Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe
Resource
win7-20240903-en
General
-
Target
9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe
-
Size
63KB
-
MD5
6a9b5806b1498d96e3312f0e3b145310
-
SHA1
408ee02773bfee08dac55cd60ce4523e5f375a75
-
SHA256
9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56
-
SHA512
1914c64910635f31aab40ff23473e6141a196aaff40d7df7a51f3f31598a4119f3732fc0fa8779f9c471a51b5595711c1a77bbb8530f337f07e6772d3c1ce945
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxi+:ymb3NkkiQ3mdBjF0y7kb/
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1568-11-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-22-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2272 tvpnlvx.exe 1240 pfltnf.exe 2632 jthbhxb.exe 2748 lnxxf.exe 2960 fvthnh.exe 2112 lrbnpjn.exe 2676 xdthl.exe 2560 prhlf.exe 992 jrjbh.exe 2336 thjpbjp.exe 2828 tntfvx.exe 1556 rhhdr.exe 1704 bjrrb.exe 1488 jxxbvf.exe 1504 hjntrvp.exe 2844 nnbpl.exe 1860 xjrttt.exe 1804 vlfxhr.exe 2968 pxprl.exe 1548 rfvbbv.exe 2376 vnflnnr.exe 2332 drrplb.exe 2280 xrvft.exe 1648 ddhrpdp.exe 2348 hjtrtxp.exe 2396 xhvjrhp.exe 1984 bfddjph.exe 1076 ffnhpfx.exe 2716 nvjnpjf.exe 1996 ltjpddf.exe 2812 rrtbrp.exe 1560 lflpnp.exe 1780 bhrxbj.exe 1612 ddlrxtf.exe 1092 bbxbxp.exe 1808 fbxhv.exe 2384 thbbrxf.exe 2680 hbxvvtp.exe 2804 blrjptn.exe 2960 ljvfjvv.exe 2656 lhrfv.exe 2576 lxddjf.exe 2552 ldvtrd.exe 900 njthrjt.exe 860 dvdflpn.exe 1868 vxjpnhh.exe 2120 ljjrj.exe 968 nplhrj.exe 2828 pbvfddx.exe 2156 hfdfb.exe 1788 rjvth.exe 1384 lnlflh.exe 2896 lfhpb.exe 2840 bhljfrb.exe 1712 vfhvxf.exe 2504 nbvphp.exe 2988 fphxpvd.exe 2764 xhprj.exe 2224 pvtrbjx.exe 2240 hptljxv.exe 2376 rtxhntp.exe 1172 rbxdnr.exe 2012 vrdrpt.exe 1084 nbddnhf.exe -
resource yara_rule behavioral1/memory/1568-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-311-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffpfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdphdxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxhjld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlhbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phtdvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndfnlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drnxrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjjrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvpllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpxld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlfxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrvhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvlbrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frpxflt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhjxrpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhhhjrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtdhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxftrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpddhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brlnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdtvpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvdpxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrjpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npbnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjbxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdflpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvtrbjx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1568 wrote to memory of 2272 1568 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe 29 PID 1568 wrote to memory of 2272 1568 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe 29 PID 1568 wrote to memory of 2272 1568 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe 29 PID 1568 wrote to memory of 2272 1568 9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe 29 PID 2272 wrote to memory of 1240 2272 tvpnlvx.exe 30 PID 2272 wrote to memory of 1240 2272 tvpnlvx.exe 30 PID 2272 wrote to memory of 1240 2272 tvpnlvx.exe 30 PID 2272 wrote to memory of 1240 2272 tvpnlvx.exe 30 PID 1240 wrote to memory of 2632 1240 pfltnf.exe 31 PID 1240 wrote to memory of 2632 1240 pfltnf.exe 31 PID 1240 wrote to memory of 2632 1240 pfltnf.exe 31 PID 1240 wrote to memory of 2632 1240 pfltnf.exe 31 PID 2632 wrote to memory of 2748 2632 jthbhxb.exe 32 PID 2632 wrote to memory of 2748 2632 jthbhxb.exe 32 PID 2632 wrote to memory of 2748 2632 jthbhxb.exe 32 PID 2632 wrote to memory of 2748 2632 jthbhxb.exe 32 PID 2748 wrote to memory of 2960 2748 lnxxf.exe 33 PID 2748 wrote to memory of 2960 2748 lnxxf.exe 33 PID 2748 wrote to memory of 2960 2748 lnxxf.exe 33 PID 2748 wrote to memory of 2960 2748 lnxxf.exe 33 PID 2960 wrote to memory of 2112 2960 fvthnh.exe 34 PID 2960 wrote to memory of 2112 2960 fvthnh.exe 34 PID 2960 wrote to memory of 2112 2960 fvthnh.exe 34 PID 2960 wrote to memory of 2112 2960 fvthnh.exe 34 PID 2112 wrote to memory of 2676 2112 lrbnpjn.exe 35 PID 2112 wrote to memory of 2676 2112 lrbnpjn.exe 35 PID 2112 wrote to memory of 2676 2112 lrbnpjn.exe 35 PID 2112 wrote to memory of 2676 2112 lrbnpjn.exe 35 PID 2676 wrote to memory of 2560 2676 xdthl.exe 36 PID 2676 wrote to memory of 2560 2676 xdthl.exe 36 PID 2676 wrote to memory of 2560 2676 xdthl.exe 36 PID 2676 wrote to memory of 2560 2676 xdthl.exe 36 PID 2560 wrote to memory of 992 2560 prhlf.exe 37 PID 2560 wrote to memory of 992 2560 prhlf.exe 37 PID 2560 wrote to memory of 992 2560 prhlf.exe 37 PID 2560 wrote to memory of 992 2560 prhlf.exe 37 PID 992 wrote to memory of 2336 992 jrjbh.exe 38 PID 992 wrote to memory of 2336 992 jrjbh.exe 38 PID 992 wrote to memory of 2336 992 jrjbh.exe 38 PID 992 wrote to memory of 2336 992 jrjbh.exe 38 PID 2336 wrote to memory of 2828 2336 thjpbjp.exe 39 PID 2336 wrote to memory of 2828 2336 thjpbjp.exe 39 PID 2336 wrote to memory of 2828 2336 thjpbjp.exe 39 PID 2336 wrote to memory of 2828 2336 thjpbjp.exe 39 PID 2828 wrote to memory of 1556 2828 tntfvx.exe 40 PID 2828 wrote to memory of 1556 2828 tntfvx.exe 40 PID 2828 wrote to memory of 1556 2828 tntfvx.exe 40 PID 2828 wrote to memory of 1556 2828 tntfvx.exe 40 PID 1556 wrote to memory of 1704 1556 rhhdr.exe 41 PID 1556 wrote to memory of 1704 1556 rhhdr.exe 41 PID 1556 wrote to memory of 1704 1556 rhhdr.exe 41 PID 1556 wrote to memory of 1704 1556 rhhdr.exe 41 PID 1704 wrote to memory of 1488 1704 bjrrb.exe 42 PID 1704 wrote to memory of 1488 1704 bjrrb.exe 42 PID 1704 wrote to memory of 1488 1704 bjrrb.exe 42 PID 1704 wrote to memory of 1488 1704 bjrrb.exe 42 PID 1488 wrote to memory of 1504 1488 jxxbvf.exe 43 PID 1488 wrote to memory of 1504 1488 jxxbvf.exe 43 PID 1488 wrote to memory of 1504 1488 jxxbvf.exe 43 PID 1488 wrote to memory of 1504 1488 jxxbvf.exe 43 PID 1504 wrote to memory of 2844 1504 hjntrvp.exe 44 PID 1504 wrote to memory of 2844 1504 hjntrvp.exe 44 PID 1504 wrote to memory of 2844 1504 hjntrvp.exe 44 PID 1504 wrote to memory of 2844 1504 hjntrvp.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe"C:\Users\Admin\AppData\Local\Temp\9d793484c34f3406c283ecfa25aaa1f160414f8f78f50874e58914271e4e5e56N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\tvpnlvx.exec:\tvpnlvx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\pfltnf.exec:\pfltnf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\jthbhxb.exec:\jthbhxb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\lnxxf.exec:\lnxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fvthnh.exec:\fvthnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lrbnpjn.exec:\lrbnpjn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\xdthl.exec:\xdthl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\prhlf.exec:\prhlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\jrjbh.exec:\jrjbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\thjpbjp.exec:\thjpbjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\tntfvx.exec:\tntfvx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rhhdr.exec:\rhhdr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\bjrrb.exec:\bjrrb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jxxbvf.exec:\jxxbvf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\hjntrvp.exec:\hjntrvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\nnbpl.exec:\nnbpl.exe17⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xjrttt.exec:\xjrttt.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vlfxhr.exec:\vlfxhr.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\pxprl.exec:\pxprl.exe20⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rfvbbv.exec:\rfvbbv.exe21⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vnflnnr.exec:\vnflnnr.exe22⤵
- Executes dropped EXE
PID:2376 -
\??\c:\drrplb.exec:\drrplb.exe23⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xrvft.exec:\xrvft.exe24⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ddhrpdp.exec:\ddhrpdp.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hjtrtxp.exec:\hjtrtxp.exe26⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xhvjrhp.exec:\xhvjrhp.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bfddjph.exec:\bfddjph.exe28⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ffnhpfx.exec:\ffnhpfx.exe29⤵
- Executes dropped EXE
PID:1076 -
\??\c:\nvjnpjf.exec:\nvjnpjf.exe30⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ltjpddf.exec:\ltjpddf.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rrtbrp.exec:\rrtbrp.exe32⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lflpnp.exec:\lflpnp.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bhrxbj.exec:\bhrxbj.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddlrxtf.exec:\ddlrxtf.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bbxbxp.exec:\bbxbxp.exe36⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fbxhv.exec:\fbxhv.exe37⤵
- Executes dropped EXE
PID:1808 -
\??\c:\thbbrxf.exec:\thbbrxf.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hbxvvtp.exec:\hbxvvtp.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\blrjptn.exec:\blrjptn.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ljvfjvv.exec:\ljvfjvv.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lhrfv.exec:\lhrfv.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lxddjf.exec:\lxddjf.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ldvtrd.exec:\ldvtrd.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\njthrjt.exec:\njthrjt.exe45⤵
- Executes dropped EXE
PID:900 -
\??\c:\dvdflpn.exec:\dvdflpn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:860 -
\??\c:\vxjpnhh.exec:\vxjpnhh.exe47⤵
- Executes dropped EXE
PID:1868 -
\??\c:\ljjrj.exec:\ljjrj.exe48⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nplhrj.exec:\nplhrj.exe49⤵
- Executes dropped EXE
PID:968 -
\??\c:\pbvfddx.exec:\pbvfddx.exe50⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hfdfb.exec:\hfdfb.exe51⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rjvth.exec:\rjvth.exe52⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lnlflh.exec:\lnlflh.exe53⤵
- Executes dropped EXE
PID:1384 -
\??\c:\lfhpb.exec:\lfhpb.exe54⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bhljfrb.exec:\bhljfrb.exe55⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vfhvxf.exec:\vfhvxf.exe56⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nbvphp.exec:\nbvphp.exe57⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fphxpvd.exec:\fphxpvd.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xhprj.exec:\xhprj.exe59⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pvtrbjx.exec:\pvtrbjx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\hptljxv.exec:\hptljxv.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rtxhntp.exec:\rtxhntp.exe62⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rbxdnr.exec:\rbxdnr.exe63⤵
- Executes dropped EXE
PID:1172 -
\??\c:\vrdrpt.exec:\vrdrpt.exe64⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nbddnhf.exec:\nbddnhf.exe65⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bxblx.exec:\bxblx.exe66⤵PID:1724
-
\??\c:\hnvxbpn.exec:\hnvxbpn.exe67⤵PID:1676
-
\??\c:\nprxdlp.exec:\nprxdlp.exe68⤵PID:2396
-
\??\c:\lrflnx.exec:\lrflnx.exe69⤵PID:1984
-
\??\c:\bfbntr.exec:\bfbntr.exe70⤵PID:2068
-
\??\c:\jplrj.exec:\jplrj.exe71⤵PID:1856
-
\??\c:\nxfttn.exec:\nxfttn.exe72⤵PID:2836
-
\??\c:\lhvxp.exec:\lhvxp.exe73⤵PID:2496
-
\??\c:\fttvbt.exec:\fttvbt.exe74⤵PID:2472
-
\??\c:\jbptdh.exec:\jbptdh.exe75⤵PID:2096
-
\??\c:\ddlfjd.exec:\ddlfjd.exe76⤵PID:1716
-
\??\c:\xblrp.exec:\xblrp.exe77⤵PID:2720
-
\??\c:\bjpddj.exec:\bjpddj.exe78⤵PID:2684
-
\??\c:\fbthhf.exec:\fbthhf.exe79⤵PID:2212
-
\??\c:\rlndh.exec:\rlndh.exe80⤵PID:2772
-
\??\c:\nnrpn.exec:\nnrpn.exe81⤵PID:2664
-
\??\c:\phjbdj.exec:\phjbdj.exe82⤵PID:2752
-
\??\c:\rfhrbxd.exec:\rfhrbxd.exe83⤵PID:2916
-
\??\c:\pxvjf.exec:\pxvjf.exe84⤵PID:2708
-
\??\c:\jxfxpt.exec:\jxfxpt.exe85⤵PID:2112
-
\??\c:\bfjrbvv.exec:\bfjrbvv.exe86⤵PID:2584
-
\??\c:\hhjxxrd.exec:\hhjxxrd.exe87⤵PID:2660
-
\??\c:\xdpdpn.exec:\xdpdpn.exe88⤵PID:860
-
\??\c:\xhpxdj.exec:\xhpxdj.exe89⤵PID:1288
-
\??\c:\pdjjhh.exec:\pdjjhh.exe90⤵PID:2512
-
\??\c:\hfjfldj.exec:\hfjfldj.exe91⤵PID:2276
-
\??\c:\lrnpvj.exec:\lrnpvj.exe92⤵PID:1312
-
\??\c:\fxvnthd.exec:\fxvnthd.exe93⤵PID:2156
-
\??\c:\ldfxjlp.exec:\ldfxjlp.exe94⤵PID:2256
-
\??\c:\trfpjvv.exec:\trfpjvv.exe95⤵PID:2784
-
\??\c:\jnjtp.exec:\jnjtp.exe96⤵PID:2904
-
\??\c:\lpbvv.exec:\lpbvv.exe97⤵PID:2840
-
\??\c:\vfbxvf.exec:\vfbxvf.exe98⤵PID:1628
-
\??\c:\dxdjjvp.exec:\dxdjjvp.exe99⤵PID:1420
-
\??\c:\tdhrp.exec:\tdhrp.exe100⤵PID:2344
-
\??\c:\tjjvt.exec:\tjjvt.exe101⤵PID:2188
-
\??\c:\bllbrh.exec:\bllbrh.exe102⤵PID:2144
-
\??\c:\ftfxxx.exec:\ftfxxx.exe103⤵PID:1752
-
\??\c:\vrbhph.exec:\vrbhph.exe104⤵PID:2864
-
\??\c:\flppl.exec:\flppl.exe105⤵PID:1060
-
\??\c:\ftphljh.exec:\ftphljh.exe106⤵PID:1344
-
\??\c:\ftnfjx.exec:\ftnfjx.exe107⤵PID:1516
-
\??\c:\drnpbnl.exec:\drnpbnl.exe108⤵PID:828
-
\??\c:\btnldv.exec:\btnldv.exe109⤵PID:2964
-
\??\c:\jppjr.exec:\jppjr.exe110⤵PID:2396
-
\??\c:\npfvjj.exec:\npfvjj.exe111⤵PID:2296
-
\??\c:\dpndp.exec:\dpndp.exe112⤵PID:1508
-
\??\c:\txtnnv.exec:\txtnnv.exe113⤵PID:308
-
\??\c:\hvplp.exec:\hvplp.exe114⤵PID:2008
-
\??\c:\lhntr.exec:\lhntr.exe115⤵PID:2940
-
\??\c:\vtrht.exec:\vtrht.exe116⤵PID:2472
-
\??\c:\xlblf.exec:\xlblf.exe117⤵PID:2272
-
\??\c:\jtnnbp.exec:\jtnnbp.exe118⤵PID:236
-
\??\c:\btllht.exec:\btllht.exe119⤵PID:1096
-
\??\c:\rxhtr.exec:\rxhtr.exe120⤵PID:1808
-
\??\c:\jrptnh.exec:\jrptnh.exe121⤵PID:2732
-
\??\c:\hxhjld.exec:\hxhjld.exe122⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-