Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe
Resource
win7-20240704-en
General
-
Target
5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe
-
Size
64KB
-
MD5
f72ac762b0aa8a358d48048e892c60f6
-
SHA1
48ce0b25ea916d3271d1acac8f092a3fa6fad58e
-
SHA256
5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144
-
SHA512
c0a6eba162140e0ee8c872e761080ff763a2159cc20e4a6661ed04027e26bc36f710d6074e5b58d0bb63933b2d02641836591935510f0ee2c7dddb387ddf95a3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNYFJ:ymb3NkkiQ3mdBjFIvlpyJ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1348-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/392-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/392-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2908 pltpb.exe 1144 fxbtlb.exe 2324 hvhjr.exe 2864 jhtdvx.exe 2104 rtlvbd.exe 2716 dvfnt.exe 392 nvhdv.exe 2700 dlblvf.exe 2488 jhnjhv.exe 552 bnljf.exe 1808 ljttnxb.exe 1692 jpxjftp.exe 2044 rbnrx.exe 2696 rlplphb.exe 2964 xjfxjv.exe 1792 vnfxf.exe 856 xjbdv.exe 1528 tvjdlv.exe 1536 nbtjhvb.exe 2400 rjlnr.exe 2256 tfftjpn.exe 1028 bhvrnvv.exe 932 pflfth.exe 964 fhdpf.exe 1780 djdlj.exe 268 lvlthd.exe 1348 flbff.exe 2572 vpjvrdd.exe 2588 pbhvt.exe 2536 jtdrvv.exe 2212 pxffh.exe 3044 tbljbp.exe 1304 ldjnxpb.exe 1612 xdvhvnh.exe 2992 jlvnjj.exe 1672 lpnltb.exe 2832 lvnbnbb.exe 2768 bjfnf.exe 2440 nnrtvr.exe 2744 ndndxp.exe 2652 hlblt.exe 1660 brpblbx.exe 2792 fxnhft.exe 1228 vxxdl.exe 2300 fxjtf.exe 904 llpdn.exe 2488 nnvdj.exe 1168 jdvhhrl.exe 1684 xbdjll.exe 1736 rhlbtjd.exe 2064 bprfljn.exe 2044 xlbhtv.exe 1960 nhvbf.exe 1344 jjlllnx.exe 944 xbftb.exe 1752 tprrnp.exe 2372 dtpblh.exe 1528 plphvj.exe 3028 btvdn.exe 2020 ffnln.exe 888 nrfxll.exe 2092 pdxxr.exe 2224 pdhdlhb.exe 1552 rvvbbx.exe -
resource yara_rule behavioral1/memory/1348-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/392-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/392-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/392-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btpjxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjjnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xldnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndndxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlllnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrpxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prrjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrdtfxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhjrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttjbrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlvnbjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllhpdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpphnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjndvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhrnvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdrjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbjpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvrvfxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2908 2556 5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe 29 PID 2556 wrote to memory of 2908 2556 5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe 29 PID 2556 wrote to memory of 2908 2556 5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe 29 PID 2556 wrote to memory of 2908 2556 5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe 29 PID 2908 wrote to memory of 1144 2908 pltpb.exe 30 PID 2908 wrote to memory of 1144 2908 pltpb.exe 30 PID 2908 wrote to memory of 1144 2908 pltpb.exe 30 PID 2908 wrote to memory of 1144 2908 pltpb.exe 30 PID 1144 wrote to memory of 2324 1144 fxbtlb.exe 31 PID 1144 wrote to memory of 2324 1144 fxbtlb.exe 31 PID 1144 wrote to memory of 2324 1144 fxbtlb.exe 31 PID 1144 wrote to memory of 2324 1144 fxbtlb.exe 31 PID 2324 wrote to memory of 2864 2324 hvhjr.exe 32 PID 2324 wrote to memory of 2864 2324 hvhjr.exe 32 PID 2324 wrote to memory of 2864 2324 hvhjr.exe 32 PID 2324 wrote to memory of 2864 2324 hvhjr.exe 32 PID 2864 wrote to memory of 2104 2864 jhtdvx.exe 33 PID 2864 wrote to memory of 2104 2864 jhtdvx.exe 33 PID 2864 wrote to memory of 2104 2864 jhtdvx.exe 33 PID 2864 wrote to memory of 2104 2864 jhtdvx.exe 33 PID 2104 wrote to memory of 2716 2104 rtlvbd.exe 34 PID 2104 wrote to memory of 2716 2104 rtlvbd.exe 34 PID 2104 wrote to memory of 2716 2104 rtlvbd.exe 34 PID 2104 wrote to memory of 2716 2104 rtlvbd.exe 34 PID 2716 wrote to memory of 392 2716 dvfnt.exe 35 PID 2716 wrote to memory of 392 2716 dvfnt.exe 35 PID 2716 wrote to memory of 392 2716 dvfnt.exe 35 PID 2716 wrote to memory of 392 2716 dvfnt.exe 35 PID 392 wrote to memory of 2700 392 nvhdv.exe 36 PID 392 wrote to memory of 2700 392 nvhdv.exe 36 PID 392 wrote to memory of 2700 392 nvhdv.exe 36 PID 392 wrote to memory of 2700 392 nvhdv.exe 36 PID 2700 wrote to memory of 2488 2700 dlblvf.exe 75 PID 2700 wrote to memory of 2488 2700 dlblvf.exe 75 PID 2700 wrote to memory of 2488 2700 dlblvf.exe 75 PID 2700 wrote to memory of 2488 2700 dlblvf.exe 75 PID 2488 wrote to memory of 552 2488 jhnjhv.exe 38 PID 2488 wrote to memory of 552 2488 jhnjhv.exe 38 PID 2488 wrote to memory of 552 2488 jhnjhv.exe 38 PID 2488 wrote to memory of 552 2488 jhnjhv.exe 38 PID 552 wrote to memory of 1808 552 bnljf.exe 39 PID 552 wrote to memory of 1808 552 bnljf.exe 39 PID 552 wrote to memory of 1808 552 bnljf.exe 39 PID 552 wrote to memory of 1808 552 bnljf.exe 39 PID 1808 wrote to memory of 1692 1808 ljttnxb.exe 40 PID 1808 wrote to memory of 1692 1808 ljttnxb.exe 40 PID 1808 wrote to memory of 1692 1808 ljttnxb.exe 40 PID 1808 wrote to memory of 1692 1808 ljttnxb.exe 40 PID 1692 wrote to memory of 2044 1692 jpxjftp.exe 41 PID 1692 wrote to memory of 2044 1692 jpxjftp.exe 41 PID 1692 wrote to memory of 2044 1692 jpxjftp.exe 41 PID 1692 wrote to memory of 2044 1692 jpxjftp.exe 41 PID 2044 wrote to memory of 2696 2044 rbnrx.exe 42 PID 2044 wrote to memory of 2696 2044 rbnrx.exe 42 PID 2044 wrote to memory of 2696 2044 rbnrx.exe 42 PID 2044 wrote to memory of 2696 2044 rbnrx.exe 42 PID 2696 wrote to memory of 2964 2696 rlplphb.exe 43 PID 2696 wrote to memory of 2964 2696 rlplphb.exe 43 PID 2696 wrote to memory of 2964 2696 rlplphb.exe 43 PID 2696 wrote to memory of 2964 2696 rlplphb.exe 43 PID 2964 wrote to memory of 1792 2964 xjfxjv.exe 44 PID 2964 wrote to memory of 1792 2964 xjfxjv.exe 44 PID 2964 wrote to memory of 1792 2964 xjfxjv.exe 44 PID 2964 wrote to memory of 1792 2964 xjfxjv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe"C:\Users\Admin\AppData\Local\Temp\5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pltpb.exec:\pltpb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\fxbtlb.exec:\fxbtlb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\hvhjr.exec:\hvhjr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jhtdvx.exec:\jhtdvx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rtlvbd.exec:\rtlvbd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\dvfnt.exec:\dvfnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nvhdv.exec:\nvhdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\dlblvf.exec:\dlblvf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jhnjhv.exec:\jhnjhv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\bnljf.exec:\bnljf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\ljttnxb.exec:\ljttnxb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\jpxjftp.exec:\jpxjftp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rbnrx.exec:\rbnrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\rlplphb.exec:\rlplphb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xjfxjv.exec:\xjfxjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vnfxf.exec:\vnfxf.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xjbdv.exec:\xjbdv.exe18⤵
- Executes dropped EXE
PID:856 -
\??\c:\tvjdlv.exec:\tvjdlv.exe19⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nbtjhvb.exec:\nbtjhvb.exe20⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rjlnr.exec:\rjlnr.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tfftjpn.exec:\tfftjpn.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bhvrnvv.exec:\bhvrnvv.exe23⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pflfth.exec:\pflfth.exe24⤵
- Executes dropped EXE
PID:932 -
\??\c:\fhdpf.exec:\fhdpf.exe25⤵
- Executes dropped EXE
PID:964 -
\??\c:\djdlj.exec:\djdlj.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lvlthd.exec:\lvlthd.exe27⤵
- Executes dropped EXE
PID:268 -
\??\c:\flbff.exec:\flbff.exe28⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vpjvrdd.exec:\vpjvrdd.exe29⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pbhvt.exec:\pbhvt.exe30⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jtdrvv.exec:\jtdrvv.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pxffh.exec:\pxffh.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbljbp.exec:\tbljbp.exe33⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ldjnxpb.exec:\ldjnxpb.exe34⤵
- Executes dropped EXE
PID:1304 -
\??\c:\xdvhvnh.exec:\xdvhvnh.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jlvnjj.exec:\jlvnjj.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lpnltb.exec:\lpnltb.exe37⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lvnbnbb.exec:\lvnbnbb.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bjfnf.exec:\bjfnf.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nnrtvr.exec:\nnrtvr.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ndndxp.exec:\ndndxp.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\hlblt.exec:\hlblt.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\brpblbx.exec:\brpblbx.exe43⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fxnhft.exec:\fxnhft.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vxxdl.exec:\vxxdl.exe45⤵
- Executes dropped EXE
PID:1228 -
\??\c:\fxjtf.exec:\fxjtf.exe46⤵
- Executes dropped EXE
PID:2300 -
\??\c:\llpdn.exec:\llpdn.exe47⤵
- Executes dropped EXE
PID:904 -
\??\c:\nnvdj.exec:\nnvdj.exe48⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jdvhhrl.exec:\jdvhhrl.exe49⤵
- Executes dropped EXE
PID:1168 -
\??\c:\xbdjll.exec:\xbdjll.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rhlbtjd.exec:\rhlbtjd.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bprfljn.exec:\bprfljn.exe52⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xlbhtv.exec:\xlbhtv.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhvbf.exec:\nhvbf.exe54⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jjlllnx.exec:\jjlllnx.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1344 -
\??\c:\xbftb.exec:\xbftb.exe56⤵
- Executes dropped EXE
PID:944 -
\??\c:\tprrnp.exec:\tprrnp.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dtpblh.exec:\dtpblh.exe58⤵
- Executes dropped EXE
PID:2372 -
\??\c:\plphvj.exec:\plphvj.exe59⤵
- Executes dropped EXE
PID:1528 -
\??\c:\btvdn.exec:\btvdn.exe60⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ffnln.exec:\ffnln.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nrfxll.exec:\nrfxll.exe62⤵
- Executes dropped EXE
PID:888 -
\??\c:\pdxxr.exec:\pdxxr.exe63⤵
- Executes dropped EXE
PID:2092 -
\??\c:\pdhdlhb.exec:\pdhdlhb.exe64⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rvvbbx.exec:\rvvbbx.exe65⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rfrxrpp.exec:\rfrxrpp.exe66⤵PID:952
-
\??\c:\phjnrpp.exec:\phjnrpp.exe67⤵PID:1548
-
\??\c:\pxbhpx.exec:\pxbhpx.exe68⤵PID:820
-
\??\c:\lbjfbrd.exec:\lbjfbrd.exe69⤵PID:1404
-
\??\c:\lnhtvvv.exec:\lnhtvvv.exe70⤵PID:1668
-
\??\c:\xtrpjbv.exec:\xtrpjbv.exe71⤵PID:1220
-
\??\c:\ftfjj.exec:\ftfjj.exe72⤵PID:2276
-
\??\c:\txdrxv.exec:\txdrxv.exe73⤵PID:796
-
\??\c:\brjjj.exec:\brjjj.exe74⤵PID:2536
-
\??\c:\nhlvtn.exec:\nhlvtn.exe75⤵PID:688
-
\??\c:\xtbjhf.exec:\xtbjhf.exe76⤵PID:2548
-
\??\c:\vpflfff.exec:\vpflfff.exe77⤵PID:2708
-
\??\c:\xrtvj.exec:\xrtvj.exe78⤵PID:2340
-
\??\c:\vrvhptd.exec:\vrvhptd.exe79⤵PID:2144
-
\??\c:\xflnfb.exec:\xflnfb.exe80⤵PID:2096
-
\??\c:\xpddvrh.exec:\xpddvrh.exe81⤵PID:2240
-
\??\c:\llvvh.exec:\llvvh.exe82⤵PID:2324
-
\??\c:\dxrln.exec:\dxrln.exe83⤵PID:2892
-
\??\c:\rtbft.exec:\rtbft.exe84⤵PID:2900
-
\??\c:\djrrfp.exec:\djrrfp.exe85⤵PID:2656
-
\??\c:\jjhdhvh.exec:\jjhdhvh.exe86⤵PID:1868
-
\??\c:\rxrhl.exec:\rxrhl.exe87⤵PID:2792
-
\??\c:\drjbh.exec:\drjbh.exe88⤵PID:1708
-
\??\c:\lpbdtv.exec:\lpbdtv.exe89⤵PID:2300
-
\??\c:\fthhrxh.exec:\fthhrxh.exe90⤵PID:904
-
\??\c:\dlpxrt.exec:\dlpxrt.exe91⤵PID:2488
-
\??\c:\xlndfnv.exec:\xlndfnv.exe92⤵PID:1168
-
\??\c:\hlrhlr.exec:\hlrhlr.exe93⤵PID:1684
-
\??\c:\lrdxrfd.exec:\lrdxrfd.exe94⤵PID:1736
-
\??\c:\tpplp.exec:\tpplp.exe95⤵PID:764
-
\??\c:\vjjtfrb.exec:\vjjtfrb.exe96⤵PID:2940
-
\??\c:\llfpbl.exec:\llfpbl.exe97⤵PID:1960
-
\??\c:\pdlrvr.exec:\pdlrvr.exe98⤵PID:1344
-
\??\c:\ptbll.exec:\ptbll.exe99⤵PID:2380
-
\??\c:\ptlffl.exec:\ptlffl.exe100⤵PID:1752
-
\??\c:\jjdnbhj.exec:\jjdnbhj.exe101⤵PID:2372
-
\??\c:\hpjplnp.exec:\hpjplnp.exe102⤵PID:2052
-
\??\c:\xltvbd.exec:\xltvbd.exe103⤵PID:2400
-
\??\c:\ltblb.exec:\ltblb.exe104⤵PID:680
-
\??\c:\ljffp.exec:\ljffp.exe105⤵PID:2600
-
\??\c:\dbpjnrd.exec:\dbpjnrd.exe106⤵PID:824
-
\??\c:\hrtfhv.exec:\hrtfhv.exe107⤵PID:2224
-
\??\c:\vdplp.exec:\vdplp.exe108⤵PID:236
-
\??\c:\fvbvx.exec:\fvbvx.exe109⤵PID:952
-
\??\c:\brpfjh.exec:\brpfjh.exe110⤵PID:1244
-
\??\c:\pjjbbbd.exec:\pjjbbbd.exe111⤵PID:820
-
\??\c:\dnprh.exec:\dnprh.exe112⤵PID:2088
-
\??\c:\jhnhj.exec:\jhnhj.exe113⤵PID:3056
-
\??\c:\nxvthv.exec:\nxvthv.exe114⤵PID:2292
-
\??\c:\lfdlf.exec:\lfdlf.exe115⤵PID:2276
-
\??\c:\tfntjv.exec:\tfntjv.exe116⤵PID:3048
-
\??\c:\pfvfht.exec:\pfvfht.exe117⤵PID:2592
-
\??\c:\hndvf.exec:\hndvf.exe118⤵PID:1048
-
\??\c:\xtxld.exec:\xtxld.exe119⤵PID:848
-
\??\c:\pxfnpvr.exec:\pxfnpvr.exe120⤵PID:2820
-
\??\c:\hhrffvv.exec:\hhrffvv.exe121⤵PID:2736
-
\??\c:\rhjxnr.exec:\rhjxnr.exe122⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-