Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f8d2ec8f015ebf2ffd47a5661b883a0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
6f8d2ec8f015ebf2ffd47a5661b883a0N.exe
-
Size
64KB
-
MD5
6f8d2ec8f015ebf2ffd47a5661b883a0
-
SHA1
85dbcc238069a0ffa892167b9e71fe66d4c962eb
-
SHA256
d93e9ea22c67c8a0d974c435e5aac21679247d607fa54eb8cb2831aca08bf0c2
-
SHA512
167f7e1f6ed61d5123aa4687c4a26dd5efaa660ca3513570fb72677cc024bd9a0683c5ec300e6539a7a7f8615e0c646deb859c9bf7ddd5e54ed07c0674f87fa0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Cz:ymb3NkkiQ3mdBjFI9jz
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2816-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2816 rvdfjr.exe 2684 vhdxbf.exe 2068 rjxplhd.exe 2608 bdfnlbt.exe 2584 xbbnx.exe 2640 xtvxdh.exe 1712 vhfvxn.exe 1788 vtxbjxv.exe 2088 ddxblrr.exe 2864 lhbxfxr.exe 2896 lljtdjx.exe 2676 dpxbh.exe 2320 bppnfd.exe 544 jhprt.exe 784 llxbxn.exe 2512 ddnxddr.exe 3040 jxvxxfd.exe 2952 fxrtjp.exe 1728 ljfhtb.exe 1932 ddtrbf.exe 848 hblbxhx.exe 984 lxrht.exe 876 jxfjhd.exe 1372 ntfrd.exe 2000 hhtprr.exe 1528 rfhxr.exe 1664 bbtrn.exe 2308 nfbfrp.exe 2448 dtvpjr.exe 2344 hxhjp.exe 1636 vldbxd.exe 2708 vpdnnf.exe 2828 hthtvr.exe 2960 lrvtvx.exe 2108 jrjxrnv.exe 2884 ptjnh.exe 2716 pprdhf.exe 1872 ltltj.exe 2608 vdlhv.exe 3020 jtrplv.exe 2120 lrrdlp.exe 2868 dhhrnt.exe 2044 fdhht.exe 2180 jjphhd.exe 2912 nrblnrt.exe 2888 lfbxpd.exe 2420 vhjxph.exe 2620 ndhbt.exe 1708 jrxfb.exe 1824 lrhrp.exe 484 jvntp.exe 2176 fhlxbb.exe 2524 nbthh.exe 1080 jpjph.exe 2992 vfxjlpf.exe 2936 dxjbv.exe 2984 dldvp.exe 1728 vrdftj.exe 1880 hvtpn.exe 932 dlxnrx.exe 1820 lfbvh.exe 2508 hjjpxn.exe 2384 lxdbhfr.exe 1288 fxfnpt.exe -
resource yara_rule behavioral1/memory/2816-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-269-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhpdxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxbxrvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtrplv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbphn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jttlbdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbbxhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrvhrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drvbbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvntp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxlxdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddfvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntppxdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpfhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfvttvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhhxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfnljr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhfvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpbjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpxdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhvdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdflpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbjvvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdddv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2816 2216 6f8d2ec8f015ebf2ffd47a5661b883a0N.exe 30 PID 2216 wrote to memory of 2816 2216 6f8d2ec8f015ebf2ffd47a5661b883a0N.exe 30 PID 2216 wrote to memory of 2816 2216 6f8d2ec8f015ebf2ffd47a5661b883a0N.exe 30 PID 2216 wrote to memory of 2816 2216 6f8d2ec8f015ebf2ffd47a5661b883a0N.exe 30 PID 2816 wrote to memory of 2684 2816 rvdfjr.exe 31 PID 2816 wrote to memory of 2684 2816 rvdfjr.exe 31 PID 2816 wrote to memory of 2684 2816 rvdfjr.exe 31 PID 2816 wrote to memory of 2684 2816 rvdfjr.exe 31 PID 2684 wrote to memory of 2068 2684 vhdxbf.exe 32 PID 2684 wrote to memory of 2068 2684 vhdxbf.exe 32 PID 2684 wrote to memory of 2068 2684 vhdxbf.exe 32 PID 2684 wrote to memory of 2068 2684 vhdxbf.exe 32 PID 2068 wrote to memory of 2608 2068 rjxplhd.exe 33 PID 2068 wrote to memory of 2608 2068 rjxplhd.exe 33 PID 2068 wrote to memory of 2608 2068 rjxplhd.exe 33 PID 2068 wrote to memory of 2608 2068 rjxplhd.exe 33 PID 2608 wrote to memory of 2584 2608 bdfnlbt.exe 34 PID 2608 wrote to memory of 2584 2608 bdfnlbt.exe 34 PID 2608 wrote to memory of 2584 2608 bdfnlbt.exe 34 PID 2608 wrote to memory of 2584 2608 bdfnlbt.exe 34 PID 2584 wrote to memory of 2640 2584 xbbnx.exe 35 PID 2584 wrote to memory of 2640 2584 xbbnx.exe 35 PID 2584 wrote to memory of 2640 2584 xbbnx.exe 35 PID 2584 wrote to memory of 2640 2584 xbbnx.exe 35 PID 2640 wrote to memory of 1712 2640 xtvxdh.exe 36 PID 2640 wrote to memory of 1712 2640 xtvxdh.exe 36 PID 2640 wrote to memory of 1712 2640 xtvxdh.exe 36 PID 2640 wrote to memory of 1712 2640 xtvxdh.exe 36 PID 1712 wrote to memory of 1788 1712 vhfvxn.exe 37 PID 1712 wrote to memory of 1788 1712 vhfvxn.exe 37 PID 1712 wrote to memory of 1788 1712 vhfvxn.exe 37 PID 1712 wrote to memory of 1788 1712 vhfvxn.exe 37 PID 1788 wrote to memory of 2088 1788 vtxbjxv.exe 38 PID 1788 wrote to memory of 2088 1788 vtxbjxv.exe 38 PID 1788 wrote to memory of 2088 1788 vtxbjxv.exe 38 PID 1788 wrote to memory of 2088 1788 vtxbjxv.exe 38 PID 2088 wrote to memory of 2864 2088 ddxblrr.exe 39 PID 2088 wrote to memory of 2864 2088 ddxblrr.exe 39 PID 2088 wrote to memory of 2864 2088 ddxblrr.exe 39 PID 2088 wrote to memory of 2864 2088 ddxblrr.exe 39 PID 2864 wrote to memory of 2896 2864 lhbxfxr.exe 40 PID 2864 wrote to memory of 2896 2864 lhbxfxr.exe 40 PID 2864 wrote to memory of 2896 2864 lhbxfxr.exe 40 PID 2864 wrote to memory of 2896 2864 lhbxfxr.exe 40 PID 2896 wrote to memory of 2676 2896 lljtdjx.exe 41 PID 2896 wrote to memory of 2676 2896 lljtdjx.exe 41 PID 2896 wrote to memory of 2676 2896 lljtdjx.exe 41 PID 2896 wrote to memory of 2676 2896 lljtdjx.exe 41 PID 2676 wrote to memory of 2320 2676 dpxbh.exe 42 PID 2676 wrote to memory of 2320 2676 dpxbh.exe 42 PID 2676 wrote to memory of 2320 2676 dpxbh.exe 42 PID 2676 wrote to memory of 2320 2676 dpxbh.exe 42 PID 2320 wrote to memory of 544 2320 bppnfd.exe 43 PID 2320 wrote to memory of 544 2320 bppnfd.exe 43 PID 2320 wrote to memory of 544 2320 bppnfd.exe 43 PID 2320 wrote to memory of 544 2320 bppnfd.exe 43 PID 544 wrote to memory of 784 544 jhprt.exe 44 PID 544 wrote to memory of 784 544 jhprt.exe 44 PID 544 wrote to memory of 784 544 jhprt.exe 44 PID 544 wrote to memory of 784 544 jhprt.exe 44 PID 784 wrote to memory of 2512 784 llxbxn.exe 45 PID 784 wrote to memory of 2512 784 llxbxn.exe 45 PID 784 wrote to memory of 2512 784 llxbxn.exe 45 PID 784 wrote to memory of 2512 784 llxbxn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f8d2ec8f015ebf2ffd47a5661b883a0N.exe"C:\Users\Admin\AppData\Local\Temp\6f8d2ec8f015ebf2ffd47a5661b883a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rvdfjr.exec:\rvdfjr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vhdxbf.exec:\vhdxbf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rjxplhd.exec:\rjxplhd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\bdfnlbt.exec:\bdfnlbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xbbnx.exec:\xbbnx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xtvxdh.exec:\xtvxdh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vhfvxn.exec:\vhfvxn.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vtxbjxv.exec:\vtxbjxv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\ddxblrr.exec:\ddxblrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lhbxfxr.exec:\lhbxfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lljtdjx.exec:\lljtdjx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dpxbh.exec:\dpxbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bppnfd.exec:\bppnfd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jhprt.exec:\jhprt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\llxbxn.exec:\llxbxn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\ddnxddr.exec:\ddnxddr.exe17⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jxvxxfd.exec:\jxvxxfd.exe18⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxrtjp.exec:\fxrtjp.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ljfhtb.exec:\ljfhtb.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ddtrbf.exec:\ddtrbf.exe21⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hblbxhx.exec:\hblbxhx.exe22⤵
- Executes dropped EXE
PID:848 -
\??\c:\lxrht.exec:\lxrht.exe23⤵
- Executes dropped EXE
PID:984 -
\??\c:\jxfjhd.exec:\jxfjhd.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\ntfrd.exec:\ntfrd.exe25⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hhtprr.exec:\hhtprr.exe26⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rfhxr.exec:\rfhxr.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bbtrn.exec:\bbtrn.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nfbfrp.exec:\nfbfrp.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dtvpjr.exec:\dtvpjr.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hxhjp.exec:\hxhjp.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vldbxd.exec:\vldbxd.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vpdnnf.exec:\vpdnnf.exe33⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hthtvr.exec:\hthtvr.exe34⤵
- Executes dropped EXE
PID:2828 -
\??\c:\lrvtvx.exec:\lrvtvx.exe35⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jrjxrnv.exec:\jrjxrnv.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ptjnh.exec:\ptjnh.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pprdhf.exec:\pprdhf.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ltltj.exec:\ltltj.exe39⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vdlhv.exec:\vdlhv.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jtrplv.exec:\jtrplv.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\lrrdlp.exec:\lrrdlp.exe42⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dhhrnt.exec:\dhhrnt.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\fdhht.exec:\fdhht.exe44⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jjphhd.exec:\jjphhd.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nrblnrt.exec:\nrblnrt.exe46⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfbxpd.exec:\lfbxpd.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vhjxph.exec:\vhjxph.exe48⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ndhbt.exec:\ndhbt.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jrxfb.exec:\jrxfb.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lrhrp.exec:\lrhrp.exe51⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jvntp.exec:\jvntp.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:484 -
\??\c:\fhlxbb.exec:\fhlxbb.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nbthh.exec:\nbthh.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jpjph.exec:\jpjph.exe55⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vfxjlpf.exec:\vfxjlpf.exe56⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dxjbv.exec:\dxjbv.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dldvp.exec:\dldvp.exe58⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vrdftj.exec:\vrdftj.exe59⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hvtpn.exec:\hvtpn.exe60⤵
- Executes dropped EXE
PID:1880 -
\??\c:\dlxnrx.exec:\dlxnrx.exe61⤵
- Executes dropped EXE
PID:932 -
\??\c:\lfbvh.exec:\lfbvh.exe62⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hjjpxn.exec:\hjjpxn.exe63⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lxdbhfr.exec:\lxdbhfr.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fxfnpt.exec:\fxfnpt.exe65⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ffddpp.exec:\ffddpp.exe66⤵PID:1052
-
\??\c:\rtfrpln.exec:\rtfrpln.exe67⤵PID:2256
-
\??\c:\lfdthx.exec:\lfdthx.exe68⤵PID:912
-
\??\c:\fxlfxv.exec:\fxlfxv.exe69⤵PID:1664
-
\??\c:\npjldn.exec:\npjldn.exe70⤵PID:2308
-
\??\c:\flthbj.exec:\flthbj.exe71⤵PID:884
-
\??\c:\txlndhn.exec:\txlndhn.exe72⤵PID:1624
-
\??\c:\htnpv.exec:\htnpv.exe73⤵PID:1928
-
\??\c:\djdvfv.exec:\djdvfv.exe74⤵PID:2812
-
\??\c:\lpflvxx.exec:\lpflvxx.exe75⤵PID:2948
-
\??\c:\vpxpvtr.exec:\vpxpvtr.exe76⤵PID:2736
-
\??\c:\xxvdf.exec:\xxvdf.exe77⤵PID:1680
-
\??\c:\hpxdjp.exec:\hpxdjp.exe78⤵
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\hplhv.exec:\hplhv.exe79⤵PID:2172
-
\??\c:\prjtd.exec:\prjtd.exe80⤵PID:2644
-
\??\c:\njvxdn.exec:\njvxdn.exe81⤵PID:3056
-
\??\c:\bpnxhtr.exec:\bpnxhtr.exe82⤵PID:3060
-
\??\c:\fbrxbt.exec:\fbrxbt.exe83⤵PID:1520
-
\??\c:\bnvvrx.exec:\bnvvrx.exe84⤵PID:916
-
\??\c:\ljxnrv.exec:\ljxnrv.exe85⤵PID:2428
-
\??\c:\vbhtpf.exec:\vbhtpf.exe86⤵PID:1536
-
\??\c:\vhdxh.exec:\vhdxh.exe87⤵PID:2288
-
\??\c:\lxtlj.exec:\lxtlj.exe88⤵PID:1720
-
\??\c:\rpfxrbp.exec:\rpfxrbp.exe89⤵PID:2880
-
\??\c:\jfhbx.exec:\jfhbx.exe90⤵PID:2204
-
\??\c:\hxddx.exec:\hxddx.exe91⤵PID:2964
-
\??\c:\blrdj.exec:\blrdj.exe92⤵PID:2836
-
\??\c:\jtxvxbd.exec:\jtxvxbd.exe93⤵PID:948
-
\??\c:\hbpdvhn.exec:\hbpdvhn.exe94⤵PID:264
-
\??\c:\pvvfxbb.exec:\pvvfxbb.exe95⤵PID:784
-
\??\c:\rhhhd.exec:\rhhhd.exe96⤵PID:592
-
\??\c:\jvnlhp.exec:\jvnlhp.exe97⤵PID:2128
-
\??\c:\fbhtj.exec:\fbhtj.exe98⤵PID:2424
-
\??\c:\xpxvjp.exec:\xpxvjp.exe99⤵PID:2440
-
\??\c:\xfjhj.exec:\xfjhj.exe100⤵PID:2516
-
\??\c:\pfbddvb.exec:\pfbddvb.exe101⤵PID:1728
-
\??\c:\ldrfhd.exec:\ldrfhd.exe102⤵PID:1880
-
\??\c:\vtrtrd.exec:\vtrtrd.exe103⤵PID:932
-
\??\c:\rhfxv.exec:\rhfxv.exe104⤵PID:1644
-
\??\c:\rxdddlh.exec:\rxdddlh.exe105⤵PID:2508
-
\??\c:\rjbrl.exec:\rjbrl.exe106⤵PID:2384
-
\??\c:\nrhrp.exec:\nrhrp.exe107⤵PID:2484
-
\??\c:\jptnrb.exec:\jptnrb.exe108⤵PID:1752
-
\??\c:\rljbpdx.exec:\rljbpdx.exe109⤵PID:2252
-
\??\c:\lffhjvn.exec:\lffhjvn.exe110⤵PID:2496
-
\??\c:\rnxpbjf.exec:\rnxpbjf.exe111⤵PID:1664
-
\??\c:\pxbrhxp.exec:\pxbrhxp.exe112⤵PID:880
-
\??\c:\jhdnftx.exec:\jhdnftx.exe113⤵PID:884
-
\??\c:\drffh.exec:\drffh.exe114⤵PID:2660
-
\??\c:\hxfxj.exec:\hxfxj.exe115⤵PID:2824
-
\??\c:\blbdr.exec:\blbdr.exe116⤵PID:2712
-
\??\c:\tjlrv.exec:\tjlrv.exe117⤵PID:1580
-
\??\c:\ltvhnhl.exec:\ltvhnhl.exe118⤵PID:2772
-
\??\c:\nnnvvvn.exec:\nnnvvvn.exe119⤵PID:596
-
\??\c:\jvhtj.exec:\jvhtj.exe120⤵PID:2876
-
\??\c:\ttxvttt.exec:\ttxvttt.exe121⤵PID:2748
-
\??\c:\pflhpn.exec:\pflhpn.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-