Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 19:18
Behavioral task
behavioral1
Sample
1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe
Resource
win7-20240903-en
General
-
Target
1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe
-
Size
485KB
-
MD5
a73729110af72f656a3d255bf48ae9e1
-
SHA1
64c799d5a4d60d781a5baa97239f805ec690b0a0
-
SHA256
1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1
-
SHA512
ab6374f73f20ef42bd78c1a8d40428c26fb2dc3058749772cd7a06a75fb67ccaededf30bcbf99ad9c3820a365a09b2f69862f97dc6051a31190e55907bb0ef83
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVV:n3C9ytvngQjgtvngSV3CPobNVV
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1364-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2796 hbdjlb.exe 2384 dflfh.exe 2216 vhfvvt.exe 2960 rdhrpdh.exe 2684 lvxxhdp.exe 2644 brvxr.exe 2096 dnbbddl.exe 2288 pxhjpd.exe 2820 ptvbdd.exe 1692 vjhjj.exe 1952 tfvrltf.exe 2552 fdrlfbt.exe 1528 xlpnxl.exe 2340 dnrlhh.exe 320 vphxfrn.exe 616 fbdtvbr.exe 2400 pjbfpx.exe 1772 nnlvx.exe 2484 fhbjrr.exe 2252 hlljvtl.exe 1276 npvhjb.exe 812 vlpdjh.exe 316 btbvxt.exe 1932 rhbbx.exe 1792 vljfhfd.exe 2004 dxxbvf.exe 2052 tpxbphl.exe 1716 pbbxp.exe 908 fvhvx.exe 1020 jttrvfr.exe 1492 vvjhrvp.exe 2476 jbltxnl.exe 2040 pndjnd.exe 1560 nrlrrdx.exe 2768 lxtxt.exe 2384 txhlhvp.exe 2704 hpxph.exe 2608 jddhnl.exe 2616 hnbnrrn.exe 2588 nrhvxfh.exe 2684 dfjdddv.exe 2548 hrtlx.exe 2056 vplfjt.exe 3024 ljdtxvr.exe 2288 nnldn.exe 1000 pjfxbd.exe 2236 rjtddpv.exe 2840 hprffdh.exe 2200 rttnhp.exe 1740 htbhtpv.exe 2160 nrvbjb.exe 2176 ttdhp.exe 376 rhpnv.exe 1360 vllrx.exe 2388 xxpvx.exe 2320 ltjhhp.exe 1772 nltnj.exe 2256 hvrrfdd.exe 1628 hpbld.exe 844 bvbnt.exe 1276 thfrdl.exe 888 bhxrlnr.exe 2028 nvdpb.exe 1656 dlrlttt.exe -
resource yara_rule behavioral1/memory/1364-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvftl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bldntdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptxlrlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbltxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbxjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfptfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvfbtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxtxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djlbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjdjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrtnnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhlrhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvfxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pplrnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plrpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxjptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbxhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptnxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhdfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxhtvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfdfpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djnvfbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlrhdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjxpff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpjflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2796 1364 1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe 30 PID 1364 wrote to memory of 2796 1364 1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe 30 PID 1364 wrote to memory of 2796 1364 1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe 30 PID 1364 wrote to memory of 2796 1364 1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe 30 PID 2796 wrote to memory of 2384 2796 hbdjlb.exe 31 PID 2796 wrote to memory of 2384 2796 hbdjlb.exe 31 PID 2796 wrote to memory of 2384 2796 hbdjlb.exe 31 PID 2796 wrote to memory of 2384 2796 hbdjlb.exe 31 PID 2384 wrote to memory of 2216 2384 dflfh.exe 32 PID 2384 wrote to memory of 2216 2384 dflfh.exe 32 PID 2384 wrote to memory of 2216 2384 dflfh.exe 32 PID 2384 wrote to memory of 2216 2384 dflfh.exe 32 PID 2216 wrote to memory of 2960 2216 vhfvvt.exe 33 PID 2216 wrote to memory of 2960 2216 vhfvvt.exe 33 PID 2216 wrote to memory of 2960 2216 vhfvvt.exe 33 PID 2216 wrote to memory of 2960 2216 vhfvvt.exe 33 PID 2960 wrote to memory of 2684 2960 rdhrpdh.exe 34 PID 2960 wrote to memory of 2684 2960 rdhrpdh.exe 34 PID 2960 wrote to memory of 2684 2960 rdhrpdh.exe 34 PID 2960 wrote to memory of 2684 2960 rdhrpdh.exe 34 PID 2684 wrote to memory of 2644 2684 lvxxhdp.exe 35 PID 2684 wrote to memory of 2644 2684 lvxxhdp.exe 35 PID 2684 wrote to memory of 2644 2684 lvxxhdp.exe 35 PID 2684 wrote to memory of 2644 2684 lvxxhdp.exe 35 PID 2644 wrote to memory of 2096 2644 brvxr.exe 36 PID 2644 wrote to memory of 2096 2644 brvxr.exe 36 PID 2644 wrote to memory of 2096 2644 brvxr.exe 36 PID 2644 wrote to memory of 2096 2644 brvxr.exe 36 PID 2096 wrote to memory of 2288 2096 dnbbddl.exe 37 PID 2096 wrote to memory of 2288 2096 dnbbddl.exe 37 PID 2096 wrote to memory of 2288 2096 dnbbddl.exe 37 PID 2096 wrote to memory of 2288 2096 dnbbddl.exe 37 PID 2288 wrote to memory of 2820 2288 pxhjpd.exe 38 PID 2288 wrote to memory of 2820 2288 pxhjpd.exe 38 PID 2288 wrote to memory of 2820 2288 pxhjpd.exe 38 PID 2288 wrote to memory of 2820 2288 pxhjpd.exe 38 PID 2820 wrote to memory of 1692 2820 ptvbdd.exe 39 PID 2820 wrote to memory of 1692 2820 ptvbdd.exe 39 PID 2820 wrote to memory of 1692 2820 ptvbdd.exe 39 PID 2820 wrote to memory of 1692 2820 ptvbdd.exe 39 PID 1692 wrote to memory of 1952 1692 vjhjj.exe 40 PID 1692 wrote to memory of 1952 1692 vjhjj.exe 40 PID 1692 wrote to memory of 1952 1692 vjhjj.exe 40 PID 1692 wrote to memory of 1952 1692 vjhjj.exe 40 PID 1952 wrote to memory of 2552 1952 tfvrltf.exe 41 PID 1952 wrote to memory of 2552 1952 tfvrltf.exe 41 PID 1952 wrote to memory of 2552 1952 tfvrltf.exe 41 PID 1952 wrote to memory of 2552 1952 tfvrltf.exe 41 PID 2552 wrote to memory of 1528 2552 fdrlfbt.exe 42 PID 2552 wrote to memory of 1528 2552 fdrlfbt.exe 42 PID 2552 wrote to memory of 1528 2552 fdrlfbt.exe 42 PID 2552 wrote to memory of 1528 2552 fdrlfbt.exe 42 PID 1528 wrote to memory of 2340 1528 xlpnxl.exe 43 PID 1528 wrote to memory of 2340 1528 xlpnxl.exe 43 PID 1528 wrote to memory of 2340 1528 xlpnxl.exe 43 PID 1528 wrote to memory of 2340 1528 xlpnxl.exe 43 PID 2340 wrote to memory of 320 2340 dnrlhh.exe 44 PID 2340 wrote to memory of 320 2340 dnrlhh.exe 44 PID 2340 wrote to memory of 320 2340 dnrlhh.exe 44 PID 2340 wrote to memory of 320 2340 dnrlhh.exe 44 PID 320 wrote to memory of 616 320 vphxfrn.exe 45 PID 320 wrote to memory of 616 320 vphxfrn.exe 45 PID 320 wrote to memory of 616 320 vphxfrn.exe 45 PID 320 wrote to memory of 616 320 vphxfrn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe"C:\Users\Admin\AppData\Local\Temp\1f726e54200936fa3a52f685ee1e37cf66a7e6d3313f8bfcba42ae0363b653c1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\hbdjlb.exec:\hbdjlb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\dflfh.exec:\dflfh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vhfvvt.exec:\vhfvvt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rdhrpdh.exec:\rdhrpdh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lvxxhdp.exec:\lvxxhdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\brvxr.exec:\brvxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\dnbbddl.exec:\dnbbddl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\pxhjpd.exec:\pxhjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\ptvbdd.exec:\ptvbdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vjhjj.exec:\vjhjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\tfvrltf.exec:\tfvrltf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\fdrlfbt.exec:\fdrlfbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xlpnxl.exec:\xlpnxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\dnrlhh.exec:\dnrlhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\vphxfrn.exec:\vphxfrn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\fbdtvbr.exec:\fbdtvbr.exe17⤵
- Executes dropped EXE
PID:616 -
\??\c:\pjbfpx.exec:\pjbfpx.exe18⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nnlvx.exec:\nnlvx.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\fhbjrr.exec:\fhbjrr.exe20⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hlljvtl.exec:\hlljvtl.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\npvhjb.exec:\npvhjb.exe22⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vlpdjh.exec:\vlpdjh.exe23⤵
- Executes dropped EXE
PID:812 -
\??\c:\btbvxt.exec:\btbvxt.exe24⤵
- Executes dropped EXE
PID:316 -
\??\c:\rhbbx.exec:\rhbbx.exe25⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vljfhfd.exec:\vljfhfd.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dxxbvf.exec:\dxxbvf.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tpxbphl.exec:\tpxbphl.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pbbxp.exec:\pbbxp.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fvhvx.exec:\fvhvx.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\jttrvfr.exec:\jttrvfr.exe31⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vvjhrvp.exec:\vvjhrvp.exe32⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jbltxnl.exec:\jbltxnl.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\pndjnd.exec:\pndjnd.exe34⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nrlrrdx.exec:\nrlrrdx.exe35⤵
- Executes dropped EXE
PID:1560 -
\??\c:\lxtxt.exec:\lxtxt.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\txhlhvp.exec:\txhlhvp.exe37⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hpxph.exec:\hpxph.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jddhnl.exec:\jddhnl.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hnbnrrn.exec:\hnbnrrn.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nrhvxfh.exec:\nrhvxfh.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dfjdddv.exec:\dfjdddv.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hrtlx.exec:\hrtlx.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vplfjt.exec:\vplfjt.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ljdtxvr.exec:\ljdtxvr.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nnldn.exec:\nnldn.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjfxbd.exec:\pjfxbd.exe47⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rjtddpv.exec:\rjtddpv.exe48⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hprffdh.exec:\hprffdh.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rttnhp.exec:\rttnhp.exe50⤵
- Executes dropped EXE
PID:2200 -
\??\c:\htbhtpv.exec:\htbhtpv.exe51⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nrvbjb.exec:\nrvbjb.exe52⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ttdhp.exec:\ttdhp.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rhpnv.exec:\rhpnv.exe54⤵
- Executes dropped EXE
PID:376 -
\??\c:\vllrx.exec:\vllrx.exe55⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xxpvx.exec:\xxpvx.exe56⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ltjhhp.exec:\ltjhhp.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nltnj.exec:\nltnj.exe58⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hvrrfdd.exec:\hvrrfdd.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hpbld.exec:\hpbld.exe60⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bvbnt.exec:\bvbnt.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\thfrdl.exec:\thfrdl.exe62⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bhxrlnr.exec:\bhxrlnr.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\nvdpb.exec:\nvdpb.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dlrlttt.exec:\dlrlttt.exe65⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rdtrt.exec:\rdtrt.exe66⤵PID:1788
-
\??\c:\djvrxh.exec:\djvrxh.exe67⤵PID:1488
-
\??\c:\ljtjhvx.exec:\ljtjhvx.exe68⤵PID:2004
-
\??\c:\jtjldfd.exec:\jtjldfd.exe69⤵PID:1156
-
\??\c:\brtppv.exec:\brtppv.exe70⤵PID:1716
-
\??\c:\xbjxdh.exec:\xbjxdh.exe71⤵PID:3048
-
\??\c:\jpxlx.exec:\jpxlx.exe72⤵PID:3056
-
\??\c:\vpfdbh.exec:\vpfdbh.exe73⤵PID:360
-
\??\c:\jjlpx.exec:\jjlpx.exe74⤵PID:1492
-
\??\c:\ljbbpn.exec:\ljbbpn.exe75⤵PID:2812
-
\??\c:\vljbjt.exec:\vljbjt.exe76⤵PID:2716
-
\??\c:\fhpvbp.exec:\fhpvbp.exe77⤵PID:2696
-
\??\c:\pjbrxdv.exec:\pjbrxdv.exe78⤵PID:2784
-
\??\c:\lrdnf.exec:\lrdnf.exe79⤵PID:2780
-
\??\c:\lhphdld.exec:\lhphdld.exe80⤵PID:2592
-
\??\c:\tlttr.exec:\tlttr.exe81⤵PID:2960
-
\??\c:\npnjljf.exec:\npnjljf.exe82⤵PID:2584
-
\??\c:\pfxnt.exec:\pfxnt.exe83⤵PID:2624
-
\??\c:\ffpbhxd.exec:\ffpbhxd.exe84⤵PID:2080
-
\??\c:\tldvhxf.exec:\tldvhxf.exe85⤵PID:2100
-
\??\c:\jxfvbrl.exec:\jxfvbrl.exe86⤵PID:924
-
\??\c:\lnbff.exec:\lnbff.exe87⤵PID:2024
-
\??\c:\bjnbntp.exec:\bjnbntp.exe88⤵PID:1208
-
\??\c:\fxbdj.exec:\fxbdj.exe89⤵PID:2944
-
\??\c:\tvfpvx.exec:\tvfpvx.exe90⤵PID:436
-
\??\c:\xxntfdl.exec:\xxntfdl.exe91⤵PID:556
-
\??\c:\fxfptfr.exec:\fxfptfr.exe92⤵
- System Location Discovery: System Language Discovery
PID:1848 -
\??\c:\btjxt.exec:\btjxt.exe93⤵PID:2800
-
\??\c:\dfrxdnl.exec:\dfrxdnl.exe94⤵PID:2172
-
\??\c:\hbtvp.exec:\hbtvp.exe95⤵PID:464
-
\??\c:\dhlrhj.exec:\dhlrhj.exe96⤵
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\pnnttp.exec:\pnnttp.exe97⤵PID:2188
-
\??\c:\fdfjn.exec:\fdfjn.exe98⤵PID:2400
-
\??\c:\tdnhp.exec:\tdnhp.exe99⤵PID:2192
-
\??\c:\fhvfr.exec:\fhvfr.exe100⤵PID:920
-
\??\c:\ppbht.exec:\ppbht.exe101⤵PID:2496
-
\??\c:\xvfxdl.exec:\xvfxdl.exe102⤵PID:1944
-
\??\c:\xtxxxhj.exec:\xtxxxhj.exe103⤵PID:1600
-
\??\c:\nttlxj.exec:\nttlxj.exe104⤵PID:812
-
\??\c:\pxrlrdt.exec:\pxrlrdt.exe105⤵PID:2888
-
\??\c:\hrpxb.exec:\hrpxb.exe106⤵PID:1932
-
\??\c:\lrvlx.exec:\lrvlx.exe107⤵PID:2264
-
\??\c:\xhtvfpl.exec:\xhtvfpl.exe108⤵PID:592
-
\??\c:\bpjfh.exec:\bpjfh.exe109⤵PID:760
-
\??\c:\ndnrpjt.exec:\ndnrpjt.exe110⤵PID:2052
-
\??\c:\dnblxfb.exec:\dnblxfb.exe111⤵PID:2072
-
\??\c:\lntbbrv.exec:\lntbbrv.exe112⤵PID:876
-
\??\c:\pljblx.exec:\pljblx.exe113⤵PID:1072
-
\??\c:\rfrld.exec:\rfrld.exe114⤵PID:1144
-
\??\c:\bnbxhb.exec:\bnbxhb.exe115⤵
- System Location Discovery: System Language Discovery
PID:864 -
\??\c:\lrjhldh.exec:\lrjhldh.exe116⤵PID:2848
-
\??\c:\bfdbp.exec:\bfdbp.exe117⤵PID:2772
-
\??\c:\pnrpjrf.exec:\pnrpjrf.exe118⤵PID:1684
-
\??\c:\jrnjnl.exec:\jrnjnl.exe119⤵PID:2816
-
\??\c:\lxbrlpp.exec:\lxbrlpp.exe120⤵PID:2688
-
\??\c:\tvhjnhn.exec:\tvhjnhn.exe121⤵PID:2528
-
\??\c:\jttrd.exec:\jttrd.exe122⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-