Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe
Resource
win7-20240903-en
General
-
Target
5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe
-
Size
70KB
-
MD5
8548bff631248a0a2d2ffd3b76d88c50
-
SHA1
acf97f0b02aa3d935e46eccbdd9cad97fe7fa7e0
-
SHA256
5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51d
-
SHA512
71e3d29495ebc701403a354eace730ab6c477bafb027735d3cfeb8aa7eb093edd2bf6eda530a765207162d65a266b2d25d4b1d2b5babf297cbdbfb9606e0b8dc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicZfU:ymb3NkkiQ3mdBjFI4V4ciX
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1120-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 bpxhh.exe 2908 bvhbv.exe 2876 frxntd.exe 2644 rrvvtn.exe 2812 tpdfd.exe 288 lvxhrfx.exe 836 xpvljn.exe 2656 flhhx.exe 1676 lfjrn.exe 3040 bjxjfpp.exe 2852 rpdvfl.exe 832 tlhbphf.exe 1708 npdfv.exe 2108 bxvddnf.exe 1356 tddljjv.exe 1104 dfbld.exe 1744 lhnftfx.exe 2228 vpxpbrl.exe 2272 njrddn.exe 2132 tbfhjf.exe 2436 pfnltr.exe 1976 tlpjf.exe 1728 rnplnv.exe 816 xprlf.exe 1804 lxdpxb.exe 1684 ldnpb.exe 696 hvxnxhp.exe 1008 prbxx.exe 2032 jnhdjn.exe 2124 rtdftl.exe 1196 rlpvh.exe 2248 bdnpj.exe 2912 jxxhh.exe 1580 jpdpjhb.exe 3044 tvvrrp.exe 2916 dvvptn.exe 2836 tvpfvt.exe 2996 fdttrjv.exe 2988 lfptlv.exe 1608 ftptnv.exe 2520 lttrbl.exe 2008 thhlf.exe 1940 hphlt.exe 2532 tjxthtp.exe 1100 jhdjh.exe 2324 lxrplbl.exe 2524 xfnjnxr.exe 884 bnpfjnf.exe 968 fxxnvh.exe 1000 ldtpb.exe 2268 tvxvnbx.exe 1240 btplfjn.exe 1568 vldtjx.exe 1356 ljjnhh.exe 2580 ldfjbn.exe 2240 njrrl.exe 2076 hdjpvth.exe 2280 rjlrxv.exe 2088 jltlrv.exe 2132 nlnrlrh.exe 1440 phxhp.exe 2304 jxrjdx.exe 2612 hftbr.exe 928 jrfdtd.exe -
resource yara_rule behavioral1/memory/1120-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvrpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjrpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtpphv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnlfpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jltjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpjfnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdbtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxhxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrnthrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhjjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxfnpbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlvhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jffnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdxnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhphvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnrbfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhlddh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxfpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfdrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phnrndd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvhnhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxhtxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvnbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnplnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjfjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxntd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppbxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhplbfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxjjrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrdxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvhxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpxtdh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2168 1120 5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe 29 PID 1120 wrote to memory of 2168 1120 5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe 29 PID 1120 wrote to memory of 2168 1120 5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe 29 PID 1120 wrote to memory of 2168 1120 5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe 29 PID 2168 wrote to memory of 2908 2168 bpxhh.exe 30 PID 2168 wrote to memory of 2908 2168 bpxhh.exe 30 PID 2168 wrote to memory of 2908 2168 bpxhh.exe 30 PID 2168 wrote to memory of 2908 2168 bpxhh.exe 30 PID 2908 wrote to memory of 2876 2908 bvhbv.exe 31 PID 2908 wrote to memory of 2876 2908 bvhbv.exe 31 PID 2908 wrote to memory of 2876 2908 bvhbv.exe 31 PID 2908 wrote to memory of 2876 2908 bvhbv.exe 31 PID 2876 wrote to memory of 2644 2876 frxntd.exe 32 PID 2876 wrote to memory of 2644 2876 frxntd.exe 32 PID 2876 wrote to memory of 2644 2876 frxntd.exe 32 PID 2876 wrote to memory of 2644 2876 frxntd.exe 32 PID 2644 wrote to memory of 2812 2644 rrvvtn.exe 33 PID 2644 wrote to memory of 2812 2644 rrvvtn.exe 33 PID 2644 wrote to memory of 2812 2644 rrvvtn.exe 33 PID 2644 wrote to memory of 2812 2644 rrvvtn.exe 33 PID 2812 wrote to memory of 288 2812 tpdfd.exe 34 PID 2812 wrote to memory of 288 2812 tpdfd.exe 34 PID 2812 wrote to memory of 288 2812 tpdfd.exe 34 PID 2812 wrote to memory of 288 2812 tpdfd.exe 34 PID 288 wrote to memory of 836 288 lvxhrfx.exe 35 PID 288 wrote to memory of 836 288 lvxhrfx.exe 35 PID 288 wrote to memory of 836 288 lvxhrfx.exe 35 PID 288 wrote to memory of 836 288 lvxhrfx.exe 35 PID 836 wrote to memory of 2656 836 xpvljn.exe 36 PID 836 wrote to memory of 2656 836 xpvljn.exe 36 PID 836 wrote to memory of 2656 836 xpvljn.exe 36 PID 836 wrote to memory of 2656 836 xpvljn.exe 36 PID 2656 wrote to memory of 1676 2656 flhhx.exe 37 PID 2656 wrote to memory of 1676 2656 flhhx.exe 37 PID 2656 wrote to memory of 1676 2656 flhhx.exe 37 PID 2656 wrote to memory of 1676 2656 flhhx.exe 37 PID 1676 wrote to memory of 3040 1676 lfjrn.exe 38 PID 1676 wrote to memory of 3040 1676 lfjrn.exe 38 PID 1676 wrote to memory of 3040 1676 lfjrn.exe 38 PID 1676 wrote to memory of 3040 1676 lfjrn.exe 38 PID 3040 wrote to memory of 2852 3040 bjxjfpp.exe 39 PID 3040 wrote to memory of 2852 3040 bjxjfpp.exe 39 PID 3040 wrote to memory of 2852 3040 bjxjfpp.exe 39 PID 3040 wrote to memory of 2852 3040 bjxjfpp.exe 39 PID 2852 wrote to memory of 832 2852 rpdvfl.exe 40 PID 2852 wrote to memory of 832 2852 rpdvfl.exe 40 PID 2852 wrote to memory of 832 2852 rpdvfl.exe 40 PID 2852 wrote to memory of 832 2852 rpdvfl.exe 40 PID 832 wrote to memory of 1708 832 tlhbphf.exe 41 PID 832 wrote to memory of 1708 832 tlhbphf.exe 41 PID 832 wrote to memory of 1708 832 tlhbphf.exe 41 PID 832 wrote to memory of 1708 832 tlhbphf.exe 41 PID 1708 wrote to memory of 2108 1708 npdfv.exe 42 PID 1708 wrote to memory of 2108 1708 npdfv.exe 42 PID 1708 wrote to memory of 2108 1708 npdfv.exe 42 PID 1708 wrote to memory of 2108 1708 npdfv.exe 42 PID 2108 wrote to memory of 1356 2108 bxvddnf.exe 43 PID 2108 wrote to memory of 1356 2108 bxvddnf.exe 43 PID 2108 wrote to memory of 1356 2108 bxvddnf.exe 43 PID 2108 wrote to memory of 1356 2108 bxvddnf.exe 43 PID 1356 wrote to memory of 1104 1356 tddljjv.exe 44 PID 1356 wrote to memory of 1104 1356 tddljjv.exe 44 PID 1356 wrote to memory of 1104 1356 tddljjv.exe 44 PID 1356 wrote to memory of 1104 1356 tddljjv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe"C:\Users\Admin\AppData\Local\Temp\5b473ca2046c88e4c4dc071d106c403aeed6a41db2578cb55669d1e727ede51dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\bpxhh.exec:\bpxhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\bvhbv.exec:\bvhbv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\frxntd.exec:\frxntd.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rrvvtn.exec:\rrvvtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\tpdfd.exec:\tpdfd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lvxhrfx.exec:\lvxhrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\xpvljn.exec:\xpvljn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\flhhx.exec:\flhhx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\lfjrn.exec:\lfjrn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\bjxjfpp.exec:\bjxjfpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\rpdvfl.exec:\rpdvfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\tlhbphf.exec:\tlhbphf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\npdfv.exec:\npdfv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\bxvddnf.exec:\bxvddnf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\tddljjv.exec:\tddljjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\dfbld.exec:\dfbld.exe17⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lhnftfx.exec:\lhnftfx.exe18⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vpxpbrl.exec:\vpxpbrl.exe19⤵
- Executes dropped EXE
PID:2228 -
\??\c:\njrddn.exec:\njrddn.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tbfhjf.exec:\tbfhjf.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pfnltr.exec:\pfnltr.exe22⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tlpjf.exec:\tlpjf.exe23⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rnplnv.exec:\rnplnv.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\xprlf.exec:\xprlf.exe25⤵
- Executes dropped EXE
PID:816 -
\??\c:\lxdpxb.exec:\lxdpxb.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ldnpb.exec:\ldnpb.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hvxnxhp.exec:\hvxnxhp.exe28⤵
- Executes dropped EXE
PID:696 -
\??\c:\prbxx.exec:\prbxx.exe29⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jnhdjn.exec:\jnhdjn.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rtdftl.exec:\rtdftl.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rlpvh.exec:\rlpvh.exe32⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bdnpj.exec:\bdnpj.exe33⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jxxhh.exec:\jxxhh.exe34⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jpdpjhb.exec:\jpdpjhb.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tvvrrp.exec:\tvvrrp.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvvptn.exec:\dvvptn.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tvpfvt.exec:\tvpfvt.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fdttrjv.exec:\fdttrjv.exe39⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lfptlv.exec:\lfptlv.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ftptnv.exec:\ftptnv.exe41⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lttrbl.exec:\lttrbl.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\thhlf.exec:\thhlf.exe43⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hphlt.exec:\hphlt.exe44⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tjxthtp.exec:\tjxthtp.exe45⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jhdjh.exec:\jhdjh.exe46⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lxrplbl.exec:\lxrplbl.exe47⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xfnjnxr.exec:\xfnjnxr.exe48⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bnpfjnf.exec:\bnpfjnf.exe49⤵
- Executes dropped EXE
PID:884 -
\??\c:\fxxnvh.exec:\fxxnvh.exe50⤵
- Executes dropped EXE
PID:968 -
\??\c:\ldtpb.exec:\ldtpb.exe51⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tvxvnbx.exec:\tvxvnbx.exe52⤵
- Executes dropped EXE
PID:2268 -
\??\c:\btplfjn.exec:\btplfjn.exe53⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vldtjx.exec:\vldtjx.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ljjnhh.exec:\ljjnhh.exe55⤵
- Executes dropped EXE
PID:1356 -
\??\c:\ldfjbn.exec:\ldfjbn.exe56⤵
- Executes dropped EXE
PID:2580 -
\??\c:\njrrl.exec:\njrrl.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hdjpvth.exec:\hdjpvth.exe58⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rjlrxv.exec:\rjlrxv.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jltlrv.exec:\jltlrv.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nlnrlrh.exec:\nlnrlrh.exe61⤵
- Executes dropped EXE
PID:2132 -
\??\c:\phxhp.exec:\phxhp.exe62⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jxrjdx.exec:\jxrjdx.exe63⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hftbr.exec:\hftbr.exe64⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jrfdtd.exec:\jrfdtd.exe65⤵
- Executes dropped EXE
PID:928 -
\??\c:\hbdjljp.exec:\hbdjljp.exe66⤵PID:2636
-
\??\c:\xbnxb.exec:\xbnxb.exe67⤵PID:1540
-
\??\c:\nddxpfj.exec:\nddxpfj.exe68⤵PID:728
-
\??\c:\hrbrllr.exec:\hrbrllr.exe69⤵PID:912
-
\??\c:\ldfdrfn.exec:\ldfdrfn.exe70⤵PID:2432
-
\??\c:\nphvrrf.exec:\nphvrrf.exe71⤵PID:2416
-
\??\c:\vdjpxtr.exec:\vdjpxtr.exe72⤵PID:2032
-
\??\c:\rrnthrt.exec:\rrnthrt.exe73⤵
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\tdvdr.exec:\tdvdr.exe74⤵PID:2292
-
\??\c:\tvtbf.exec:\tvtbf.exe75⤵
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\ppxdv.exec:\ppxdv.exe76⤵PID:2804
-
\??\c:\xttbfpx.exec:\xttbfpx.exe77⤵PID:2208
-
\??\c:\lplth.exec:\lplth.exe78⤵PID:2832
-
\??\c:\jphbb.exec:\jphbb.exe79⤵PID:2856
-
\??\c:\ndhvxf.exec:\ndhvxf.exe80⤵PID:2880
-
\??\c:\hhvld.exec:\hhvld.exe81⤵PID:2868
-
\??\c:\rbxrh.exec:\rbxrh.exe82⤵PID:2748
-
\??\c:\blrlxb.exec:\blrlxb.exe83⤵PID:2468
-
\??\c:\xnpnlj.exec:\xnpnlj.exe84⤵PID:1960
-
\??\c:\rthvh.exec:\rthvh.exe85⤵PID:2068
-
\??\c:\lllbvph.exec:\lllbvph.exe86⤵PID:1980
-
\??\c:\xdtht.exec:\xdtht.exe87⤵PID:828
-
\??\c:\bvdrf.exec:\bvdrf.exe88⤵PID:2556
-
\??\c:\frdrfh.exec:\frdrfh.exe89⤵PID:2608
-
\??\c:\xbpjhjl.exec:\xbpjhjl.exe90⤵PID:568
-
\??\c:\xppfhjb.exec:\xppfhjb.exe91⤵PID:3004
-
\??\c:\rlbfjr.exec:\rlbfjr.exe92⤵PID:1632
-
\??\c:\plvjtld.exec:\plvjtld.exe93⤵PID:832
-
\??\c:\ftthbj.exec:\ftthbj.exe94⤵PID:1708
-
\??\c:\rlpnbb.exec:\rlpnbb.exe95⤵PID:1500
-
\??\c:\tlhfvt.exec:\tlhfvt.exe96⤵PID:1992
-
\??\c:\nffthjt.exec:\nffthjt.exe97⤵PID:1180
-
\??\c:\rlnjbp.exec:\rlnjbp.exe98⤵PID:2092
-
\??\c:\tfndvfx.exec:\tfndvfx.exe99⤵PID:2104
-
\??\c:\xtpphl.exec:\xtpphl.exe100⤵PID:2320
-
\??\c:\brtpnx.exec:\brtpnx.exe101⤵PID:2272
-
\??\c:\xrtfh.exec:\xrtfh.exe102⤵PID:560
-
\??\c:\vvppp.exec:\vvppp.exe103⤵PID:2192
-
\??\c:\tthhb.exec:\tthhb.exe104⤵PID:1004
-
\??\c:\hrldp.exec:\hrldp.exe105⤵PID:1784
-
\??\c:\ltrvthd.exec:\ltrvthd.exe106⤵PID:1472
-
\??\c:\fbfxnxp.exec:\fbfxnxp.exe107⤵PID:2136
-
\??\c:\fxbpf.exec:\fxbpf.exe108⤵PID:1664
-
\??\c:\rtxdp.exec:\rtxdp.exe109⤵PID:2244
-
\??\c:\rvndhl.exec:\rvndhl.exe110⤵PID:628
-
\??\c:\rrhvrd.exec:\rrhvrd.exe111⤵PID:924
-
\??\c:\hnrrd.exec:\hnrrd.exe112⤵PID:2440
-
\??\c:\jlfhxt.exec:\jlfhxt.exe113⤵PID:2592
-
\??\c:\rvbffp.exec:\rvbffp.exe114⤵PID:872
-
\??\c:\rpvfbt.exec:\rpvfbt.exe115⤵PID:2116
-
\??\c:\ttjphhd.exec:\ttjphhd.exe116⤵PID:2596
-
\??\c:\htbfbxf.exec:\htbfbxf.exe117⤵PID:2248
-
\??\c:\vxbvlt.exec:\vxbvlt.exe118⤵PID:1592
-
\??\c:\pbtlfpv.exec:\pbtlfpv.exe119⤵PID:2928
-
\??\c:\rrhbfr.exec:\rrhbfr.exe120⤵PID:2800
-
\??\c:\bpvnvx.exec:\bpvnvx.exe121⤵PID:2908
-
\??\c:\njftb.exec:\njftb.exe122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-