Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 01:32
Static task
static1
Behavioral task
behavioral1
Sample
64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe
Resource
win7-20240903-en
General
-
Target
64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe
-
Size
70KB
-
MD5
914f08ccd73570414021b61fcdcf4e50
-
SHA1
a35c99bb16d40d96d4546d9a729ee68af3f68447
-
SHA256
64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4
-
SHA512
a2c6146b1f0244b5c7cc3aaa7a093a6ebf667fc8681e6c19553aef5c09b4281cf9ca8a9220c8046a583481770888cdd5e6f997402fc5539dea9600c5e452d7d8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjl:ymb3NkkiQ3mdBjFI4VV
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2124-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 ltftjv.exe 1648 ldlhh.exe 2724 lldlhvl.exe 2652 bdddt.exe 2712 vdfvh.exe 2520 ntbbbpx.exe 3040 bdlpvrb.exe 2508 nbjjdd.exe 1700 dnxdn.exe 2388 ndjhvvl.exe 2384 rndrvl.exe 2840 jdnlf.exe 2496 hlhpjp.exe 540 tddtdnj.exe 2320 tdllht.exe 1160 ptdflpb.exe 1772 ldllxh.exe 2948 pftrxdb.exe 2316 jpxbr.exe 1148 jdbhnj.exe 1484 xjlrp.exe 896 dlvpdjb.exe 1584 lrpbrh.exe 1828 rljbnv.exe 1076 txxpjj.exe 1676 fbpjjvx.exe 1592 fvfpnlh.exe 236 lnpjhr.exe 1320 fvnxrpf.exe 1764 nnxhf.exe 2988 rfnfx.exe 3068 jnflr.exe 2236 bdftx.exe 1528 tntrbr.exe 2808 lpdnr.exe 2764 flxbt.exe 2940 htnfthd.exe 2680 tfhvt.exe 2796 tnvfv.exe 2712 jbdlpjj.exe 2364 pldht.exe 3036 jbtjl.exe 3044 pxxdhth.exe 1856 xrpfxt.exe 2264 dnjpj.exe 2396 trvnb.exe 1824 njvflh.exe 2844 nhbfb.exe 2888 dhnnjlb.exe 1936 nxpjlxt.exe 2864 dfrlblx.exe 2092 ddtbhhd.exe 704 hlvpll.exe 2956 vdflbrp.exe 1156 fljrtnd.exe 1964 brtbvt.exe 2164 jdvhxx.exe 2024 bbfdrd.exe 1632 jvdpv.exe 1884 jpbxhlv.exe 2376 hbhdl.exe 752 tpddhd.exe 1616 dlvtb.exe 1796 fltvxjp.exe -
resource yara_rule behavioral1/memory/2124-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlvlvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfbxdnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlhfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvxnthr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djntnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdvhrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbhbnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlxftpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drxbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfpthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhphtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhvrfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlhpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrltd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltftjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tljhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpvdfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jftllj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbxtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjhlprf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxhjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thldhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlpvrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnfnrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhfpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfhxtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbndd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdnvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbnnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxbr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2216 2124 64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe 30 PID 2124 wrote to memory of 2216 2124 64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe 30 PID 2124 wrote to memory of 2216 2124 64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe 30 PID 2124 wrote to memory of 2216 2124 64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe 30 PID 2216 wrote to memory of 1648 2216 ltftjv.exe 31 PID 2216 wrote to memory of 1648 2216 ltftjv.exe 31 PID 2216 wrote to memory of 1648 2216 ltftjv.exe 31 PID 2216 wrote to memory of 1648 2216 ltftjv.exe 31 PID 1648 wrote to memory of 2724 1648 ldlhh.exe 32 PID 1648 wrote to memory of 2724 1648 ldlhh.exe 32 PID 1648 wrote to memory of 2724 1648 ldlhh.exe 32 PID 1648 wrote to memory of 2724 1648 ldlhh.exe 32 PID 2724 wrote to memory of 2652 2724 lldlhvl.exe 33 PID 2724 wrote to memory of 2652 2724 lldlhvl.exe 33 PID 2724 wrote to memory of 2652 2724 lldlhvl.exe 33 PID 2724 wrote to memory of 2652 2724 lldlhvl.exe 33 PID 2652 wrote to memory of 2712 2652 bdddt.exe 34 PID 2652 wrote to memory of 2712 2652 bdddt.exe 34 PID 2652 wrote to memory of 2712 2652 bdddt.exe 34 PID 2652 wrote to memory of 2712 2652 bdddt.exe 34 PID 2712 wrote to memory of 2520 2712 vdfvh.exe 35 PID 2712 wrote to memory of 2520 2712 vdfvh.exe 35 PID 2712 wrote to memory of 2520 2712 vdfvh.exe 35 PID 2712 wrote to memory of 2520 2712 vdfvh.exe 35 PID 2520 wrote to memory of 3040 2520 ntbbbpx.exe 36 PID 2520 wrote to memory of 3040 2520 ntbbbpx.exe 36 PID 2520 wrote to memory of 3040 2520 ntbbbpx.exe 36 PID 2520 wrote to memory of 3040 2520 ntbbbpx.exe 36 PID 3040 wrote to memory of 2508 3040 bdlpvrb.exe 37 PID 3040 wrote to memory of 2508 3040 bdlpvrb.exe 37 PID 3040 wrote to memory of 2508 3040 bdlpvrb.exe 37 PID 3040 wrote to memory of 2508 3040 bdlpvrb.exe 37 PID 2508 wrote to memory of 1700 2508 nbjjdd.exe 38 PID 2508 wrote to memory of 1700 2508 nbjjdd.exe 38 PID 2508 wrote to memory of 1700 2508 nbjjdd.exe 38 PID 2508 wrote to memory of 1700 2508 nbjjdd.exe 38 PID 1700 wrote to memory of 2388 1700 dnxdn.exe 39 PID 1700 wrote to memory of 2388 1700 dnxdn.exe 39 PID 1700 wrote to memory of 2388 1700 dnxdn.exe 39 PID 1700 wrote to memory of 2388 1700 dnxdn.exe 39 PID 2388 wrote to memory of 2384 2388 ndjhvvl.exe 40 PID 2388 wrote to memory of 2384 2388 ndjhvvl.exe 40 PID 2388 wrote to memory of 2384 2388 ndjhvvl.exe 40 PID 2388 wrote to memory of 2384 2388 ndjhvvl.exe 40 PID 2384 wrote to memory of 2840 2384 rndrvl.exe 41 PID 2384 wrote to memory of 2840 2384 rndrvl.exe 41 PID 2384 wrote to memory of 2840 2384 rndrvl.exe 41 PID 2384 wrote to memory of 2840 2384 rndrvl.exe 41 PID 2840 wrote to memory of 2496 2840 jdnlf.exe 42 PID 2840 wrote to memory of 2496 2840 jdnlf.exe 42 PID 2840 wrote to memory of 2496 2840 jdnlf.exe 42 PID 2840 wrote to memory of 2496 2840 jdnlf.exe 42 PID 2496 wrote to memory of 540 2496 hlhpjp.exe 43 PID 2496 wrote to memory of 540 2496 hlhpjp.exe 43 PID 2496 wrote to memory of 540 2496 hlhpjp.exe 43 PID 2496 wrote to memory of 540 2496 hlhpjp.exe 43 PID 540 wrote to memory of 2320 540 tddtdnj.exe 44 PID 540 wrote to memory of 2320 540 tddtdnj.exe 44 PID 540 wrote to memory of 2320 540 tddtdnj.exe 44 PID 540 wrote to memory of 2320 540 tddtdnj.exe 44 PID 2320 wrote to memory of 1160 2320 tdllht.exe 45 PID 2320 wrote to memory of 1160 2320 tdllht.exe 45 PID 2320 wrote to memory of 1160 2320 tdllht.exe 45 PID 2320 wrote to memory of 1160 2320 tdllht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe"C:\Users\Admin\AppData\Local\Temp\64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ltftjv.exec:\ltftjv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\ldlhh.exec:\ldlhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\lldlhvl.exec:\lldlhvl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bdddt.exec:\bdddt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vdfvh.exec:\vdfvh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ntbbbpx.exec:\ntbbbpx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bdlpvrb.exec:\bdlpvrb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nbjjdd.exec:\nbjjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\dnxdn.exec:\dnxdn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\ndjhvvl.exec:\ndjhvvl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rndrvl.exec:\rndrvl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jdnlf.exec:\jdnlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\hlhpjp.exec:\hlhpjp.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\tddtdnj.exec:\tddtdnj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\tdllht.exec:\tdllht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\ptdflpb.exec:\ptdflpb.exe17⤵
- Executes dropped EXE
PID:1160 -
\??\c:\ldllxh.exec:\ldllxh.exe18⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pftrxdb.exec:\pftrxdb.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jpxbr.exec:\jpxbr.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2316 -
\??\c:\jdbhnj.exec:\jdbhnj.exe21⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xjlrp.exec:\xjlrp.exe22⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dlvpdjb.exec:\dlvpdjb.exe23⤵
- Executes dropped EXE
PID:896 -
\??\c:\lrpbrh.exec:\lrpbrh.exe24⤵
- Executes dropped EXE
PID:1584 -
\??\c:\rljbnv.exec:\rljbnv.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\txxpjj.exec:\txxpjj.exe26⤵
- Executes dropped EXE
PID:1076 -
\??\c:\fbpjjvx.exec:\fbpjjvx.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fvfpnlh.exec:\fvfpnlh.exe28⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lnpjhr.exec:\lnpjhr.exe29⤵
- Executes dropped EXE
PID:236 -
\??\c:\fvnxrpf.exec:\fvnxrpf.exe30⤵
- Executes dropped EXE
PID:1320 -
\??\c:\nnxhf.exec:\nnxhf.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rfnfx.exec:\rfnfx.exe32⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jnflr.exec:\jnflr.exe33⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bdftx.exec:\bdftx.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tntrbr.exec:\tntrbr.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lpdnr.exec:\lpdnr.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\flxbt.exec:\flxbt.exe37⤵
- Executes dropped EXE
PID:2764 -
\??\c:\htnfthd.exec:\htnfthd.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tfhvt.exec:\tfhvt.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tnvfv.exec:\tnvfv.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jbdlpjj.exec:\jbdlpjj.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pldht.exec:\pldht.exe42⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jbtjl.exec:\jbtjl.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pxxdhth.exec:\pxxdhth.exe44⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xrpfxt.exec:\xrpfxt.exe45⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dnjpj.exec:\dnjpj.exe46⤵
- Executes dropped EXE
PID:2264 -
\??\c:\trvnb.exec:\trvnb.exe47⤵
- Executes dropped EXE
PID:2396 -
\??\c:\njvflh.exec:\njvflh.exe48⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nhbfb.exec:\nhbfb.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dhnnjlb.exec:\dhnnjlb.exe50⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nxpjlxt.exec:\nxpjlxt.exe51⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dfrlblx.exec:\dfrlblx.exe52⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ddtbhhd.exec:\ddtbhhd.exe53⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hlvpll.exec:\hlvpll.exe54⤵
- Executes dropped EXE
PID:704 -
\??\c:\vdflbrp.exec:\vdflbrp.exe55⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fljrtnd.exec:\fljrtnd.exe56⤵
- Executes dropped EXE
PID:1156 -
\??\c:\brtbvt.exec:\brtbvt.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jdvhxx.exec:\jdvhxx.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bbfdrd.exec:\bbfdrd.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jvdpv.exec:\jvdpv.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jpbxhlv.exec:\jpbxhlv.exe61⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hbhdl.exec:\hbhdl.exe62⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tpddhd.exec:\tpddhd.exe63⤵
- Executes dropped EXE
PID:752 -
\??\c:\dlvtb.exec:\dlvtb.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fltvxjp.exec:\fltvxjp.exe65⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bntddvt.exec:\bntddvt.exe66⤵PID:1680
-
\??\c:\dntrx.exec:\dntrx.exe67⤵PID:1480
-
\??\c:\dnjpd.exec:\dnjpd.exe68⤵PID:636
-
\??\c:\lfvllt.exec:\lfvllt.exe69⤵PID:2252
-
\??\c:\vjxbbvd.exec:\vjxbbvd.exe70⤵PID:1448
-
\??\c:\vvbdpxh.exec:\vvbdpxh.exe71⤵PID:2284
-
\??\c:\ntxljjx.exec:\ntxljjx.exe72⤵PID:1136
-
\??\c:\ffljt.exec:\ffljt.exe73⤵PID:1764
-
\??\c:\prxdh.exec:\prxdh.exe74⤵PID:2304
-
\??\c:\pdttp.exec:\pdttp.exe75⤵PID:928
-
\??\c:\djhhnhj.exec:\djhhnhj.exe76⤵PID:1568
-
\??\c:\tlfrx.exec:\tlfrx.exe77⤵PID:3052
-
\??\c:\hnlrjd.exec:\hnlrjd.exe78⤵PID:1648
-
\??\c:\vflvdp.exec:\vflvdp.exe79⤵PID:2732
-
\??\c:\lbllhh.exec:\lbllhh.exe80⤵PID:2720
-
\??\c:\thnfh.exec:\thnfh.exe81⤵PID:2652
-
\??\c:\nxtfth.exec:\nxtfth.exe82⤵PID:2588
-
\??\c:\pnblhdd.exec:\pnblhdd.exe83⤵PID:2568
-
\??\c:\jhbjb.exec:\jhbjb.exe84⤵PID:3060
-
\??\c:\jxvpjpv.exec:\jxvpjpv.exe85⤵PID:1628
-
\??\c:\drrdjd.exec:\drrdjd.exe86⤵PID:2868
-
\??\c:\pllft.exec:\pllft.exe87⤵PID:1604
-
\??\c:\pndxrb.exec:\pndxrb.exe88⤵PID:2400
-
\??\c:\ddpplhp.exec:\ddpplhp.exe89⤵PID:3008
-
\??\c:\rprhh.exec:\rprhh.exe90⤵PID:2612
-
\??\c:\fldpn.exec:\fldpn.exe91⤵PID:2832
-
\??\c:\fxnntd.exec:\fxnntd.exe92⤵PID:576
-
\??\c:\xthhtl.exec:\xthhtl.exe93⤵PID:520
-
\??\c:\dlhtbd.exec:\dlhtbd.exe94⤵PID:2996
-
\??\c:\jlnvnbx.exec:\jlnvnbx.exe95⤵PID:560
-
\??\c:\llhpxbv.exec:\llhpxbv.exe96⤵PID:1312
-
\??\c:\jdjbpl.exec:\jdjbpl.exe97⤵PID:1972
-
\??\c:\lnvjj.exec:\lnvjj.exe98⤵PID:1284
-
\??\c:\vrhrjd.exec:\vrhrjd.exe99⤵PID:2348
-
\??\c:\rvhndfb.exec:\rvhndfb.exe100⤵PID:2196
-
\??\c:\lxxntxf.exec:\lxxntxf.exe101⤵PID:2160
-
\??\c:\htjbhbp.exec:\htjbhbp.exe102⤵PID:1148
-
\??\c:\vlrxnp.exec:\vlrxnp.exe103⤵PID:2372
-
\??\c:\pndflhf.exec:\pndflhf.exe104⤵PID:896
-
\??\c:\njfbv.exec:\njfbv.exe105⤵PID:2008
-
\??\c:\hddbdv.exec:\hddbdv.exe106⤵PID:1732
-
\??\c:\dxljdlj.exec:\dxljdlj.exe107⤵PID:1304
-
\??\c:\lnnljr.exec:\lnnljr.exe108⤵PID:892
-
\??\c:\tttlvlh.exec:\tttlvlh.exe109⤵PID:1460
-
\??\c:\tnldlxn.exec:\tnldlxn.exe110⤵PID:2444
-
\??\c:\jhjlxh.exec:\jhjlxh.exe111⤵PID:1588
-
\??\c:\htrlp.exec:\htrlp.exe112⤵PID:2296
-
\??\c:\vhbndd.exec:\vhbndd.exe113⤵PID:888
-
\??\c:\dvtjbv.exec:\dvtjbv.exe114⤵PID:2032
-
\??\c:\pxltr.exec:\pxltr.exe115⤵PID:3064
-
\??\c:\jvjltdd.exec:\jvjltdd.exe116⤵PID:2260
-
\??\c:\tfdbr.exec:\tfdbr.exe117⤵PID:2708
-
\??\c:\rnhvlt.exec:\rnhvlt.exe118⤵PID:1108
-
\??\c:\jjtff.exec:\jjtff.exe119⤵PID:2152
-
\??\c:\vhbdfnv.exec:\vhbdfnv.exe120⤵PID:2532
-
\??\c:\hlvtpfd.exec:\hlvtpfd.exe121⤵PID:2724
-
\??\c:\hvpbrvf.exec:\hvpbrvf.exe122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-