exe 31 PID 1908 wrote to memory of 1436 1908 llxlxfl.exe 31 PID 1436 wrote to memory of 2700 1436 3nnthh.exe 32 PID 1436 wrote to memory of 2700 1436 3nnthh.exe 32 PID 1436 wrote to memory of 2700 1436 3nnthh.exe 32 PID 1436 wrote to memory of 2700 1436 3nnthh.exe 32 PID 2700 wrote to memory of 2704 2700 pvddd.exe 33 PID 2700 wrote to memory of 2704 2700 pvddd.exe 33 PID 2700 wrote to memory of 2704 2700 pvddd.exe 33 PID 2700 wrote to memory of 2704 2700 pvddd.exe 33 PID 2704 wrote to memory of 2860 2704 hbntbb.exe 34 PID 2704 wrote to memory of 2860 2704 hbntbb.exe 34 PID 2704 wrote to memory of 2860 2704 hbntbb.exe 34 PID 2704 wrote to memory of 2860 2704 hbntbb.exe 34 PID 2860 wrote to memory of 2732 2860 vvpdp.exe 35 PID 2860 wrote to memory of 2732 2860 vvpdp.exe 35 PID 2860 wrote to memory of 2732 2860 vvpdp.exe 35 PID 2860 wrote to memory of 2732 2860 vvpdp.exe 35 PID 2732 wrote to memory of 2616 2732 ttbbbb.exe 36 PID 2732 wrote to memory of 2616 2732 ttbbbb.exe 36 PID 2732 wrote to memory of 2616 2732 ttbbbb.exe 36 PID 2732 wrote to memory of 2616 2732 ttbbbb.exe 36 PID 2616 wrote to memory of 2384 2616 dvjvj.exe 37 PID 2616 wrote to memory of 2384 2616 dvjvj.exe 37 PID 2616 wrote to memory of 2384 2616 dvjvj.exe 37 PID 2616 wrote to memory of 2384 2616 dvjvj.exe 37 PID 2384 wrote to memory of 404 2384 rfrffxf.exe 38 PID 2384 wrote to memory of 404 2384 rfrffxf.exe 38 PID 2384 wrote to memory of 404 2384 rfrffxf.exe 38 PID 2384 wrote to memory of 404 2384 rfrffxf.exe 38 PID 404 wrote to memory of 1716 404 bbntbb.exe 39 PID 404 wrote to memory of 1716 404 bbntbb.exe 39 PID 404 wrote to memory of 1716 404 bbntbb.exe 39 PID 404 wrote to memory of 1716 404 bbntbb.exe 39 PID 1716 wrote to memory of 2460 1716 jdvpd.exe 40 PID 1716 wrote to memory of 2460 1716 jdvpd.exe 40 PID 1716 wrote to memory of 2460 1716 jdvpd.exe 40 PID 1716 wrote to memory of 2460 1716 jdvpd.exe 40 PID 2460 wrote to memory of 1952 2460 llrlrfl.exe 41 PID 2460 wrote to memory of 1952 2460 llrlrfl.exe 41 PID 2460 wrote to memory of 1952 2460 llrlrfl.exe 41 PID 2460 wrote to memory of 1952 2460 llrlrfl.exe 41 PID 1952 wrote to memory of 2424 1952 5bthbb.exe 42 PID 1952 wrote to memory of 2424 1952 5bthbb.exe 42 PID 1952 wrote to memory of 2424 1952 5bthbb.exe 42 PID 1952 wrote to memory of 2424 1952 5bthbb.exe 42 PID 2424 wrote to memory of 2428 2424 bbntbn.exe 43 PID 2424 wrote to memory of 2428 2424 bbntbn.exe 43 PID 2424 wrote to memory of 2428 2424 bbntbn.exe 43 PID 2424 wrote to memory of 2428 2424 bbntbn.exe 43 PID 2428 wrote to memory of 2480 2428 9jpvd.exe 44 PID 2428 wrote to memory of 2480 2428 9jpvd.exe 44 PID 2428 wrote to memory of 2480 2428 9jpvd.exe 44 PID 2428 wrote to memory of 2480 2428 9jpvd.exe 44 PID 2480 wrote to memory of 472 2480 lfllffr.exe 45 PID 2480 wrote to memory of 472 2480 lfllffr.exe 45 PID 2480 wrote to memory of 472 2480 lfllffr.exe 45 PID 2480 wrote to memory of 472 2480 lfllffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\611add48cf659fa4a6b087e5e24760c0N.exe"C:\Users\Admin\AppData\Local\Temp\611add48cf659fa4a6b087e5e24760c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\llxlxfl.exec:\llxlxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\3nnthh.exec:\3nnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\pvddd.exec:\pvddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hbntbb.exec:\hbntbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vvpdp.exec:\vvpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ttbbbb.exec:\ttbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dvjvj.exec:\dvjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rfrffxf.exec:\rfrffxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\bbntbb.exec:\bbntbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\jdvpd.exec:\jdvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\llrlrfl.exec:\llrlrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\5bthbb.exec:\5bthbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\bbntbn.exec:\bbntbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\9jpvd.exec:\9jpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\lfllffr.exec:\lfllffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\3bhthn.exec:\3bhthn.exe17⤵
- Executes dropped EXE
PID:472 -
\??\c:\5tthht.exec:\5tthht.exe18⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pjdjd.exec:\pjdjd.exe19⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe20⤵
- Executes dropped EXE
PID:2140 -
\??\c:\thbttb.exec:\thbttb.exe21⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hbntnb.exec:\hbntnb.exe22⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3ddpj.exec:\3ddpj.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rrrrflr.exec:\rrrrflr.exe24⤵
- Executes dropped EXE
PID:756 -
\??\c:\fxxllrf.exec:\fxxllrf.exe25⤵
- Executes dropped EXE
PID:1212 -
\??\c:\tbbnhn.exec:\tbbnhn.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dddjv.exec:\dddjv.exe27⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5rlfrlx.exec:\5rlfrlx.exe28⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bbhhtt.exec:\bbhhtt.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pjpvj.exec:\pjpvj.exe30⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vddpj.exec:\vddpj.exe31⤵
- Executes dropped EXE
PID:1232 -
\??\c:\rrlrrxx.exec:\rrlrrxx.exe32⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnhttb.exec:\tnhttb.exe33⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9jvjv.exec:\9jvjv.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\flflxfx.exec:\flflxfx.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tnnbnt.exec:\tnnbnt.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1vvpd.exec:\1vvpd.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vvpdj.exec:\vvpdj.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fxfllrl.exec:\fxfllrl.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xrfxfll.exec:\xrfxfll.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\btnbtb.exec:\btnbtb.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dvddj.exec:\dvddj.exe43⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ddvdv.exec:\ddvdv.exe44⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9rlrlrf.exec:\9rlrlrf.exe45⤵
- Executes dropped EXE
PID:804 -
\??\c:\9lffrlf.exec:\9lffrlf.exe46⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hhtbnb.exec:\hhtbnb.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jjdjd.exec:\jjdjd.exe48⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dvdjj.exec:\dvdjj.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrxxfrf.exec:\rrxxfrf.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btnnhh.exec:\btnnhh.exe51⤵
- Executes dropped EXE
PID:1860 -
\??\c:\nnhnnb.exec:\nnhnnb.exe52⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jjdjd.exec:\jjdjd.exe53⤵
- Executes dropped EXE
PID:684 -
\??\c:\flxfxxx.exec:\flxfxxx.exe54⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xrllrxl.exec:\xrllrxl.exe55⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nthhth.exec:\nthhth.exe56⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jjppv.exec:\jjppv.exe57⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pvjjj.exec:\pvjjj.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7xxflll.exec:\7xxflll.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe60⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hbntbh.exec:\hbntbh.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\hnhbnb.exec:\hnhbnb.exe62⤵
- Executes dropped EXE
PID:980 -
\??\c:\vvpjj.exec:\vvpjj.exe63⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lfrxffl.exec:\lfrxffl.exe64⤵
- Executes dropped EXE
PID:1260 -
\??\c:\llflxfr.exec:\llflxfr.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nnbthb.exec:\nnbthb.exe66⤵PID:780
-
\??\c:\hhbntb.exec:\hhbntb.exe67⤵PID:1640
-
\??\c:\9pdjp.exec:\9pdjp.exe68⤵PID:2476
-
\??\c:\vvpjp.exec:\vvpjp.exe69⤵PID:764
-
\??\c:\rrflrlf.exec:\rrflrlf.exe70⤵PID:2440
-
\??\c:\1rrfrxr.exec:\1rrfrxr.exe71⤵PID:376
-
\??\c:\nnhttb.exec:\nnhttb.exe72⤵PID:2740
-
\??\c:\vvvjv.exec:\vvvjv.exe73⤵PID:2736
-
\??\c:\vdppd.exec:\vdppd.exe74⤵PID:1572
-
\??\c:\lllllrf.exec:\lllllrf.exe75⤵PID:2820
-
\??\c:\bthnbt.exec:\bthnbt.exe76⤵PID:2828
-
\??\c:\tnbhnt.exec:\tnbhnt.exe77⤵PID:2704
-
\??\c:\7jdvp.exec:\7jdvp.exe78⤵PID:3016
-
\??\c:\pvvvd.exec:\pvvvd.exe79⤵PID:2644
-
\??\c:\rrxrxxx.exec:\rrxrxxx.exe80⤵PID:2640
-
\??\c:\hhbbbh.exec:\hhbbbh.exe81⤵PID:2652
-
\??\c:\7bnnhn.exec:\7bnnhn.exe82⤵PID:2108
-
\??\c:\vpddj.exec:\vpddj.exe83⤵PID:2376
-
\??\c:\ddpjp.exec:\ddpjp.exe84⤵
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\fxlrflf.exec:\fxlrflf.exe85⤵PID:2092
-
\??\c:\3nnbht.exec:\3nnbht.exe86⤵PID:1976
-
\??\c:\ttbbht.exec:\ttbbht.exe87⤵PID:2280
-
\??\c:\dvpdp.exec:\dvpdp.exe88⤵PID:1956
-
\??\c:\ddpjd.exec:\ddpjd.exe89⤵PID:2516
-
\??\c:\xxllflr.exec:\xxllflr.exe90⤵PID:2424
-
\??\c:\7hthht.exec:\7hthht.exe91⤵PID:2256
-
\??\c:\nnbhhb.exec:\nnbhhb.exe92⤵PID:2576
-
\??\c:\7dvvj.exec:\7dvvj.exe93⤵PID:2580
-
\??\c:\vdpjj.exec:\vdpjj.exe94⤵PID:1632
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe95⤵PID:1848
-
\??\c:\hbtthn.exec:\hbtthn.exe96⤵PID:1548
-
\??\c:\thtnnh.exec:\thtnnh.exe97⤵PID:1408
-
\??\c:\djpdp.exec:\djpdp.exe98⤵PID:2392
-
\??\c:\dddpp.exec:\dddpp.exe99⤵PID:2396
-
\??\c:\3frlrxr.exec:\3frlrxr.exe100⤵PID:1756
-
\??\c:\rrrfflr.exec:\rrrfflr.exe101⤵PID:2016
-
\??\c:\9tnhhh.exec:\9tnhhh.exe102⤵PID:836
-
\??\c:\hbbbhb.exec:\hbbbhb.exe103⤵PID:2360
-
\??\c:\7pjjd.exec:\7pjjd.exe104⤵PID:1784
-
\??\c:\xxlxflx.exec:\xxlxflx.exe105⤵PID:1336
-
\??\c:\1rlrlrx.exec:\1rlrlrx.exe106⤵PID:3056
-
\??\c:\hbbbbh.exec:\hbbbbh.exe107⤵PID:2336
-
\??\c:\9nntbb.exec:\9nntbb.exe108⤵PID:2904
-
\??\c:\vpdpv.exec:\vpdpv.exe109⤵PID:868
-
\??\c:\lxrlrrf.exec:\lxrlrrf.exe110⤵PID:1428
-
\??\c:\lflxxxf.exec:\lflxxxf.exe111⤵PID:1972
-
\??\c:\hbnhtt.exec:\hbnhtt.exe112⤵PID:1908
-
\??\c:\1dvdv.exec:\1dvdv.exe113⤵PID:1596
-
\??\c:\rlrxlxf.exec:\rlrxlxf.exe114⤵PID:1052
-
\??\c:\1fxflrf.exec:\1fxflrf.exe115⤵PID:2368
-
\??\c:\bbtttb.exec:\bbtttb.exe116⤵PID:2868
-
\??\c:\nnbbbb.exec:\nnbbbb.exe117⤵PID:2624
-
\??\c:\vppvv.exec:\vppvv.exe118⤵PID:2756
-
\??\c:\jvjdj.exec:\jvjdj.exe119⤵PID:2832
-
\??\c:\xrrrrxl.exec:\xrrrrxl.exe120⤵PID:2612
-
\??\c:\rrrffff.exec:\rrrffff.exe121⤵PID:2768
-
\??\c:\7nhhtn.exec:\7nhhtn.exe122⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-