Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe
Resource
win7-20241010-en
General
-
Target
3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe
-
Size
54KB
-
MD5
61301f67b5b57197dd53e55360de5c20
-
SHA1
6a233d2a5657e010637d60dd8fc0d9428bb4eee7
-
SHA256
3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369a
-
SHA512
5936015718734b7d68f56695704b23f29a1f95bdb3281c79235aefb33e3130aa899cba54927548cae6f69cacbc02529a434093d25af2068e8cfba229b067cb75
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJM:0cdpeeBSHHMHLf9RyIEK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2728-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-48-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2960-47-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2960-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-186-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2556-195-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2496-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-283-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3000-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-398-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/940-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-457-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1780-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-533-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-541-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2420-567-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-613-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-620-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1132-675-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-783-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/948-948-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2804-955-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/948-968-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2796-976-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2796-974-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2620-1182-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1380-1201-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1380-1226-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/924-1227-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 rrnbj.exe 2776 xhhprn.exe 2880 dfvbfx.exe 2960 nhvjdjn.exe 2672 fjpdpxf.exe 2696 rnxnlnl.exe 2888 nfjfb.exe 2940 ftrttjf.exe 2236 hhlxldx.exe 1132 rrjdt.exe 1052 nljdbf.exe 2720 vhtjn.exe 1696 lltprl.exe 2928 tlptd.exe 2296 rftvlnd.exe 1572 hllplv.exe 1744 hhjfxtj.exe 2164 lldrxx.exe 1944 jrdfjjr.exe 2556 njfttnx.exe 2496 tjhrvfx.exe 2504 nnrjjff.exe 1596 dvhvnf.exe 1980 jhlft.exe 1972 xvpttxv.exe 3056 dfvfjt.exe 2552 nttdlh.exe 112 bjlllnt.exe 2548 ltxprbj.exe 3000 jvjrj.exe 2528 btfxxhr.exe 2248 rxpjxl.exe 2892 hrrvj.exe 2772 ffvlbbn.exe 2864 rffhnpl.exe 2136 pvthjnp.exe 2656 rbnrlhf.exe 1824 fvvxd.exe 2620 thttjdj.exe 2632 bdfdr.exe 2672 ndffdf.exe 2372 dxddhnl.exe 1852 lxfxrv.exe 756 ftxrhr.exe 924 pfxfnrj.exe 3036 rllvtbl.exe 1776 rhvnd.exe 2936 pbrjpf.exe 2972 trpfprv.exe 2796 pltfvft.exe 2588 xbtndj.exe 564 fbtthln.exe 940 nbdvv.exe 2024 pvnpdx.exe 264 bvjvdr.exe 1780 nvhnt.exe 2144 fpnptph.exe 2364 nxndbn.exe 2348 tlpbxd.exe 820 xlpnvv.exe 976 fvhfldb.exe 1928 fthvt.exe 1576 jhltx.exe 600 rvnnjnt.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpfptv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfbxpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhdrxrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlddfvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtxfrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddrlvtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnnrbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vffft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxnhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbdfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlpbxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtdhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlvxfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjbjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvjlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxhxfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njfttnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftfpjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bplhxhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbjpnjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtxjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnxdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhflth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpppdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2824 2728 3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe 30 PID 2728 wrote to memory of 2824 2728 3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe 30 PID 2728 wrote to memory of 2824 2728 3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe 30 PID 2728 wrote to memory of 2824 2728 3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe 30 PID 2824 wrote to memory of 2776 2824 rrnbj.exe 31 PID 2824 wrote to memory of 2776 2824 rrnbj.exe 31 PID 2824 wrote to memory of 2776 2824 rrnbj.exe 31 PID 2824 wrote to memory of 2776 2824 rrnbj.exe 31 PID 2776 wrote to memory of 2880 2776 xhhprn.exe 32 PID 2776 wrote to memory of 2880 2776 xhhprn.exe 32 PID 2776 wrote to memory of 2880 2776 xhhprn.exe 32 PID 2776 wrote to memory of 2880 2776 xhhprn.exe 32 PID 2880 wrote to memory of 2960 2880 dfvbfx.exe 33 PID 2880 wrote to memory of 2960 2880 dfvbfx.exe 33 PID 2880 wrote to memory of 2960 2880 dfvbfx.exe 33 PID 2880 wrote to memory of 2960 2880 dfvbfx.exe 33 PID 2960 wrote to memory of 2672 2960 nhvjdjn.exe 34 PID 2960 wrote to memory of 2672 2960 nhvjdjn.exe 34 PID 2960 wrote to memory of 2672 2960 nhvjdjn.exe 34 PID 2960 wrote to memory of 2672 2960 nhvjdjn.exe 34 PID 2672 wrote to memory of 2696 2672 fjpdpxf.exe 35 PID 2672 wrote to memory of 2696 2672 fjpdpxf.exe 35 PID 2672 wrote to memory of 2696 2672 fjpdpxf.exe 35 PID 2672 wrote to memory of 2696 2672 fjpdpxf.exe 35 PID 2696 wrote to memory of 2888 2696 rnxnlnl.exe 36 PID 2696 wrote to memory of 2888 2696 rnxnlnl.exe 36 PID 2696 wrote to memory of 2888 2696 rnxnlnl.exe 36 PID 2696 wrote to memory of 2888 2696 rnxnlnl.exe 36 PID 2888 wrote to memory of 2940 2888 nfjfb.exe 37 PID 2888 wrote to memory of 2940 2888 nfjfb.exe 37 PID 2888 wrote to memory of 2940 2888 nfjfb.exe 37 PID 2888 wrote to memory of 2940 2888 nfjfb.exe 37 PID 2940 wrote to memory of 2236 2940 ftrttjf.exe 38 PID 2940 wrote to memory of 2236 2940 ftrttjf.exe 38 PID 2940 wrote to memory of 2236 2940 ftrttjf.exe 38 PID 2940 wrote to memory of 2236 2940 ftrttjf.exe 38 PID 2236 wrote to memory of 1132 2236 hhlxldx.exe 39 PID 2236 wrote to memory of 1132 2236 hhlxldx.exe 39 PID 2236 wrote to memory of 1132 2236 hhlxldx.exe 39 PID 2236 wrote to memory of 1132 2236 hhlxldx.exe 39 PID 1132 wrote to memory of 1052 1132 rrjdt.exe 40 PID 1132 wrote to memory of 1052 1132 rrjdt.exe 40 PID 1132 wrote to memory of 1052 1132 rrjdt.exe 40 PID 1132 wrote to memory of 1052 1132 rrjdt.exe 40 PID 1052 wrote to memory of 2720 1052 nljdbf.exe 41 PID 1052 wrote to memory of 2720 1052 nljdbf.exe 41 PID 1052 wrote to memory of 2720 1052 nljdbf.exe 41 PID 1052 wrote to memory of 2720 1052 nljdbf.exe 41 PID 2720 wrote to memory of 1696 2720 vhtjn.exe 42 PID 2720 wrote to memory of 1696 2720 vhtjn.exe 42 PID 2720 wrote to memory of 1696 2720 vhtjn.exe 42 PID 2720 wrote to memory of 1696 2720 vhtjn.exe 42 PID 1696 wrote to memory of 2928 1696 lltprl.exe 43 PID 1696 wrote to memory of 2928 1696 lltprl.exe 43 PID 1696 wrote to memory of 2928 1696 lltprl.exe 43 PID 1696 wrote to memory of 2928 1696 lltprl.exe 43 PID 2928 wrote to memory of 2296 2928 tlptd.exe 44 PID 2928 wrote to memory of 2296 2928 tlptd.exe 44 PID 2928 wrote to memory of 2296 2928 tlptd.exe 44 PID 2928 wrote to memory of 2296 2928 tlptd.exe 44 PID 2296 wrote to memory of 1572 2296 rftvlnd.exe 45 PID 2296 wrote to memory of 1572 2296 rftvlnd.exe 45 PID 2296 wrote to memory of 1572 2296 rftvlnd.exe 45 PID 2296 wrote to memory of 1572 2296 rftvlnd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe"C:\Users\Admin\AppData\Local\Temp\3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rrnbj.exec:\rrnbj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xhhprn.exec:\xhhprn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\dfvbfx.exec:\dfvbfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\nhvjdjn.exec:\nhvjdjn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\fjpdpxf.exec:\fjpdpxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rnxnlnl.exec:\rnxnlnl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nfjfb.exec:\nfjfb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ftrttjf.exec:\ftrttjf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hhlxldx.exec:\hhlxldx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rrjdt.exec:\rrjdt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\nljdbf.exec:\nljdbf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\vhtjn.exec:\vhtjn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lltprl.exec:\lltprl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\tlptd.exec:\tlptd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rftvlnd.exec:\rftvlnd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\hllplv.exec:\hllplv.exe17⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhjfxtj.exec:\hhjfxtj.exe18⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lldrxx.exec:\lldrxx.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jrdfjjr.exec:\jrdfjjr.exe20⤵
- Executes dropped EXE
PID:1944 -
\??\c:\njfttnx.exec:\njfttnx.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\tjhrvfx.exec:\tjhrvfx.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nnrjjff.exec:\nnrjjff.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvhvnf.exec:\dvhvnf.exe24⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jhlft.exec:\jhlft.exe25⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xvpttxv.exec:\xvpttxv.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dfvfjt.exec:\dfvfjt.exe27⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nttdlh.exec:\nttdlh.exe28⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bjlllnt.exec:\bjlllnt.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\ltxprbj.exec:\ltxprbj.exe30⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jvjrj.exec:\jvjrj.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\btfxxhr.exec:\btfxxhr.exe32⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rxpjxl.exec:\rxpjxl.exe33⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hrrvj.exec:\hrrvj.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ffvlbbn.exec:\ffvlbbn.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rffhnpl.exec:\rffhnpl.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pvthjnp.exec:\pvthjnp.exe37⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rbnrlhf.exec:\rbnrlhf.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fvvxd.exec:\fvvxd.exe39⤵
- Executes dropped EXE
PID:1824 -
\??\c:\thttjdj.exec:\thttjdj.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bdfdr.exec:\bdfdr.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ndffdf.exec:\ndffdf.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dxddhnl.exec:\dxddhnl.exe43⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lxfxrv.exec:\lxfxrv.exe44⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ftxrhr.exec:\ftxrhr.exe45⤵
- Executes dropped EXE
PID:756 -
\??\c:\pfxfnrj.exec:\pfxfnrj.exe46⤵
- Executes dropped EXE
PID:924 -
\??\c:\rllvtbl.exec:\rllvtbl.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rhvnd.exec:\rhvnd.exe48⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pbrjpf.exec:\pbrjpf.exe49⤵
- Executes dropped EXE
PID:2936 -
\??\c:\trpfprv.exec:\trpfprv.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pltfvft.exec:\pltfvft.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xbtndj.exec:\xbtndj.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fbtthln.exec:\fbtthln.exe53⤵
- Executes dropped EXE
PID:564 -
\??\c:\nbdvv.exec:\nbdvv.exe54⤵
- Executes dropped EXE
PID:940 -
\??\c:\pvnpdx.exec:\pvnpdx.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bvjvdr.exec:\bvjvdr.exe56⤵
- Executes dropped EXE
PID:264 -
\??\c:\nvhnt.exec:\nvhnt.exe57⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fpnptph.exec:\fpnptph.exe58⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nxndbn.exec:\nxndbn.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tlpbxd.exec:\tlpbxd.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2348 -
\??\c:\xlpnvv.exec:\xlpnvv.exe61⤵
- Executes dropped EXE
PID:820 -
\??\c:\fvhfldb.exec:\fvhfldb.exe62⤵
- Executes dropped EXE
PID:976 -
\??\c:\fthvt.exec:\fthvt.exe63⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jhltx.exec:\jhltx.exe64⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rvnnjnt.exec:\rvnnjnt.exe65⤵
- Executes dropped EXE
PID:600 -
\??\c:\rtjdpx.exec:\rtjdpx.exe66⤵PID:1476
-
\??\c:\tlnvbll.exec:\tlnvbll.exe67⤵PID:1468
-
\??\c:\pttlpj.exec:\pttlpj.exe68⤵PID:2028
-
\??\c:\hnjpdxr.exec:\hnjpdxr.exe69⤵PID:2596
-
\??\c:\pphjxjj.exec:\pphjxjj.exe70⤵PID:3012
-
\??\c:\hllhn.exec:\hllhn.exe71⤵PID:2212
-
\??\c:\dxjphf.exec:\dxjphf.exe72⤵PID:112
-
\??\c:\jrvlf.exec:\jrvlf.exe73⤵PID:1320
-
\??\c:\nvllb.exec:\nvllb.exe74⤵PID:2420
-
\??\c:\pxpnnf.exec:\pxpnnf.exe75⤵PID:2384
-
\??\c:\btplxf.exec:\btplxf.exe76⤵PID:1288
-
\??\c:\jxbvf.exec:\jxbvf.exe77⤵PID:2292
-
\??\c:\jpprf.exec:\jpprf.exe78⤵PID:2820
-
\??\c:\dhpxxd.exec:\dhpxxd.exe79⤵PID:2196
-
\??\c:\pdpfptv.exec:\pdpfptv.exe80⤵
- System Location Discovery: System Language Discovery
PID:1552 -
\??\c:\dbfptjx.exec:\dbfptjx.exe81⤵PID:2436
-
\??\c:\dfdnbpf.exec:\dfdnbpf.exe82⤵PID:2644
-
\??\c:\ltrtfl.exec:\ltrtfl.exe83⤵PID:2800
-
\??\c:\bpxph.exec:\bpxph.exe84⤵PID:2792
-
\??\c:\ntlrth.exec:\ntlrth.exe85⤵PID:2684
-
\??\c:\vjrhj.exec:\vjrhj.exe86⤵PID:2068
-
\??\c:\vdxvxj.exec:\vdxvxj.exe87⤵PID:2668
-
\??\c:\nxjxf.exec:\nxjxf.exe88⤵PID:2660
-
\??\c:\pxxbnrv.exec:\pxxbnrv.exe89⤵PID:1800
-
\??\c:\ppbfnjb.exec:\ppbfnjb.exe90⤵PID:3032
-
\??\c:\lbffxrl.exec:\lbffxrl.exe91⤵
- System Location Discovery: System Language Discovery
PID:516 -
\??\c:\phdjrr.exec:\phdjrr.exe92⤵PID:1132
-
\??\c:\ffxjfhh.exec:\ffxjfhh.exe93⤵PID:1776
-
\??\c:\lvlfj.exec:\lvlfj.exe94⤵PID:2508
-
\??\c:\ddftjx.exec:\ddftjx.exe95⤵PID:2720
-
\??\c:\jbpdvl.exec:\jbpdvl.exe96⤵PID:1308
-
\??\c:\frdnxjn.exec:\frdnxjn.exe97⤵PID:572
-
\??\c:\vpnrf.exec:\vpnrf.exe98⤵PID:1600
-
\??\c:\xlpxrj.exec:\xlpxrj.exe99⤵PID:1488
-
\??\c:\vlljnnt.exec:\vlljnnt.exe100⤵PID:2024
-
\??\c:\rfppxh.exec:\rfppxh.exe101⤵PID:2096
-
\??\c:\dldvlv.exec:\dldvlv.exe102⤵PID:1780
-
\??\c:\jhltt.exec:\jhltt.exe103⤵PID:2128
-
\??\c:\rdvjn.exec:\rdvjn.exe104⤵PID:2256
-
\??\c:\txtrjvh.exec:\txtrjvh.exe105⤵PID:768
-
\??\c:\vlnbvrr.exec:\vlnbvrr.exe106⤵PID:1384
-
\??\c:\dftdtd.exec:\dftdtd.exe107⤵PID:668
-
\??\c:\flnlxh.exec:\flnlxh.exe108⤵PID:2992
-
\??\c:\tdltdd.exec:\tdltdd.exe109⤵PID:1576
-
\??\c:\jntfprf.exec:\jntfprf.exe110⤵PID:1056
-
\??\c:\fxplh.exec:\fxplh.exe111⤵PID:1656
-
\??\c:\vfnjbnv.exec:\vfnjbnv.exe112⤵PID:2352
-
\??\c:\hhlnhtf.exec:\hhlnhtf.exe113⤵PID:2132
-
\??\c:\dlhfrvr.exec:\dlhfrvr.exe114⤵PID:3040
-
\??\c:\xjvdn.exec:\xjvdn.exe115⤵PID:1496
-
\??\c:\ntfpx.exec:\ntfpx.exe116⤵PID:1748
-
\??\c:\ffdtdb.exec:\ffdtdb.exe117⤵PID:1372
-
\??\c:\rflbb.exec:\rflbb.exe118⤵PID:2360
-
\??\c:\jrdhxr.exec:\jrdhxr.exe119⤵PID:880
-
\??\c:\dhdxn.exec:\dhdxn.exe120⤵PID:2252
-
\??\c:\vrpllb.exec:\vrpllb.exe121⤵PID:2844
-
\??\c:\xhvdxll.exec:\xhvdxll.exe122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-