Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 23:52
Static task
static1
Behavioral task
behavioral1
Sample
8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe
Resource
win7-20240903-en
General
-
Target
8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe
-
Size
70KB
-
MD5
2adf4179e2d501c51cf356be3840681e
-
SHA1
0a6d6f8f33d399288279496bcb1108781d3d56bb
-
SHA256
8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce
-
SHA512
07548fb09bba1d946b5580778fd23a7eda1f84b684793d7cea39c0d4cc3670b07a2e947f612af3eb040d1ffaef4ef6a40c56b4e68edb40b08014d539df4ecba0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicP:ymb3NkkiQ3mdBjFI4V4ciU
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2908-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1832 lhvbl.exe 2732 xfxrtn.exe 2808 pxtpjnn.exe 2584 dddvdrv.exe 3032 pnldlnr.exe 2480 rlnvx.exe 3000 hxnlb.exe 1796 dblpdjx.exe 1480 xrhtrd.exe 2428 rnphx.exe 2752 tjtvd.exe 2716 jvrrr.exe 548 tfpdhtj.exe 2284 lhrrf.exe 2176 bdldv.exe 1424 vbdpr.exe 2060 rfrxb.exe 2316 fxhfd.exe 2024 rhbdn.exe 2312 ftnfrvl.exe 2244 bflrj.exe 1852 tdlrhbd.exe 876 hrxjt.exe 2444 tjhtff.exe 1520 fvnpd.exe 1736 ftvjhv.exe 2860 bbjrhh.exe 2376 vpjddh.exe 2240 pfrftpj.exe 2204 txjrhnj.exe 2308 dxdht.exe 2612 tfjvhf.exe 2220 jpjpnft.exe 2776 bjphh.exe 2720 jjdtrrf.exe 2628 rvxvtd.exe 2820 drvxjnb.exe 2636 fvvpx.exe 2768 jrnpdp.exe 2544 llbfjj.exe 2512 xbpbd.exe 1564 nbxjdn.exe 2372 tjppbd.exe 1148 xbxrlhp.exe 2144 dfdjbr.exe 2932 xljbdj.exe 2952 njlvjlh.exe 1240 nfhddb.exe 2716 nfxnrnl.exe 1180 tfnfpf.exe 1672 jdfph.exe 1440 lpjtlh.exe 368 fjhhp.exe 1280 vrjhnvr.exe 1800 pbdvnn.exe 3056 dhtjtfb.exe 1552 phltbl.exe 2024 drtlfb.exe 932 hftbt.exe 1844 fhhdxth.exe 824 jphpfr.exe 1004 plttdbj.exe 840 bxrxfnl.exe 2552 hrrbl.exe -
resource yara_rule behavioral1/memory/2908-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-265-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvfbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plvpjxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvnhprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldhvnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrrrdhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbvfhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbfvjln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdtrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbbnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrdbjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbffxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnphx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvpjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhtvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjhhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrxxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbfxvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthvnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtjtfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 1832 2908 8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe 30 PID 2908 wrote to memory of 1832 2908 8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe 30 PID 2908 wrote to memory of 1832 2908 8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe 30 PID 2908 wrote to memory of 1832 2908 8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe 30 PID 1832 wrote to memory of 2732 1832 lhvbl.exe 31 PID 1832 wrote to memory of 2732 1832 lhvbl.exe 31 PID 1832 wrote to memory of 2732 1832 lhvbl.exe 31 PID 1832 wrote to memory of 2732 1832 lhvbl.exe 31 PID 2732 wrote to memory of 2808 2732 xfxrtn.exe 32 PID 2732 wrote to memory of 2808 2732 xfxrtn.exe 32 PID 2732 wrote to memory of 2808 2732 xfxrtn.exe 32 PID 2732 wrote to memory of 2808 2732 xfxrtn.exe 32 PID 2808 wrote to memory of 2584 2808 pxtpjnn.exe 33 PID 2808 wrote to memory of 2584 2808 pxtpjnn.exe 33 PID 2808 wrote to memory of 2584 2808 pxtpjnn.exe 33 PID 2808 wrote to memory of 2584 2808 pxtpjnn.exe 33 PID 2584 wrote to memory of 3032 2584 dddvdrv.exe 34 PID 2584 wrote to memory of 3032 2584 dddvdrv.exe 34 PID 2584 wrote to memory of 3032 2584 dddvdrv.exe 34 PID 2584 wrote to memory of 3032 2584 dddvdrv.exe 34 PID 3032 wrote to memory of 2480 3032 pnldlnr.exe 35 PID 3032 wrote to memory of 2480 3032 pnldlnr.exe 35 PID 3032 wrote to memory of 2480 3032 pnldlnr.exe 35 PID 3032 wrote to memory of 2480 3032 pnldlnr.exe 35 PID 2480 wrote to memory of 3000 2480 rlnvx.exe 36 PID 2480 wrote to memory of 3000 2480 rlnvx.exe 36 PID 2480 wrote to memory of 3000 2480 rlnvx.exe 36 PID 2480 wrote to memory of 3000 2480 rlnvx.exe 36 PID 3000 wrote to memory of 1796 3000 hxnlb.exe 37 PID 3000 wrote to memory of 1796 3000 hxnlb.exe 37 PID 3000 wrote to memory of 1796 3000 hxnlb.exe 37 PID 3000 wrote to memory of 1796 3000 hxnlb.exe 37 PID 1796 wrote to memory of 1480 1796 dblpdjx.exe 38 PID 1796 wrote to memory of 1480 1796 dblpdjx.exe 38 PID 1796 wrote to memory of 1480 1796 dblpdjx.exe 38 PID 1796 wrote to memory of 1480 1796 dblpdjx.exe 38 PID 1480 wrote to memory of 2428 1480 xrhtrd.exe 39 PID 1480 wrote to memory of 2428 1480 xrhtrd.exe 39 PID 1480 wrote to memory of 2428 1480 xrhtrd.exe 39 PID 1480 wrote to memory of 2428 1480 xrhtrd.exe 39 PID 2428 wrote to memory of 2752 2428 rnphx.exe 40 PID 2428 wrote to memory of 2752 2428 rnphx.exe 40 PID 2428 wrote to memory of 2752 2428 rnphx.exe 40 PID 2428 wrote to memory of 2752 2428 rnphx.exe 40 PID 2752 wrote to memory of 2716 2752 tjtvd.exe 41 PID 2752 wrote to memory of 2716 2752 tjtvd.exe 41 PID 2752 wrote to memory of 2716 2752 tjtvd.exe 41 PID 2752 wrote to memory of 2716 2752 tjtvd.exe 41 PID 2716 wrote to memory of 548 2716 jvrrr.exe 42 PID 2716 wrote to memory of 548 2716 jvrrr.exe 42 PID 2716 wrote to memory of 548 2716 jvrrr.exe 42 PID 2716 wrote to memory of 548 2716 jvrrr.exe 42 PID 548 wrote to memory of 2284 548 tfpdhtj.exe 43 PID 548 wrote to memory of 2284 548 tfpdhtj.exe 43 PID 548 wrote to memory of 2284 548 tfpdhtj.exe 43 PID 548 wrote to memory of 2284 548 tfpdhtj.exe 43 PID 2284 wrote to memory of 2176 2284 lhrrf.exe 44 PID 2284 wrote to memory of 2176 2284 lhrrf.exe 44 PID 2284 wrote to memory of 2176 2284 lhrrf.exe 44 PID 2284 wrote to memory of 2176 2284 lhrrf.exe 44 PID 2176 wrote to memory of 1424 2176 bdldv.exe 45 PID 2176 wrote to memory of 1424 2176 bdldv.exe 45 PID 2176 wrote to memory of 1424 2176 bdldv.exe 45 PID 2176 wrote to memory of 1424 2176 bdldv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe"C:\Users\Admin\AppData\Local\Temp\8eb42f4f742964203a185f2f57235885b51c7585539c8cd81250f1c3a2cb48ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\lhvbl.exec:\lhvbl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\xfxrtn.exec:\xfxrtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\pxtpjnn.exec:\pxtpjnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\dddvdrv.exec:\dddvdrv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pnldlnr.exec:\pnldlnr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rlnvx.exec:\rlnvx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\hxnlb.exec:\hxnlb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dblpdjx.exec:\dblpdjx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xrhtrd.exec:\xrhtrd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rnphx.exec:\rnphx.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\tjtvd.exec:\tjtvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jvrrr.exec:\jvrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\tfpdhtj.exec:\tfpdhtj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\lhrrf.exec:\lhrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bdldv.exec:\bdldv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\vbdpr.exec:\vbdpr.exe17⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rfrxb.exec:\rfrxb.exe18⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxhfd.exec:\fxhfd.exe19⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rhbdn.exec:\rhbdn.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ftnfrvl.exec:\ftnfrvl.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bflrj.exec:\bflrj.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tdlrhbd.exec:\tdlrhbd.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hrxjt.exec:\hrxjt.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\tjhtff.exec:\tjhtff.exe25⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fvnpd.exec:\fvnpd.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ftvjhv.exec:\ftvjhv.exe27⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bbjrhh.exec:\bbjrhh.exe28⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vpjddh.exec:\vpjddh.exe29⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pfrftpj.exec:\pfrftpj.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\txjrhnj.exec:\txjrhnj.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dxdht.exec:\dxdht.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tfjvhf.exec:\tfjvhf.exe33⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jpjpnft.exec:\jpjpnft.exe34⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bjphh.exec:\bjphh.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jjdtrrf.exec:\jjdtrrf.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rvxvtd.exec:\rvxvtd.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\drvxjnb.exec:\drvxjnb.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fvvpx.exec:\fvvpx.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jrnpdp.exec:\jrnpdp.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\llbfjj.exec:\llbfjj.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xbpbd.exec:\xbpbd.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nbxjdn.exec:\nbxjdn.exe43⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tjppbd.exec:\tjppbd.exe44⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xbxrlhp.exec:\xbxrlhp.exe45⤵
- Executes dropped EXE
PID:1148 -
\??\c:\dfdjbr.exec:\dfdjbr.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xljbdj.exec:\xljbdj.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\njlvjlh.exec:\njlvjlh.exe48⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nfhddb.exec:\nfhddb.exe49⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nfxnrnl.exec:\nfxnrnl.exe50⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tfnfpf.exec:\tfnfpf.exe51⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jdfph.exec:\jdfph.exe52⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lpjtlh.exec:\lpjtlh.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\fjhhp.exec:\fjhhp.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:368 -
\??\c:\vrjhnvr.exec:\vrjhnvr.exe55⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pbdvnn.exec:\pbdvnn.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\dhtjtfb.exec:\dhtjtfb.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056 -
\??\c:\phltbl.exec:\phltbl.exe58⤵
- Executes dropped EXE
PID:1552 -
\??\c:\drtlfb.exec:\drtlfb.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hftbt.exec:\hftbt.exe60⤵
- Executes dropped EXE
PID:932 -
\??\c:\fhhdxth.exec:\fhhdxth.exe61⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jphpfr.exec:\jphpfr.exe62⤵
- Executes dropped EXE
PID:824 -
\??\c:\plttdbj.exec:\plttdbj.exe63⤵
- Executes dropped EXE
PID:1004 -
\??\c:\bxrxfnl.exec:\bxrxfnl.exe64⤵
- Executes dropped EXE
PID:840 -
\??\c:\hrrbl.exec:\hrrbl.exe65⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ddvbhn.exec:\ddvbhn.exe66⤵PID:1352
-
\??\c:\tdxvj.exec:\tdxvj.exe67⤵PID:920
-
\??\c:\btvfrn.exec:\btvfrn.exe68⤵PID:748
-
\??\c:\fjhdlfb.exec:\fjhdlfb.exe69⤵PID:1932
-
\??\c:\hvrxxp.exec:\hvrxxp.exe70⤵
- System Location Discovery: System Language Discovery
PID:852 -
\??\c:\vvrrdp.exec:\vvrrdp.exe71⤵PID:1016
-
\??\c:\jvfhdv.exec:\jvfhdv.exe72⤵PID:2208
-
\??\c:\prvbhp.exec:\prvbhp.exe73⤵PID:2908
-
\??\c:\plnlx.exec:\plnlx.exe74⤵PID:1952
-
\??\c:\xfrpnxp.exec:\xfrpnxp.exe75⤵PID:908
-
\??\c:\xvfljph.exec:\xvfljph.exe76⤵PID:2804
-
\??\c:\nvpvjb.exec:\nvpvjb.exe77⤵PID:2476
-
\??\c:\bdbxjh.exec:\bdbxjh.exe78⤵PID:2504
-
\??\c:\rvjhxjj.exec:\rvjhxjj.exe79⤵PID:2200
-
\??\c:\fxfprf.exec:\fxfprf.exe80⤵PID:2856
-
\??\c:\rlhlhbx.exec:\rlhlhbx.exe81⤵PID:1252
-
\??\c:\jjtvtt.exec:\jjtvtt.exe82⤵PID:2996
-
\??\c:\rjbfn.exec:\rjbfn.exe83⤵PID:2588
-
\??\c:\rdplb.exec:\rdplb.exe84⤵PID:888
-
\??\c:\ftbdbrl.exec:\ftbdbrl.exe85⤵PID:1124
-
\??\c:\rxfxntr.exec:\rxfxntr.exe86⤵PID:2120
-
\??\c:\prxtfp.exec:\prxtfp.exe87⤵PID:2036
-
\??\c:\htfvtxj.exec:\htfvtxj.exe88⤵PID:2256
-
\??\c:\ndtpjnb.exec:\ndtpjnb.exe89⤵PID:2304
-
\??\c:\dnbrnt.exec:\dnbrnt.exe90⤵PID:2364
-
\??\c:\tnxxl.exec:\tnxxl.exe91⤵PID:2976
-
\??\c:\jbndbfp.exec:\jbndbfp.exe92⤵PID:2272
-
\??\c:\bxbjhf.exec:\bxbjhf.exe93⤵PID:1456
-
\??\c:\jpnffbf.exec:\jpnffbf.exe94⤵PID:768
-
\??\c:\ltbblfl.exec:\ltbblfl.exe95⤵PID:1476
-
\??\c:\dhhpt.exec:\dhhpt.exe96⤵PID:2064
-
\??\c:\rbbtt.exec:\rbbtt.exe97⤵PID:2960
-
\??\c:\xfldd.exec:\xfldd.exe98⤵PID:1484
-
\??\c:\jtbvh.exec:\jtbvh.exe99⤵PID:1696
-
\??\c:\xpbljvj.exec:\xpbljvj.exe100⤵PID:1772
-
\??\c:\httnhtt.exec:\httnhtt.exe101⤵PID:1360
-
\??\c:\vhffbb.exec:\vhffbb.exe102⤵PID:2156
-
\??\c:\brjjb.exec:\brjjb.exe103⤵PID:1308
-
\??\c:\lbltx.exec:\lbltx.exe104⤵PID:1780
-
\??\c:\hdvxl.exec:\hdvxl.exe105⤵PID:1668
-
\??\c:\vnhjj.exec:\vnhjj.exe106⤵PID:784
-
\??\c:\rtvnrfj.exec:\rtvnrfj.exe107⤵PID:1948
-
\??\c:\dbffxd.exec:\dbffxd.exe108⤵
- System Location Discovery: System Language Discovery
PID:920 -
\??\c:\xfvbpnt.exec:\xfvbpnt.exe109⤵PID:2100
-
\??\c:\dtrbbd.exec:\dtrbbd.exe110⤵PID:2052
-
\??\c:\xlnjn.exec:\xlnjn.exe111⤵PID:1136
-
\??\c:\hbhlbj.exec:\hbhlbj.exe112⤵PID:2204
-
\??\c:\xjdpb.exec:\xjdpb.exe113⤵PID:1460
-
\??\c:\lvnxdxr.exec:\lvnxdxr.exe114⤵PID:2548
-
\??\c:\fdjjdf.exec:\fdjjdf.exe115⤵PID:2724
-
\??\c:\xrlbrfn.exec:\xrlbrfn.exe116⤵PID:2736
-
\??\c:\jfnbpbn.exec:\jfnbpbn.exe117⤵PID:2592
-
\??\c:\thxrrh.exec:\thxrrh.exe118⤵PID:2828
-
\??\c:\nvvrrdn.exec:\nvvrrdn.exe119⤵PID:1604
-
\??\c:\nxhfx.exec:\nxhfx.exe120⤵PID:1688
-
\??\c:\tjtlbp.exec:\tjtlbp.exe121⤵PID:2464
-
\??\c:\lvvxjfr.exec:\lvvxjfr.exe122⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-