Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 21:38
Static task
static1
Behavioral task
behavioral1
Sample
4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe
Resource
win7-20240903-en
General
-
Target
4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe
-
Size
593KB
-
MD5
d3bb638ec9454f8a0089189e3157cc17
-
SHA1
640ae0f4c3da443a71b4f97d4cd8ba107fea8588
-
SHA256
4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203
-
SHA512
1d300a3298e9430276fbaa38426c6e93da7b642e78f546690b5cb61233c8833e1702961d36846ecfb668038d6afba71f58ab1370f454d112099fe1fe58394643
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayLAw:n3C9Lebz+xt4vFeFmgayX
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2548-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1544 vvppd.exe 836 bhhntt.exe 2564 pvdvv.exe 2256 9lflflr.exe 2888 tnbtbn.exe 2848 bbbbtt.exe 2724 vdjpv.exe 2792 5jppj.exe 2688 thbhbt.exe 2492 ffrlxrf.exe 632 ffrxfxf.exe 1584 htnnnh.exe 1412 1dvdj.exe 2816 bbhhtn.exe 756 jdpjv.exe 1088 vpppd.exe 1852 ffrrfrx.exe 1120 vpddj.exe 2480 9rrxrrr.exe 960 nnnhhh.exe 2332 bhbnbb.exe 1552 ttbbbb.exe 616 vpdjd.exe 620 jpvvp.exe 916 nttntb.exe 2840 tththn.exe 2484 jpdjv.exe 2212 rlflxrr.exe 3028 bhhtnh.exe 1520 xfxxrrf.exe 2516 rrrflrl.exe 1536 vjdvj.exe 1252 bthhnh.exe 2160 jdpjp.exe 2568 fffrrfl.exe 2540 lllxfxr.exe 2876 ntnbbt.exe 2868 pddjd.exe 2852 xffxxrf.exe 2948 nhbhbb.exe 2880 vpdjj.exe 2800 xxxfrfl.exe 2632 xxfxllr.exe 2356 nnhnhh.exe 2696 jpvjv.exe 2492 rxlflrl.exe 2824 tnbtnn.exe 2972 jvdjv.exe 2924 rrxfffx.exe 752 hbbhht.exe 1324 7pddd.exe 840 fxxflxl.exe 1220 ttbtbn.exe 996 pdppp.exe 2100 flxffxf.exe 2208 tbttbn.exe 2308 vvpjd.exe 2116 rlrlxlf.exe 3036 tbbhtb.exe 1888 vdjvd.exe 1712 rlxrrll.exe 1912 5nnntt.exe 620 vjdjj.exe 1028 fxxxlfl.exe -
resource yara_rule behavioral1/memory/2548-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1544 2548 4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe 30 PID 2548 wrote to memory of 1544 2548 4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe 30 PID 2548 wrote to memory of 1544 2548 4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe 30 PID 2548 wrote to memory of 1544 2548 4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe 30 PID 1544 wrote to memory of 836 1544 vvppd.exe 31 PID 1544 wrote to memory of 836 1544 vvppd.exe 31 PID 1544 wrote to memory of 836 1544 vvppd.exe 31 PID 1544 wrote to memory of 836 1544 vvppd.exe 31 PID 836 wrote to memory of 2564 836 bhhntt.exe 32 PID 836 wrote to memory of 2564 836 bhhntt.exe 32 PID 836 wrote to memory of 2564 836 bhhntt.exe 32 PID 836 wrote to memory of 2564 836 bhhntt.exe 32 PID 2564 wrote to memory of 2256 2564 pvdvv.exe 33 PID 2564 wrote to memory of 2256 2564 pvdvv.exe 33 PID 2564 wrote to memory of 2256 2564 pvdvv.exe 33 PID 2564 wrote to memory of 2256 2564 pvdvv.exe 33 PID 2256 wrote to memory of 2888 2256 9lflflr.exe 34 PID 2256 wrote to memory of 2888 2256 9lflflr.exe 34 PID 2256 wrote to memory of 2888 2256 9lflflr.exe 34 PID 2256 wrote to memory of 2888 2256 9lflflr.exe 34 PID 2888 wrote to memory of 2848 2888 tnbtbn.exe 35 PID 2888 wrote to memory of 2848 2888 tnbtbn.exe 35 PID 2888 wrote to memory of 2848 2888 tnbtbn.exe 35 PID 2888 wrote to memory of 2848 2888 tnbtbn.exe 35 PID 2848 wrote to memory of 2724 2848 bbbbtt.exe 36 PID 2848 wrote to memory of 2724 2848 bbbbtt.exe 36 PID 2848 wrote to memory of 2724 2848 bbbbtt.exe 36 PID 2848 wrote to memory of 2724 2848 bbbbtt.exe 36 PID 2724 wrote to memory of 2792 2724 vdjpv.exe 37 PID 2724 wrote to memory of 2792 2724 vdjpv.exe 37 PID 2724 wrote to memory of 2792 2724 vdjpv.exe 37 PID 2724 wrote to memory of 2792 2724 vdjpv.exe 37 PID 2792 wrote to memory of 2688 2792 5jppj.exe 38 PID 2792 wrote to memory of 2688 2792 5jppj.exe 38 PID 2792 wrote to memory of 2688 2792 5jppj.exe 38 PID 2792 wrote to memory of 2688 2792 5jppj.exe 38 PID 2688 wrote to memory of 2492 2688 thbhbt.exe 39 PID 2688 wrote to memory of 2492 2688 thbhbt.exe 39 PID 2688 wrote to memory of 2492 2688 thbhbt.exe 39 PID 2688 wrote to memory of 2492 2688 thbhbt.exe 39 PID 2492 wrote to memory of 632 2492 ffrlxrf.exe 40 PID 2492 wrote to memory of 632 2492 ffrlxrf.exe 40 PID 2492 wrote to memory of 632 2492 ffrlxrf.exe 40 PID 2492 wrote to memory of 632 2492 ffrlxrf.exe 40 PID 632 wrote to memory of 1584 632 ffrxfxf.exe 41 PID 632 wrote to memory of 1584 632 ffrxfxf.exe 41 PID 632 wrote to memory of 1584 632 ffrxfxf.exe 41 PID 632 wrote to memory of 1584 632 ffrxfxf.exe 41 PID 1584 wrote to memory of 1412 1584 htnnnh.exe 42 PID 1584 wrote to memory of 1412 1584 htnnnh.exe 42 PID 1584 wrote to memory of 1412 1584 htnnnh.exe 42 PID 1584 wrote to memory of 1412 1584 htnnnh.exe 42 PID 1412 wrote to memory of 2816 1412 1dvdj.exe 43 PID 1412 wrote to memory of 2816 1412 1dvdj.exe 43 PID 1412 wrote to memory of 2816 1412 1dvdj.exe 43 PID 1412 wrote to memory of 2816 1412 1dvdj.exe 43 PID 2816 wrote to memory of 756 2816 bbhhtn.exe 44 PID 2816 wrote to memory of 756 2816 bbhhtn.exe 44 PID 2816 wrote to memory of 756 2816 bbhhtn.exe 44 PID 2816 wrote to memory of 756 2816 bbhhtn.exe 44 PID 756 wrote to memory of 1088 756 jdpjv.exe 45 PID 756 wrote to memory of 1088 756 jdpjv.exe 45 PID 756 wrote to memory of 1088 756 jdpjv.exe 45 PID 756 wrote to memory of 1088 756 jdpjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe"C:\Users\Admin\AppData\Local\Temp\4cc15348dc0fb2327b69f4b22434e5027ccf5c6f06b76b83515542a30d013203.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vvppd.exec:\vvppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\bhhntt.exec:\bhhntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\pvdvv.exec:\pvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\9lflflr.exec:\9lflflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\tnbtbn.exec:\tnbtbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bbbbtt.exec:\bbbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vdjpv.exec:\vdjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5jppj.exec:\5jppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\thbhbt.exec:\thbhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ffrlxrf.exec:\ffrlxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ffrxfxf.exec:\ffrxfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\htnnnh.exec:\htnnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\1dvdj.exec:\1dvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\bbhhtn.exec:\bbhhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jdpjv.exec:\jdpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vpppd.exec:\vpppd.exe17⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ffrrfrx.exec:\ffrrfrx.exe18⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vpddj.exec:\vpddj.exe19⤵
- Executes dropped EXE
PID:1120 -
\??\c:\9rrxrrr.exec:\9rrxrrr.exe20⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nnnhhh.exec:\nnnhhh.exe21⤵
- Executes dropped EXE
PID:960 -
\??\c:\bhbnbb.exec:\bhbnbb.exe22⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ttbbbb.exec:\ttbbbb.exe23⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vpdjd.exec:\vpdjd.exe24⤵
- Executes dropped EXE
PID:616 -
\??\c:\jpvvp.exec:\jpvvp.exe25⤵
- Executes dropped EXE
PID:620 -
\??\c:\nttntb.exec:\nttntb.exe26⤵
- Executes dropped EXE
PID:916 -
\??\c:\tththn.exec:\tththn.exe27⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jpdjv.exec:\jpdjv.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rlflxrr.exec:\rlflxrr.exe29⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bhhtnh.exec:\bhhtnh.exe30⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xfxxrrf.exec:\xfxxrrf.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rrrflrl.exec:\rrrflrl.exe32⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vjdvj.exec:\vjdvj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1536 -
\??\c:\bthhnh.exec:\bthhnh.exe34⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jdpjp.exec:\jdpjp.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fffrrfl.exec:\fffrrfl.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lllxfxr.exec:\lllxfxr.exe37⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ntnbbt.exec:\ntnbbt.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pddjd.exec:\pddjd.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xffxxrf.exec:\xffxxrf.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nhbhbb.exec:\nhbhbb.exe41⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vpdjj.exec:\vpdjj.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxxfrfl.exec:\xxxfrfl.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xxfxllr.exec:\xxfxllr.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nnhnhh.exec:\nnhnhh.exe45⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jpvjv.exec:\jpvjv.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rxlflrl.exec:\rxlflrl.exe47⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnbtnn.exec:\tnbtnn.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jvdjv.exec:\jvdjv.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rrxfffx.exec:\rrxfffx.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hbbhht.exec:\hbbhht.exe51⤵
- Executes dropped EXE
PID:752 -
\??\c:\7pddd.exec:\7pddd.exe52⤵
- Executes dropped EXE
PID:1324 -
\??\c:\fxxflxl.exec:\fxxflxl.exe53⤵
- Executes dropped EXE
PID:840 -
\??\c:\ttbtbn.exec:\ttbtbn.exe54⤵
- Executes dropped EXE
PID:1220 -
\??\c:\pdppp.exec:\pdppp.exe55⤵
- Executes dropped EXE
PID:996 -
\??\c:\flxffxf.exec:\flxffxf.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tbttbn.exec:\tbttbn.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vvpjd.exec:\vvpjd.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rlrlxlf.exec:\rlrlxlf.exe59⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tbbhtb.exec:\tbbhtb.exe60⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vdjvd.exec:\vdjvd.exe61⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rlxrrll.exec:\rlxrrll.exe62⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5nnntt.exec:\5nnntt.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vjdjj.exec:\vjdjj.exe64⤵
- Executes dropped EXE
PID:620 -
\??\c:\fxxxlfl.exec:\fxxxlfl.exe65⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xfrrlrf.exec:\xfrrlrf.exe66⤵PID:3056
-
\??\c:\pvpdd.exec:\pvpdd.exe67⤵PID:1928
-
\??\c:\vdppj.exec:\vdppj.exe68⤵PID:1916
-
\??\c:\htnnbh.exec:\htnnbh.exe69⤵PID:1748
-
\??\c:\tbntnh.exec:\tbntnh.exe70⤵PID:884
-
\??\c:\jjjjp.exec:\jjjjp.exe71⤵PID:2024
-
\??\c:\bhhnhh.exec:\bhhnhh.exe72⤵PID:1956
-
\??\c:\ppvdp.exec:\ppvdp.exe73⤵PID:1524
-
\??\c:\fllrrrx.exec:\fllrrrx.exe74⤵PID:1724
-
\??\c:\9hnbbb.exec:\9hnbbb.exe75⤵PID:2348
-
\??\c:\ppdjv.exec:\ppdjv.exe76⤵PID:2708
-
\??\c:\ffrxfll.exec:\ffrxfll.exe77⤵PID:2552
-
\??\c:\bhthtn.exec:\bhthtn.exe78⤵PID:2764
-
\??\c:\vpdvd.exec:\vpdvd.exe79⤵PID:2780
-
\??\c:\5hbnbb.exec:\5hbnbb.exe80⤵PID:2772
-
\??\c:\vdvdd.exec:\vdvdd.exe81⤵PID:2060
-
\??\c:\rlrxllx.exec:\rlrxllx.exe82⤵PID:2648
-
\??\c:\hbbhtt.exec:\hbbhtt.exe83⤵PID:2620
-
\??\c:\pjpjv.exec:\pjpjv.exe84⤵PID:2724
-
\??\c:\rffffrr.exec:\rffffrr.exe85⤵PID:1456
-
\??\c:\bbnnth.exec:\bbnnth.exe86⤵PID:2356
-
\??\c:\ddvpd.exec:\ddvpd.exe87⤵PID:844
-
\??\c:\3hbttb.exec:\3hbttb.exe88⤵PID:1556
-
\??\c:\ddppp.exec:\ddppp.exe89⤵PID:2964
-
\??\c:\5lfrrxf.exec:\5lfrrxf.exe90⤵PID:2692
-
\??\c:\hthhbh.exec:\hthhbh.exe91⤵PID:2820
-
\??\c:\djjvp.exec:\djjvp.exe92⤵PID:2960
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe93⤵PID:328
-
\??\c:\hnbbtt.exec:\hnbbtt.exe94⤵PID:1892
-
\??\c:\vvvpj.exec:\vvvpj.exe95⤵PID:1860
-
\??\c:\pdvdv.exec:\pdvdv.exe96⤵PID:236
-
\??\c:\xxrrxrr.exec:\xxrrxrr.exe97⤵PID:2100
-
\??\c:\hbntbb.exec:\hbntbb.exe98⤵PID:1656
-
\??\c:\pjpvv.exec:\pjpvv.exe99⤵PID:3044
-
\??\c:\lfrfrlx.exec:\lfrfrlx.exe100⤵PID:960
-
\??\c:\nhttnn.exec:\nhttnn.exe101⤵PID:1516
-
\??\c:\vjjdp.exec:\vjjdp.exe102⤵PID:2660
-
\??\c:\fxfrfxr.exec:\fxfrfxr.exe103⤵PID:1264
-
\??\c:\hhnbnb.exec:\hhnbnb.exe104⤵PID:1912
-
\??\c:\vvvvp.exec:\vvvvp.exe105⤵PID:908
-
\??\c:\rxlffrr.exec:\rxlffrr.exe106⤵PID:1676
-
\??\c:\btnnth.exec:\btnnth.exe107⤵PID:3056
-
\??\c:\hhtbnb.exec:\hhtbnb.exe108⤵PID:1928
-
\??\c:\7dvvj.exec:\7dvvj.exe109⤵PID:2324
-
\??\c:\1nthbt.exec:\1nthbt.exe110⤵PID:1748
-
\??\c:\ppppj.exec:\ppppj.exe111⤵PID:884
-
\??\c:\xfffxxx.exec:\xfffxxx.exe112⤵PID:1992
-
\??\c:\nnthtb.exec:\nnthtb.exe113⤵PID:1956
-
\??\c:\vjppp.exec:\vjppp.exe114⤵PID:1524
-
\??\c:\xflrrfr.exec:\xflrrfr.exe115⤵PID:1724
-
\??\c:\bbbtbt.exec:\bbbtbt.exe116⤵PID:2160
-
\??\c:\5pjdp.exec:\5pjdp.exe117⤵PID:2856
-
\??\c:\lflxlrf.exec:\lflxlrf.exe118⤵PID:2256
-
\??\c:\hbnnbb.exec:\hbnnbb.exe119⤵PID:2764
-
\??\c:\vpjdv.exec:\vpjdv.exe120⤵PID:2740
-
\??\c:\llfllrf.exec:\llfllrf.exe121⤵PID:2772
-
\??\c:\nthhtb.exec:\nthhtb.exe122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-