Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe
Resource
win7-20240708-en
General
-
Target
d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe
-
Size
590KB
-
MD5
f2a764bb54e03f4a6388d1a7c7aa78e0
-
SHA1
aa9573570e345434caf6b289da4f84c09a16d806
-
SHA256
d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7
-
SHA512
d96acdff66c97c1adb96477318d61601713aa7e6090c1c6d4bb0e7b843210551a011ad9811705ae263294ae8a7530325a5c575bc92874c727360363a6b9a16a1
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayB:n3C9Lebz+xt4vFeFmgayB
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1324 dvjvd.exe 2740 fflxrxf.exe 2692 xxlrfrr.exe 2868 bthhtt.exe 2668 fxlrflr.exe 2576 1pjpd.exe 2604 7tttnb.exe 2620 hhhhnn.exe 2184 3hbbhh.exe 1372 vppjp.exe 2780 pddpp.exe 1196 7tnttt.exe 2648 9xlfllx.exe 2312 fxlrxfl.exe 1472 9bbbnt.exe 1580 ddpjv.exe 2220 rrlxlxr.exe 3048 5ddvj.exe 2996 xxrxlxl.exe 1628 btbhhh.exe 2936 1vpjv.exe 1820 vpjpd.exe 1080 fxlrflx.exe 1988 hhntbh.exe 1656 pjvpv.exe 560 9rfllrx.exe 2236 ttnhbb.exe 2328 1vjpv.exe 864 fxxfrlx.exe 1984 btnnbh.exe 1596 xrrflll.exe 2892 1bbbhn.exe 2688 vvvdj.exe 2864 1ppdp.exe 2292 3hbhtb.exe 2868 tthnbh.exe 2752 vvjvj.exe 2720 fxlrxfl.exe 2560 rrffrxf.exe 2604 tnhntn.exe 2216 hbtbnn.exe 2064 pvppv.exe 396 9vppv.exe 2784 3ffrfrr.exe 2916 7nhnhh.exe 2760 jvdjd.exe 2756 fflfllf.exe 1492 fxrlflx.exe 1740 3bhtnb.exe 2000 bhnbbt.exe 1884 vpjpp.exe 2208 xrrxfrx.exe 2532 xlrxfll.exe 936 btntbb.exe 2944 pjppp.exe 2936 vjpvd.exe 1608 1rfxfxf.exe 848 tttntb.exe 2156 btbhnt.exe 1076 dvjjp.exe 2148 ppdpd.exe 3020 9fxfxlr.exe 2236 tnnbhn.exe 2188 nnbbbb.exe -
resource yara_rule behavioral1/memory/1984-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-131-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1324 1984 d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe 31 PID 1984 wrote to memory of 1324 1984 d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe 31 PID 1984 wrote to memory of 1324 1984 d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe 31 PID 1984 wrote to memory of 1324 1984 d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe 31 PID 1324 wrote to memory of 2740 1324 dvjvd.exe 32 PID 1324 wrote to memory of 2740 1324 dvjvd.exe 32 PID 1324 wrote to memory of 2740 1324 dvjvd.exe 32 PID 1324 wrote to memory of 2740 1324 dvjvd.exe 32 PID 2740 wrote to memory of 2692 2740 fflxrxf.exe 33 PID 2740 wrote to memory of 2692 2740 fflxrxf.exe 33 PID 2740 wrote to memory of 2692 2740 fflxrxf.exe 33 PID 2740 wrote to memory of 2692 2740 fflxrxf.exe 33 PID 2692 wrote to memory of 2868 2692 xxlrfrr.exe 66 PID 2692 wrote to memory of 2868 2692 xxlrfrr.exe 66 PID 2692 wrote to memory of 2868 2692 xxlrfrr.exe 66 PID 2692 wrote to memory of 2868 2692 xxlrfrr.exe 66 PID 2868 wrote to memory of 2668 2868 bthhtt.exe 35 PID 2868 wrote to memory of 2668 2868 bthhtt.exe 35 PID 2868 wrote to memory of 2668 2868 bthhtt.exe 35 PID 2868 wrote to memory of 2668 2868 bthhtt.exe 35 PID 2668 wrote to memory of 2576 2668 fxlrflr.exe 36 PID 2668 wrote to memory of 2576 2668 fxlrflr.exe 36 PID 2668 wrote to memory of 2576 2668 fxlrflr.exe 36 PID 2668 wrote to memory of 2576 2668 fxlrflr.exe 36 PID 2576 wrote to memory of 2604 2576 1pjpd.exe 108 PID 2576 wrote to memory of 2604 2576 1pjpd.exe 108 PID 2576 wrote to memory of 2604 2576 1pjpd.exe 108 PID 2576 wrote to memory of 2604 2576 1pjpd.exe 108 PID 2604 wrote to memory of 2620 2604 7tttnb.exe 38 PID 2604 wrote to memory of 2620 2604 7tttnb.exe 38 PID 2604 wrote to memory of 2620 2604 7tttnb.exe 38 PID 2604 wrote to memory of 2620 2604 7tttnb.exe 38 PID 2620 wrote to memory of 2184 2620 hhhhnn.exe 39 PID 2620 wrote to memory of 2184 2620 hhhhnn.exe 39 PID 2620 wrote to memory of 2184 2620 hhhhnn.exe 39 PID 2620 wrote to memory of 2184 2620 hhhhnn.exe 39 PID 2184 wrote to memory of 1372 2184 3hbbhh.exe 40 PID 2184 wrote to memory of 1372 2184 3hbbhh.exe 40 PID 2184 wrote to memory of 1372 2184 3hbbhh.exe 40 PID 2184 wrote to memory of 1372 2184 3hbbhh.exe 40 PID 1372 wrote to memory of 2780 1372 vppjp.exe 41 PID 1372 wrote to memory of 2780 1372 vppjp.exe 41 PID 1372 wrote to memory of 2780 1372 vppjp.exe 41 PID 1372 wrote to memory of 2780 1372 vppjp.exe 41 PID 2780 wrote to memory of 1196 2780 pddpp.exe 42 PID 2780 wrote to memory of 1196 2780 pddpp.exe 42 PID 2780 wrote to memory of 1196 2780 pddpp.exe 42 PID 2780 wrote to memory of 1196 2780 pddpp.exe 42 PID 1196 wrote to memory of 2648 1196 7tnttt.exe 43 PID 1196 wrote to memory of 2648 1196 7tnttt.exe 43 PID 1196 wrote to memory of 2648 1196 7tnttt.exe 43 PID 1196 wrote to memory of 2648 1196 7tnttt.exe 43 PID 2648 wrote to memory of 2312 2648 9xlfllx.exe 44 PID 2648 wrote to memory of 2312 2648 9xlfllx.exe 44 PID 2648 wrote to memory of 2312 2648 9xlfllx.exe 44 PID 2648 wrote to memory of 2312 2648 9xlfllx.exe 44 PID 2312 wrote to memory of 1472 2312 fxlrxfl.exe 45 PID 2312 wrote to memory of 1472 2312 fxlrxfl.exe 45 PID 2312 wrote to memory of 1472 2312 fxlrxfl.exe 45 PID 2312 wrote to memory of 1472 2312 fxlrxfl.exe 45 PID 1472 wrote to memory of 1580 1472 9bbbnt.exe 46 PID 1472 wrote to memory of 1580 1472 9bbbnt.exe 46 PID 1472 wrote to memory of 1580 1472 9bbbnt.exe 46 PID 1472 wrote to memory of 1580 1472 9bbbnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe"C:\Users\Admin\AppData\Local\Temp\d53072307e680283f8539b05b929f38526abb8b8ad2115fee59a007f7cc48ac7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\dvjvd.exec:\dvjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\fflxrxf.exec:\fflxrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xxlrfrr.exec:\xxlrfrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bthhtt.exec:\bthhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\fxlrflr.exec:\fxlrflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1pjpd.exec:\1pjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7tttnb.exec:\7tttnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hhhhnn.exec:\hhhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3hbbhh.exec:\3hbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vppjp.exec:\vppjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\pddpp.exec:\pddpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7tnttt.exec:\7tnttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\9xlfllx.exec:\9xlfllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\9bbbnt.exec:\9bbbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\ddpjv.exec:\ddpjv.exe17⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rrlxlxr.exec:\rrlxlxr.exe18⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5ddvj.exec:\5ddvj.exe19⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\btbhhh.exec:\btbhhh.exe21⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1vpjv.exec:\1vpjv.exe22⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpjpd.exec:\vpjpd.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fxlrflx.exec:\fxlrflx.exe24⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hhntbh.exec:\hhntbh.exe25⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pjvpv.exec:\pjvpv.exe26⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9rfllrx.exec:\9rfllrx.exe27⤵
- Executes dropped EXE
PID:560 -
\??\c:\ttnhbb.exec:\ttnhbb.exe28⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1vjpv.exec:\1vjpv.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fxxfrlx.exec:\fxxfrlx.exe30⤵
- Executes dropped EXE
PID:864 -
\??\c:\btnnbh.exec:\btnnbh.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrrflll.exec:\xrrflll.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1bbbhn.exec:\1bbbhn.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vvvdj.exec:\vvvdj.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1ppdp.exec:\1ppdp.exe35⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3hbhtb.exec:\3hbhtb.exe36⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tthnbh.exec:\tthnbh.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vvjvj.exec:\vvjvj.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rrffrxf.exec:\rrffrxf.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tnhntn.exec:\tnhntn.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hbtbnn.exec:\hbtbnn.exe42⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pvppv.exec:\pvppv.exe43⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9vppv.exec:\9vppv.exe44⤵
- Executes dropped EXE
PID:396 -
\??\c:\3ffrfrr.exec:\3ffrfrr.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7nhnhh.exec:\7nhnhh.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jvdjd.exec:\jvdjd.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fflfllf.exec:\fflfllf.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fxrlflx.exec:\fxrlflx.exe49⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3bhtnb.exec:\3bhtnb.exe50⤵
- Executes dropped EXE
PID:1740 -
\??\c:\bhnbbt.exec:\bhnbbt.exe51⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vpjpp.exec:\vpjpp.exe52⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xrrxfrx.exec:\xrrxfrx.exe53⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xlrxfll.exec:\xlrxfll.exe54⤵
- Executes dropped EXE
PID:2532 -
\??\c:\btntbb.exec:\btntbb.exe55⤵
- Executes dropped EXE
PID:936 -
\??\c:\pjppp.exec:\pjppp.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vjpvd.exec:\vjpvd.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1rfxfxf.exec:\1rfxfxf.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tttntb.exec:\tttntb.exe59⤵
- Executes dropped EXE
PID:848 -
\??\c:\btbhnt.exec:\btbhnt.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dvjjp.exec:\dvjjp.exe61⤵
- Executes dropped EXE
PID:1076 -
\??\c:\ppdpd.exec:\ppdpd.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9fxfxlr.exec:\9fxfxlr.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnnbhn.exec:\tnnbhn.exe64⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nnbbbb.exec:\nnbbbb.exe65⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jjjvd.exec:\jjjvd.exe66⤵PID:764
-
\??\c:\frflrrx.exec:\frflrrx.exe67⤵PID:2472
-
\??\c:\ffxflfl.exec:\ffxflfl.exe68⤵PID:1688
-
\??\c:\tthntt.exec:\tthntt.exe69⤵PID:1596
-
\??\c:\btntbb.exec:\btntbb.exe70⤵PID:2892
-
\??\c:\pjdjp.exec:\pjdjp.exe71⤵PID:2688
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe72⤵PID:2816
-
\??\c:\fflxllr.exec:\fflxllr.exe73⤵PID:2808
-
\??\c:\3bhtbh.exec:\3bhtbh.exe74⤵PID:2824
-
\??\c:\1bbttt.exec:\1bbttt.exe75⤵PID:2104
-
\??\c:\ddvvj.exec:\ddvvj.exe76⤵PID:1692
-
\??\c:\vpjvj.exec:\vpjvj.exe77⤵PID:3060
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe78⤵PID:2568
-
\??\c:\htthbt.exec:\htthbt.exe79⤵PID:2604
-
\??\c:\5htttt.exec:\5htttt.exe80⤵PID:2260
-
\??\c:\ddjdp.exec:\ddjdp.exe81⤵PID:1104
-
\??\c:\pjvdj.exec:\pjvdj.exe82⤵PID:996
-
\??\c:\7lflxfl.exec:\7lflxfl.exe83⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\bthttb.exec:\bthttb.exe84⤵PID:2768
-
\??\c:\nnbhnn.exec:\nnbhnn.exe85⤵PID:2296
-
\??\c:\1pvvp.exec:\1pvvp.exe86⤵PID:1280
-
\??\c:\1dvjj.exec:\1dvjj.exe87⤵PID:768
-
\??\c:\rxflrxf.exec:\rxflrxf.exe88⤵PID:2404
-
\??\c:\rfxxllx.exec:\rfxxllx.exe89⤵PID:1868
-
\??\c:\hhttht.exec:\hhttht.exe90⤵PID:1068
-
\??\c:\5jjvv.exec:\5jjvv.exe91⤵PID:2732
-
\??\c:\9pdjp.exec:\9pdjp.exe92⤵PID:2876
-
\??\c:\fxlxflx.exec:\fxlxflx.exe93⤵PID:1808
-
\??\c:\frrflrx.exec:\frrflrx.exe94⤵PID:2616
-
\??\c:\nhhhhh.exec:\nhhhhh.exe95⤵PID:2940
-
\??\c:\bthhtt.exec:\bthhtt.exe96⤵PID:2372
-
\??\c:\jjddj.exec:\jjddj.exe97⤵PID:888
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe98⤵PID:796
-
\??\c:\7lxlxxf.exec:\7lxlxxf.exe99⤵PID:2012
-
\??\c:\nhtbnn.exec:\nhtbnn.exe100⤵PID:2228
-
\??\c:\hnhthn.exec:\hnhthn.exe101⤵PID:2096
-
\??\c:\vvjjp.exec:\vvjjp.exe102⤵PID:1084
-
\??\c:\dvpvd.exec:\dvpvd.exe103⤵PID:868
-
\??\c:\xxlrflx.exec:\xxlrflx.exe104⤵PID:3032
-
\??\c:\hthnbh.exec:\hthnbh.exe105⤵PID:2252
-
\??\c:\btttnb.exec:\btttnb.exe106⤵PID:2516
-
\??\c:\jdpdj.exec:\jdpdj.exe107⤵PID:2640
-
\??\c:\jdjdj.exec:\jdjdj.exe108⤵PID:1896
-
\??\c:\rllrffr.exec:\rllrffr.exe109⤵PID:2848
-
\??\c:\3lfrxfr.exec:\3lfrxfr.exe110⤵PID:2660
-
\??\c:\3hhnht.exec:\3hhnht.exe111⤵PID:2844
-
\??\c:\vjppj.exec:\vjppj.exe112⤵PID:2736
-
\??\c:\vvvjv.exec:\vvvjv.exe113⤵PID:2716
-
\??\c:\rrlrfrx.exec:\rrlrfrx.exe114⤵PID:2752
-
\??\c:\fxlffrx.exec:\fxlffrx.exe115⤵PID:2720
-
\??\c:\hbnthn.exec:\hbnthn.exe116⤵PID:800
-
\??\c:\bttbnn.exec:\bttbnn.exe117⤵PID:2108
-
\??\c:\vjpjp.exec:\vjpjp.exe118⤵PID:816
-
\??\c:\7vjpv.exec:\7vjpv.exe119⤵PID:2544
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe120⤵PID:2308
-
\??\c:\bthntb.exec:\bthntb.exe121⤵PID:2924
-
\??\c:\nhtttt.exec:\nhtttt.exe122⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-