Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 13:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a142998fca9c12f4160eb2e36e2f5f10N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
a142998fca9c12f4160eb2e36e2f5f10N.exe
-
Size
80KB
-
MD5
a142998fca9c12f4160eb2e36e2f5f10
-
SHA1
16734c7c7c1df4c5fdab6271ae99675f85796566
-
SHA256
a7015d10f6b924f00acac405507a811ed462ecf4348cd37478f90e18185aa66b
-
SHA512
6da9003e499e9d93ac8f9b33d4c1c547c53210fb4b13709ad6dbe755c8c1f554adb12bdf20e1f0cd6c0b6ef6a1577509d681aadba023d0111ed99c2449d3052d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC52v:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCm
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-94-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/460-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2200 jvrfn.exe 2504 rrxjx.exe 2688 hxtbdvb.exe 2812 fbbnn.exe 1852 nrndh.exe 2952 pvdtx.exe 2820 pvtjxhh.exe 2092 ljndt.exe 3068 pjdhhpj.exe 2944 bdbdllh.exe 2192 pbpvjhh.exe 2656 ttbdb.exe 1820 pvdjrpj.exe 2864 bxpvb.exe 1080 rjrvdt.exe 2920 bphhbfx.exe 688 jnplj.exe 1956 rdtxbbb.exe 1488 ddhtb.exe 2212 dxtrln.exe 2484 njtxpp.exe 2144 pvvttll.exe 2476 hdrdh.exe 460 pfnjpj.exe 2016 jdrhvbr.exe 944 rtjfnd.exe 1676 rvhxb.exe 756 dbfxrr.exe 2188 hlnhvl.exe 2980 tfdtx.exe 1208 dlbdjtf.exe 3052 bnftr.exe 2564 jhdtl.exe 2532 bbbxfd.exe 1576 ljdrxj.exe 3060 bllxh.exe 2908 xxdvdp.exe 900 ntdvpnt.exe 2744 xddbrj.exe 2688 jpffv.exe 2900 xjlllrf.exe 2760 flxrjv.exe 2596 rbjhvf.exe 2608 pxbhfxp.exe 2092 drbjhd.exe 2216 lhvdtl.exe 2084 fhhtn.exe 2964 pjftp.exe 2376 xvjdjr.exe 2184 fnpdhr.exe 368 bjhjpj.exe 1580 jhxvfn.exe 2024 htxrh.exe 2076 jftxhbl.exe 1080 hjddvv.exe 968 bjhhd.exe 2032 tjhlj.exe 1088 njvrx.exe 2264 djjnx.exe 2208 vvjxhb.exe 2420 jhdvprv.exe 2484 bbdxl.exe 2144 vbtpjd.exe 736 fxrnbl.exe -
resource yara_rule behavioral1/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/460-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxfdnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfvttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llvlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvnvpxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brbdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlrbftf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxpbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfjbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxphdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtnvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlxbdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdpbnxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlnxjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbvrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfnlxdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltrlhlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrrvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htfpprn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbxbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdrjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdbjjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txtbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfhtlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrjxxpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhdhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjprhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdphrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjtbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvhxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllvdrj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2200 2352 a142998fca9c12f4160eb2e36e2f5f10N.exe 29 PID 2352 wrote to memory of 2200 2352 a142998fca9c12f4160eb2e36e2f5f10N.exe 29 PID 2352 wrote to memory of 2200 2352 a142998fca9c12f4160eb2e36e2f5f10N.exe 29 PID 2352 wrote to memory of 2200 2352 a142998fca9c12f4160eb2e36e2f5f10N.exe 29 PID 2200 wrote to memory of 2504 2200 jvrfn.exe 30 PID 2200 wrote to memory of 2504 2200 jvrfn.exe 30 PID 2200 wrote to memory of 2504 2200 jvrfn.exe 30 PID 2200 wrote to memory of 2504 2200 jvrfn.exe 30 PID 2504 wrote to memory of 2688 2504 rrxjx.exe 31 PID 2504 wrote to memory of 2688 2504 rrxjx.exe 31 PID 2504 wrote to memory of 2688 2504 rrxjx.exe 31 PID 2504 wrote to memory of 2688 2504 rrxjx.exe 31 PID 2688 wrote to memory of 2812 2688 hxtbdvb.exe 32 PID 2688 wrote to memory of 2812 2688 hxtbdvb.exe 32 PID 2688 wrote to memory of 2812 2688 hxtbdvb.exe 32 PID 2688 wrote to memory of 2812 2688 hxtbdvb.exe 32 PID 2812 wrote to memory of 1852 2812 fbbnn.exe 33 PID 2812 wrote to memory of 1852 2812 fbbnn.exe 33 PID 2812 wrote to memory of 1852 2812 fbbnn.exe 33 PID 2812 wrote to memory of 1852 2812 fbbnn.exe 33 PID 1852 wrote to memory of 2952 1852 nrndh.exe 34 PID 1852 wrote to memory of 2952 1852 nrndh.exe 34 PID 1852 wrote to memory of 2952 1852 nrndh.exe 34 PID 1852 wrote to memory of 2952 1852 nrndh.exe 34 PID 2952 wrote to memory of 2820 2952 pvdtx.exe 35 PID 2952 wrote to memory of 2820 2952 pvdtx.exe 35 PID 2952 wrote to memory of 2820 2952 pvdtx.exe 35 PID 2952 wrote to memory of 2820 2952 pvdtx.exe 35 PID 2820 wrote to memory of 2092 2820 pvtjxhh.exe 36 PID 2820 wrote to memory of 2092 2820 pvtjxhh.exe 36 PID 2820 wrote to memory of 2092 2820 pvtjxhh.exe 36 PID 2820 wrote to memory of 2092 2820 pvtjxhh.exe 36 PID 2092 wrote to memory of 3068 2092 ljndt.exe 37 PID 2092 wrote to memory of 3068 2092 ljndt.exe 37 PID 2092 wrote to memory of 3068 2092 ljndt.exe 37 PID 2092 wrote to memory of 3068 2092 ljndt.exe 37 PID 3068 wrote to memory of 2944 3068 pjdhhpj.exe 38 PID 3068 wrote to memory of 2944 3068 pjdhhpj.exe 38 PID 3068 wrote to memory of 2944 3068 pjdhhpj.exe 38 PID 3068 wrote to memory of 2944 3068 pjdhhpj.exe 38 PID 2944 wrote to memory of 2192 2944 bdbdllh.exe 39 PID 2944 wrote to memory of 2192 2944 bdbdllh.exe 39 PID 2944 wrote to memory of 2192 2944 bdbdllh.exe 39 PID 2944 wrote to memory of 2192 2944 bdbdllh.exe 39 PID 2192 wrote to memory of 2656 2192 pbpvjhh.exe 40 PID 2192 wrote to memory of 2656 2192 pbpvjhh.exe 40 PID 2192 wrote to memory of 2656 2192 pbpvjhh.exe 40 PID 2192 wrote to memory of 2656 2192 pbpvjhh.exe 40 PID 2656 wrote to memory of 1820 2656 ttbdb.exe 41 PID 2656 wrote to memory of 1820 2656 ttbdb.exe 41 PID 2656 wrote to memory of 1820 2656 ttbdb.exe 41 PID 2656 wrote to memory of 1820 2656 ttbdb.exe 41 PID 1820 wrote to memory of 2864 1820 pvdjrpj.exe 42 PID 1820 wrote to memory of 2864 1820 pvdjrpj.exe 42 PID 1820 wrote to memory of 2864 1820 pvdjrpj.exe 42 PID 1820 wrote to memory of 2864 1820 pvdjrpj.exe 42 PID 2864 wrote to memory of 1080 2864 bxpvb.exe 43 PID 2864 wrote to memory of 1080 2864 bxpvb.exe 43 PID 2864 wrote to memory of 1080 2864 bxpvb.exe 43 PID 2864 wrote to memory of 1080 2864 bxpvb.exe 43 PID 1080 wrote to memory of 2920 1080 rjrvdt.exe 44 PID 1080 wrote to memory of 2920 1080 rjrvdt.exe 44 PID 1080 wrote to memory of 2920 1080 rjrvdt.exe 44 PID 1080 wrote to memory of 2920 1080 rjrvdt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\a142998fca9c12f4160eb2e36e2f5f10N.exe"C:\Users\Admin\AppData\Local\Temp\a142998fca9c12f4160eb2e36e2f5f10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jvrfn.exec:\jvrfn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\rrxjx.exec:\rrxjx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\hxtbdvb.exec:\hxtbdvb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fbbnn.exec:\fbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nrndh.exec:\nrndh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\pvdtx.exec:\pvdtx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pvtjxhh.exec:\pvtjxhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ljndt.exec:\ljndt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pjdhhpj.exec:\pjdhhpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\bdbdllh.exec:\bdbdllh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\pbpvjhh.exec:\pbpvjhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\ttbdb.exec:\ttbdb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pvdjrpj.exec:\pvdjrpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\bxpvb.exec:\bxpvb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rjrvdt.exec:\rjrvdt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\bphhbfx.exec:\bphhbfx.exe17⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jnplj.exec:\jnplj.exe18⤵
- Executes dropped EXE
PID:688 -
\??\c:\rdtxbbb.exec:\rdtxbbb.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ddhtb.exec:\ddhtb.exe20⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dxtrln.exec:\dxtrln.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\njtxpp.exec:\njtxpp.exe22⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pvvttll.exec:\pvvttll.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hdrdh.exec:\hdrdh.exe24⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pfnjpj.exec:\pfnjpj.exe25⤵
- Executes dropped EXE
PID:460 -
\??\c:\jdrhvbr.exec:\jdrhvbr.exe26⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rtjfnd.exec:\rtjfnd.exe27⤵
- Executes dropped EXE
PID:944 -
\??\c:\rvhxb.exec:\rvhxb.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dbfxrr.exec:\dbfxrr.exe29⤵
- Executes dropped EXE
PID:756 -
\??\c:\hlnhvl.exec:\hlnhvl.exe30⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tfdtx.exec:\tfdtx.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\dlbdjtf.exec:\dlbdjtf.exe32⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bnftr.exec:\bnftr.exe33⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jhdtl.exec:\jhdtl.exe34⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbbxfd.exec:\bbbxfd.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ljdrxj.exec:\ljdrxj.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bllxh.exec:\bllxh.exe37⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xxdvdp.exec:\xxdvdp.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ntdvpnt.exec:\ntdvpnt.exe39⤵
- Executes dropped EXE
PID:900 -
\??\c:\xddbrj.exec:\xddbrj.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jpffv.exec:\jpffv.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xjlllrf.exec:\xjlllrf.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\flxrjv.exec:\flxrjv.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rbjhvf.exec:\rbjhvf.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pxbhfxp.exec:\pxbhfxp.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\drbjhd.exec:\drbjhd.exe46⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lhvdtl.exec:\lhvdtl.exe47⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fhhtn.exec:\fhhtn.exe48⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pjftp.exec:\pjftp.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xvjdjr.exec:\xvjdjr.exe50⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fnpdhr.exec:\fnpdhr.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bjhjpj.exec:\bjhjpj.exe52⤵
- Executes dropped EXE
PID:368 -
\??\c:\jhxvfn.exec:\jhxvfn.exe53⤵
- Executes dropped EXE
PID:1580 -
\??\c:\htxrh.exec:\htxrh.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jftxhbl.exec:\jftxhbl.exe55⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hjddvv.exec:\hjddvv.exe56⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bjhhd.exec:\bjhhd.exe57⤵
- Executes dropped EXE
PID:968 -
\??\c:\tjhlj.exec:\tjhlj.exe58⤵
- Executes dropped EXE
PID:2032 -
\??\c:\njvrx.exec:\njvrx.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\djjnx.exec:\djjnx.exe60⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vvjxhb.exec:\vvjxhb.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jhdvprv.exec:\jhdvprv.exe62⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bbdxl.exec:\bbdxl.exe63⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vbtpjd.exec:\vbtpjd.exe64⤵
- Executes dropped EXE
PID:2144 -
\??\c:\fxrnbl.exec:\fxrnbl.exe65⤵
- Executes dropped EXE
PID:736 -
\??\c:\xblrlx.exec:\xblrlx.exe66⤵PID:2392
-
\??\c:\jlhjfbp.exec:\jlhjfbp.exe67⤵PID:1652
-
\??\c:\dltvrt.exec:\dltvrt.exe68⤵PID:1016
-
\??\c:\ndjlbh.exec:\ndjlbh.exe69⤵PID:1696
-
\??\c:\trlbrpl.exec:\trlbrpl.exe70⤵PID:1684
-
\??\c:\xvhfrn.exec:\xvhfrn.exe71⤵PID:956
-
\??\c:\pxxplhx.exec:\pxxplhx.exe72⤵PID:2096
-
\??\c:\vlxhxr.exec:\vlxhxr.exe73⤵PID:2188
-
\??\c:\dhrld.exec:\dhrld.exe74⤵PID:2676
-
\??\c:\fdjdh.exec:\fdjdh.exe75⤵PID:1492
-
\??\c:\ptxfrd.exec:\ptxfrd.exe76⤵PID:1736
-
\??\c:\vrhrnvp.exec:\vrhrnvp.exe77⤵PID:2124
-
\??\c:\brtthtd.exec:\brtthtd.exe78⤵PID:2528
-
\??\c:\nljppx.exec:\nljppx.exe79⤵PID:1604
-
\??\c:\tttnvl.exec:\tttnvl.exe80⤵PID:2120
-
\??\c:\bbxrn.exec:\bbxrn.exe81⤵PID:2544
-
\??\c:\lhxjppd.exec:\lhxjppd.exe82⤵PID:2752
-
\??\c:\pbppvbd.exec:\pbppvbd.exe83⤵PID:2720
-
\??\c:\rntrdv.exec:\rntrdv.exe84⤵PID:2812
-
\??\c:\xxjtf.exec:\xxjtf.exe85⤵PID:2960
-
\??\c:\dfxtdxh.exec:\dfxtdxh.exe86⤵PID:2776
-
\??\c:\dbdplx.exec:\dbdplx.exe87⤵PID:2952
-
\??\c:\dpjtbj.exec:\dpjtbj.exe88⤵
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\vdfjbr.exec:\vdfjbr.exe89⤵PID:2104
-
\??\c:\xrbht.exec:\xrbht.exe90⤵PID:2660
-
\??\c:\phnvf.exec:\phnvf.exe91⤵PID:2956
-
\??\c:\hhrlxnb.exec:\hhrlxnb.exe92⤵PID:2936
-
\??\c:\vnrtvt.exec:\vnrtvt.exe93⤵PID:1724
-
\??\c:\hfhfjh.exec:\hfhfjh.exe94⤵PID:2524
-
\??\c:\pbnrfnh.exec:\pbnrfnh.exe95⤵PID:2500
-
\??\c:\rxvtbl.exec:\rxvtbl.exe96⤵PID:1820
-
\??\c:\dhpdnff.exec:\dhpdnff.exe97⤵PID:2864
-
\??\c:\lpvhhn.exec:\lpvhhn.exe98⤵PID:2868
-
\??\c:\trjnr.exec:\trjnr.exe99⤵PID:612
-
\??\c:\hfdvv.exec:\hfdvv.exe100⤵PID:1768
-
\??\c:\vnxjfjj.exec:\vnxjfjj.exe101⤵PID:3008
-
\??\c:\hnddrhf.exec:\hnddrhf.exe102⤵PID:2344
-
\??\c:\xxhnftv.exec:\xxhnftv.exe103⤵PID:2408
-
\??\c:\bdnthbx.exec:\bdnthbx.exe104⤵PID:2260
-
\??\c:\llxxh.exec:\llxxh.exe105⤵PID:576
-
\??\c:\jxvxp.exec:\jxvxp.exe106⤵PID:3004
-
\??\c:\jxbhfj.exec:\jxbhfj.exe107⤵PID:1040
-
\??\c:\jfhnxr.exec:\jfhnxr.exe108⤵PID:2476
-
\??\c:\tbvvbh.exec:\tbvvbh.exe109⤵PID:764
-
\??\c:\rxfvv.exec:\rxfvv.exe110⤵PID:1332
-
\??\c:\rnrrjpv.exec:\rnrrjpv.exe111⤵PID:1644
-
\??\c:\ttttl.exec:\ttttl.exe112⤵PID:1696
-
\??\c:\tlvlld.exec:\tlvlld.exe113⤵PID:1676
-
\??\c:\bnvxnl.exec:\bnvxnl.exe114⤵PID:2172
-
\??\c:\xxhvjtd.exec:\xxhvjtd.exe115⤵PID:1636
-
\??\c:\btnltfn.exec:\btnltfn.exe116⤵PID:2188
-
\??\c:\hvnfplv.exec:\hvnfplv.exe117⤵PID:2160
-
\??\c:\lvvxv.exec:\lvvxv.exe118⤵PID:2396
-
\??\c:\lnrlv.exec:\lnrlv.exe119⤵PID:2904
-
\??\c:\dvnfn.exec:\dvnfn.exe120⤵PID:2364
-
\??\c:\nnlfrn.exec:\nnlfrn.exe121⤵PID:1840
-
\??\c:\bvbvbhx.exec:\bvbvbhx.exe122⤵PID:2052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-