Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe
Resource
win7-20240903-en
General
-
Target
fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe
-
Size
63KB
-
MD5
10e1f626dd3e7530f75c5816a8890950
-
SHA1
029bbb574f7451444a374c3c6e02465a1cb67e94
-
SHA256
fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0
-
SHA512
89c317b59e31810986a70ff7ea89fc29a7d220f5cf8dbaae5c733a13f52e6123f64bc38e35a4af52fc5ebf068cb689ff3ee105ba01cdb0b9ea0cc39925cc8055
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxi03:ymb3NkkiQ3mdBjF0y7kbD
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1656-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/524-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 nblxxnt.exe 2408 pptdttd.exe 2848 rxnjtt.exe 2388 xvnvv.exe 2132 hbpjf.exe 2812 rxrxj.exe 2712 lbnnflp.exe 2456 nnjpvd.exe 2360 hfjrdp.exe 2584 thxlph.exe 1904 dfpltdx.exe 2816 jnndx.exe 2740 tjblr.exe 2396 hvtbd.exe 1484 dlhdltd.exe 2472 fjjjl.exe 1000 vrvfd.exe 2512 rrdlb.exe 2404 nvxttdp.exe 1896 rndlhvt.exe 920 fjfbfd.exe 1152 bjvvbf.exe 2536 rthvrfh.exe 2084 ltvnlvj.exe 1212 vtrlnl.exe 2024 lxvffnt.exe 752 htnph.exe 524 vtftvd.exe 1136 pjhfb.exe 1640 lttxh.exe 2120 xfhpvjp.exe 2968 xdlpppp.exe 2768 vtrblf.exe 2408 ftjbllf.exe 2792 trvfvld.exe 2060 dnltpl.exe 1596 dbtbppn.exe 2804 nttbxp.exe 2640 vdbdtp.exe 1648 xhjfdr.exe 1776 prpxrdl.exe 2648 lrvjh.exe 2372 fjjhd.exe 2908 ddhlt.exe 2880 xdxnvn.exe 3020 hjbtnt.exe 2624 bdxbxl.exe 2972 xvtdtr.exe 2196 xblpbxr.exe 1692 jdxfjn.exe 2396 pdftrlv.exe 1684 xrptb.exe 824 dtvjdl.exe 2560 vlxxpv.exe 2300 trvpbx.exe 2500 lhrdtt.exe 2124 pptnp.exe 1996 dpnrdbn.exe 2128 lxvnthp.exe 1056 vfvtjpp.exe 2188 hlddt.exe 2536 xvhfl.exe 2308 pxlxvlj.exe 540 lxnrpl.exe -
resource yara_rule behavioral1/memory/1656-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/524-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-67-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhnbltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhtrvxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llhvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pltdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tblrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbvrbjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfdrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnfblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxlfvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvnthp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nplhppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbxbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbtbjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpltdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxvllpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlbhrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2552 1656 fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe 29 PID 1656 wrote to memory of 2552 1656 fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe 29 PID 1656 wrote to memory of 2552 1656 fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe 29 PID 1656 wrote to memory of 2552 1656 fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe 29 PID 2552 wrote to memory of 2408 2552 nblxxnt.exe 62 PID 2552 wrote to memory of 2408 2552 nblxxnt.exe 62 PID 2552 wrote to memory of 2408 2552 nblxxnt.exe 62 PID 2552 wrote to memory of 2408 2552 nblxxnt.exe 62 PID 2408 wrote to memory of 2848 2408 pptdttd.exe 31 PID 2408 wrote to memory of 2848 2408 pptdttd.exe 31 PID 2408 wrote to memory of 2848 2408 pptdttd.exe 31 PID 2408 wrote to memory of 2848 2408 pptdttd.exe 31 PID 2848 wrote to memory of 2388 2848 rxnjtt.exe 32 PID 2848 wrote to memory of 2388 2848 rxnjtt.exe 32 PID 2848 wrote to memory of 2388 2848 rxnjtt.exe 32 PID 2848 wrote to memory of 2388 2848 rxnjtt.exe 32 PID 2388 wrote to memory of 2132 2388 xvnvv.exe 33 PID 2388 wrote to memory of 2132 2388 xvnvv.exe 33 PID 2388 wrote to memory of 2132 2388 xvnvv.exe 33 PID 2388 wrote to memory of 2132 2388 xvnvv.exe 33 PID 2132 wrote to memory of 2812 2132 hbpjf.exe 34 PID 2132 wrote to memory of 2812 2132 hbpjf.exe 34 PID 2132 wrote to memory of 2812 2132 hbpjf.exe 34 PID 2132 wrote to memory of 2812 2132 hbpjf.exe 34 PID 2812 wrote to memory of 2712 2812 rxrxj.exe 35 PID 2812 wrote to memory of 2712 2812 rxrxj.exe 35 PID 2812 wrote to memory of 2712 2812 rxrxj.exe 35 PID 2812 wrote to memory of 2712 2812 rxrxj.exe 35 PID 2712 wrote to memory of 2456 2712 lbnnflp.exe 36 PID 2712 wrote to memory of 2456 2712 lbnnflp.exe 36 PID 2712 wrote to memory of 2456 2712 lbnnflp.exe 36 PID 2712 wrote to memory of 2456 2712 lbnnflp.exe 36 PID 2456 wrote to memory of 2360 2456 nnjpvd.exe 37 PID 2456 wrote to memory of 2360 2456 nnjpvd.exe 37 PID 2456 wrote to memory of 2360 2456 nnjpvd.exe 37 PID 2456 wrote to memory of 2360 2456 nnjpvd.exe 37 PID 2360 wrote to memory of 2584 2360 hfjrdp.exe 38 PID 2360 wrote to memory of 2584 2360 hfjrdp.exe 38 PID 2360 wrote to memory of 2584 2360 hfjrdp.exe 38 PID 2360 wrote to memory of 2584 2360 hfjrdp.exe 38 PID 2584 wrote to memory of 1904 2584 thxlph.exe 39 PID 2584 wrote to memory of 1904 2584 thxlph.exe 39 PID 2584 wrote to memory of 1904 2584 thxlph.exe 39 PID 2584 wrote to memory of 1904 2584 thxlph.exe 39 PID 1904 wrote to memory of 2816 1904 dfpltdx.exe 40 PID 1904 wrote to memory of 2816 1904 dfpltdx.exe 40 PID 1904 wrote to memory of 2816 1904 dfpltdx.exe 40 PID 1904 wrote to memory of 2816 1904 dfpltdx.exe 40 PID 2816 wrote to memory of 2740 2816 jnndx.exe 41 PID 2816 wrote to memory of 2740 2816 jnndx.exe 41 PID 2816 wrote to memory of 2740 2816 jnndx.exe 41 PID 2816 wrote to memory of 2740 2816 jnndx.exe 41 PID 2740 wrote to memory of 2396 2740 tjblr.exe 79 PID 2740 wrote to memory of 2396 2740 tjblr.exe 79 PID 2740 wrote to memory of 2396 2740 tjblr.exe 79 PID 2740 wrote to memory of 2396 2740 tjblr.exe 79 PID 2396 wrote to memory of 1484 2396 hvtbd.exe 43 PID 2396 wrote to memory of 1484 2396 hvtbd.exe 43 PID 2396 wrote to memory of 1484 2396 hvtbd.exe 43 PID 2396 wrote to memory of 1484 2396 hvtbd.exe 43 PID 1484 wrote to memory of 2472 1484 dlhdltd.exe 44 PID 1484 wrote to memory of 2472 1484 dlhdltd.exe 44 PID 1484 wrote to memory of 2472 1484 dlhdltd.exe 44 PID 1484 wrote to memory of 2472 1484 dlhdltd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe"C:\Users\Admin\AppData\Local\Temp\fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\nblxxnt.exec:\nblxxnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pptdttd.exec:\pptdttd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rxnjtt.exec:\rxnjtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xvnvv.exec:\xvnvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\hbpjf.exec:\hbpjf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\rxrxj.exec:\rxrxj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lbnnflp.exec:\lbnnflp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nnjpvd.exec:\nnjpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\hfjrdp.exec:\hfjrdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\thxlph.exec:\thxlph.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\dfpltdx.exec:\dfpltdx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\jnndx.exec:\jnndx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\tjblr.exec:\tjblr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hvtbd.exec:\hvtbd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\dlhdltd.exec:\dlhdltd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\fjjjl.exec:\fjjjl.exe17⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vrvfd.exec:\vrvfd.exe18⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rrdlb.exec:\rrdlb.exe19⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nvxttdp.exec:\nvxttdp.exe20⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rndlhvt.exec:\rndlhvt.exe21⤵
- Executes dropped EXE
PID:1896 -
\??\c:\fjfbfd.exec:\fjfbfd.exe22⤵
- Executes dropped EXE
PID:920 -
\??\c:\bjvvbf.exec:\bjvvbf.exe23⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rthvrfh.exec:\rthvrfh.exe24⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ltvnlvj.exec:\ltvnlvj.exe25⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vtrlnl.exec:\vtrlnl.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lxvffnt.exec:\lxvffnt.exe27⤵
- Executes dropped EXE
PID:2024 -
\??\c:\htnph.exec:\htnph.exe28⤵
- Executes dropped EXE
PID:752 -
\??\c:\vtftvd.exec:\vtftvd.exe29⤵
- Executes dropped EXE
PID:524 -
\??\c:\pjhfb.exec:\pjhfb.exe30⤵
- Executes dropped EXE
PID:1136 -
\??\c:\lttxh.exec:\lttxh.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xfhpvjp.exec:\xfhpvjp.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xdlpppp.exec:\xdlpppp.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vtrblf.exec:\vtrblf.exe34⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ftjbllf.exec:\ftjbllf.exe35⤵
- Executes dropped EXE
PID:2408 -
\??\c:\trvfvld.exec:\trvfvld.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dnltpl.exec:\dnltpl.exe37⤵
- Executes dropped EXE
PID:2060 -
\??\c:\dbtbppn.exec:\dbtbppn.exe38⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nttbxp.exec:\nttbxp.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vdbdtp.exec:\vdbdtp.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xhjfdr.exec:\xhjfdr.exe41⤵
- Executes dropped EXE
PID:1648 -
\??\c:\prpxrdl.exec:\prpxrdl.exe42⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lrvjh.exec:\lrvjh.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\fjjhd.exec:\fjjhd.exe44⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ddhlt.exec:\ddhlt.exe45⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xdxnvn.exec:\xdxnvn.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hjbtnt.exec:\hjbtnt.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bdxbxl.exec:\bdxbxl.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xvtdtr.exec:\xvtdtr.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xblpbxr.exec:\xblpbxr.exe50⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jdxfjn.exec:\jdxfjn.exe51⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pdftrlv.exec:\pdftrlv.exe52⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrptb.exec:\xrptb.exe53⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dtvjdl.exec:\dtvjdl.exe54⤵
- Executes dropped EXE
PID:824 -
\??\c:\vlxxpv.exec:\vlxxpv.exe55⤵
- Executes dropped EXE
PID:2560 -
\??\c:\trvpbx.exec:\trvpbx.exe56⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lhrdtt.exec:\lhrdtt.exe57⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pptnp.exec:\pptnp.exe58⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dpnrdbn.exec:\dpnrdbn.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lxvnthp.exec:\lxvnthp.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\vfvtjpp.exec:\vfvtjpp.exe61⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hlddt.exec:\hlddt.exe62⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xvhfl.exec:\xvhfl.exe63⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pxlxvlj.exec:\pxlxvlj.exe64⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lxnrpl.exec:\lxnrpl.exe65⤵
- Executes dropped EXE
PID:540 -
\??\c:\xtfvhtj.exec:\xtfvhtj.exe66⤵PID:2840
-
\??\c:\brjphnr.exec:\brjphnr.exe67⤵PID:1944
-
\??\c:\ptpxxdl.exec:\ptpxxdl.exe68⤵PID:1528
-
\??\c:\jfddfnr.exec:\jfddfnr.exe69⤵PID:2036
-
\??\c:\vjnfx.exec:\vjnfx.exe70⤵PID:324
-
\??\c:\djdhxlb.exec:\djdhxlb.exe71⤵PID:2088
-
\??\c:\ldfdxx.exec:\ldfdxx.exe72⤵PID:1640
-
\??\c:\vjjjx.exec:\vjjjx.exe73⤵PID:2276
-
\??\c:\lfdntpj.exec:\lfdntpj.exe74⤵PID:2844
-
\??\c:\bxbtjb.exec:\bxbtjb.exe75⤵PID:2780
-
\??\c:\vfpttd.exec:\vfpttd.exe76⤵PID:2764
-
\??\c:\jtnvl.exec:\jtnvl.exe77⤵PID:2776
-
\??\c:\pjrhtxl.exec:\pjrhtxl.exe78⤵PID:2756
-
\??\c:\pvhdln.exec:\pvhdln.exe79⤵PID:2060
-
\??\c:\tvbhpbd.exec:\tvbhpbd.exe80⤵PID:2872
-
\??\c:\hbdrxh.exec:\hbdrxh.exe81⤵PID:2808
-
\??\c:\jxlhbnf.exec:\jxlhbnf.exe82⤵PID:2868
-
\??\c:\nnntbpp.exec:\nnntbpp.exe83⤵PID:2712
-
\??\c:\lrxtj.exec:\lrxtj.exe84⤵PID:2384
-
\??\c:\xlttlp.exec:\xlttlp.exe85⤵PID:3016
-
\??\c:\htbrn.exec:\htbrn.exe86⤵PID:2372
-
\??\c:\bxhlb.exec:\bxhlb.exe87⤵PID:3008
-
\??\c:\rxppp.exec:\rxppp.exe88⤵PID:2880
-
\??\c:\jrxrb.exec:\jrxrb.exe89⤵PID:2896
-
\??\c:\hdhhr.exec:\hdhhr.exe90⤵PID:2832
-
\??\c:\jlrxpr.exec:\jlrxpr.exe91⤵PID:2696
-
\??\c:\jdlfjh.exec:\jdlfjh.exe92⤵PID:2136
-
\??\c:\bbjhjnf.exec:\bbjhjnf.exe93⤵PID:1692
-
\??\c:\rhxfnt.exec:\rhxfnt.exe94⤵PID:2396
-
\??\c:\dhdnr.exec:\dhdnr.exe95⤵PID:2148
-
\??\c:\tnpvf.exec:\tnpvf.exe96⤵PID:824
-
\??\c:\hpvxff.exec:\hpvxff.exe97⤵PID:2560
-
\??\c:\ltdplv.exec:\ltdplv.exe98⤵PID:2300
-
\??\c:\dlppt.exec:\dlppt.exe99⤵PID:2232
-
\??\c:\lbjxxfj.exec:\lbjxxfj.exe100⤵PID:2124
-
\??\c:\plxnpvd.exec:\plxnpvd.exe101⤵PID:2540
-
\??\c:\xnjjnr.exec:\xnjjnr.exe102⤵PID:2128
-
\??\c:\vvtjn.exec:\vvtjn.exe103⤵PID:1116
-
\??\c:\rrxhxh.exec:\rrxhxh.exe104⤵PID:2156
-
\??\c:\lrlnvr.exec:\lrlnvr.exe105⤵PID:1992
-
\??\c:\ldhtj.exec:\ldhtj.exe106⤵PID:2492
-
\??\c:\rfvvt.exec:\rfvvt.exe107⤵PID:1080
-
\??\c:\hltflp.exec:\hltflp.exe108⤵PID:1780
-
\??\c:\hpxtrbv.exec:\hpxtrbv.exe109⤵PID:1808
-
\??\c:\bbhlxrx.exec:\bbhlxrx.exe110⤵PID:692
-
\??\c:\nftpvdp.exec:\nftpvdp.exe111⤵PID:912
-
\??\c:\bbplvrb.exec:\bbplvrb.exe112⤵PID:2608
-
\??\c:\brbnfbp.exec:\brbnfbp.exe113⤵PID:936
-
\??\c:\fxvrfff.exec:\fxvrfff.exe114⤵PID:2332
-
\??\c:\pvldrnr.exec:\pvldrnr.exe115⤵PID:2304
-
\??\c:\tnllp.exec:\tnllp.exe116⤵PID:1220
-
\??\c:\vfhhl.exec:\vfhhl.exe117⤵PID:2644
-
\??\c:\tvbhtvr.exec:\tvbhtvr.exe118⤵PID:2748
-
\??\c:\xhttn.exec:\xhttn.exe119⤵PID:1568
-
\??\c:\ftnpdrl.exec:\ftnpdrl.exe120⤵PID:2692
-
\??\c:\plpvlp.exec:\plpvlp.exe121⤵PID:2636
-
\??\c:\nbrplt.exec:\nbrplt.exe122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-