Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe
Resource
win7-20240903-en
General
-
Target
150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe
-
Size
383KB
-
MD5
e10912ffc2ce6d07940672e9f6dee201
-
SHA1
bd4aa760ce86808e11cbc8efc976640f9e2d5c8c
-
SHA256
150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54
-
SHA512
0e6d55450664835cacafb40c662a94afb3dccacfb8f6799b5d0e54c5ac160fe4bff5282b630cebeed2ee3249bed909a2c39530787b9740be606f8b4826ac096a
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwv:n3C9uYA7okVqdKwaO5CVS
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2468-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2140 9dvdv.exe 2760 bbthtb.exe 2204 rrrxlrx.exe 2168 bbhthh.exe 2604 rffrxlr.exe 2016 tnnnhn.exe 1940 3jpjp.exe 2208 fxxxrlr.exe 2064 btnnhn.exe 2832 vvvjv.exe 2696 hbttbh.exe 2948 pjdjj.exe 1248 xxfrxfx.exe 1268 bnnbbh.exe 2192 5vpvv.exe 1632 ffflxxr.exe 3004 jjjvp.exe 1816 rxrlrrl.exe 2584 3htbbh.exe 1132 pjvvd.exe 1472 fxlfllx.exe 292 hhtthh.exe 1520 lxrrffx.exe 1772 rlrrxrx.exe 600 vpppv.exe 2392 jvjjj.exe 772 tttthh.exe 2176 vjdpv.exe 876 5lrxxfl.exe 2416 7thhnh.exe 2468 ppdvd.exe 1592 lxlrrxl.exe 2864 dvjvv.exe 2196 9lrrxfr.exe 2916 5xrrrxf.exe 2640 ttnntt.exe 2780 pjdjv.exe 2616 7lxxffr.exe 2604 xrxrrlr.exe 2220 bhttnn.exe 2016 jdjjd.exe 1784 1jdpv.exe 2060 rxxllfx.exe 2784 nbttbt.exe 2064 3tnntt.exe 848 1djpp.exe 2812 pdpjp.exe 2352 rrfxfff.exe 2948 hnhtbt.exe 764 hbnntb.exe 1268 vjpjd.exe 2964 rflffxf.exe 676 3lffffl.exe 2296 7nhnnt.exe 1324 jdvvj.exe 1816 1lfxfll.exe 2324 5ffrrll.exe 2336 tnttnt.exe 2292 jjpvv.exe 1768 ffxlxfr.exe 292 xlxxrrl.exe 1520 3bnhbb.exe 760 7vpdj.exe 2476 flxrflx.exe -
resource yara_rule behavioral1/memory/2468-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1132-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2140 2468 150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe 30 PID 2468 wrote to memory of 2140 2468 150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe 30 PID 2468 wrote to memory of 2140 2468 150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe 30 PID 2468 wrote to memory of 2140 2468 150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe 30 PID 2140 wrote to memory of 2760 2140 9dvdv.exe 31 PID 2140 wrote to memory of 2760 2140 9dvdv.exe 31 PID 2140 wrote to memory of 2760 2140 9dvdv.exe 31 PID 2140 wrote to memory of 2760 2140 9dvdv.exe 31 PID 2760 wrote to memory of 2204 2760 bbthtb.exe 32 PID 2760 wrote to memory of 2204 2760 bbthtb.exe 32 PID 2760 wrote to memory of 2204 2760 bbthtb.exe 32 PID 2760 wrote to memory of 2204 2760 bbthtb.exe 32 PID 2204 wrote to memory of 2168 2204 rrrxlrx.exe 33 PID 2204 wrote to memory of 2168 2204 rrrxlrx.exe 33 PID 2204 wrote to memory of 2168 2204 rrrxlrx.exe 33 PID 2204 wrote to memory of 2168 2204 rrrxlrx.exe 33 PID 2168 wrote to memory of 2604 2168 bbhthh.exe 34 PID 2168 wrote to memory of 2604 2168 bbhthh.exe 34 PID 2168 wrote to memory of 2604 2168 bbhthh.exe 34 PID 2168 wrote to memory of 2604 2168 bbhthh.exe 34 PID 2604 wrote to memory of 2016 2604 rffrxlr.exe 35 PID 2604 wrote to memory of 2016 2604 rffrxlr.exe 35 PID 2604 wrote to memory of 2016 2604 rffrxlr.exe 35 PID 2604 wrote to memory of 2016 2604 rffrxlr.exe 35 PID 2016 wrote to memory of 1940 2016 tnnnhn.exe 36 PID 2016 wrote to memory of 1940 2016 tnnnhn.exe 36 PID 2016 wrote to memory of 1940 2016 tnnnhn.exe 36 PID 2016 wrote to memory of 1940 2016 tnnnhn.exe 36 PID 1940 wrote to memory of 2208 1940 3jpjp.exe 37 PID 1940 wrote to memory of 2208 1940 3jpjp.exe 37 PID 1940 wrote to memory of 2208 1940 3jpjp.exe 37 PID 1940 wrote to memory of 2208 1940 3jpjp.exe 37 PID 2208 wrote to memory of 2064 2208 fxxxrlr.exe 38 PID 2208 wrote to memory of 2064 2208 fxxxrlr.exe 38 PID 2208 wrote to memory of 2064 2208 fxxxrlr.exe 38 PID 2208 wrote to memory of 2064 2208 fxxxrlr.exe 38 PID 2064 wrote to memory of 2832 2064 btnnhn.exe 39 PID 2064 wrote to memory of 2832 2064 btnnhn.exe 39 PID 2064 wrote to memory of 2832 2064 btnnhn.exe 39 PID 2064 wrote to memory of 2832 2064 btnnhn.exe 39 PID 2832 wrote to memory of 2696 2832 vvvjv.exe 40 PID 2832 wrote to memory of 2696 2832 vvvjv.exe 40 PID 2832 wrote to memory of 2696 2832 vvvjv.exe 40 PID 2832 wrote to memory of 2696 2832 vvvjv.exe 40 PID 2696 wrote to memory of 2948 2696 hbttbh.exe 41 PID 2696 wrote to memory of 2948 2696 hbttbh.exe 41 PID 2696 wrote to memory of 2948 2696 hbttbh.exe 41 PID 2696 wrote to memory of 2948 2696 hbttbh.exe 41 PID 2948 wrote to memory of 1248 2948 pjdjj.exe 42 PID 2948 wrote to memory of 1248 2948 pjdjj.exe 42 PID 2948 wrote to memory of 1248 2948 pjdjj.exe 42 PID 2948 wrote to memory of 1248 2948 pjdjj.exe 42 PID 1248 wrote to memory of 1268 1248 xxfrxfx.exe 43 PID 1248 wrote to memory of 1268 1248 xxfrxfx.exe 43 PID 1248 wrote to memory of 1268 1248 xxfrxfx.exe 43 PID 1248 wrote to memory of 1268 1248 xxfrxfx.exe 43 PID 1268 wrote to memory of 2192 1268 bnnbbh.exe 44 PID 1268 wrote to memory of 2192 1268 bnnbbh.exe 44 PID 1268 wrote to memory of 2192 1268 bnnbbh.exe 44 PID 1268 wrote to memory of 2192 1268 bnnbbh.exe 44 PID 2192 wrote to memory of 1632 2192 5vpvv.exe 45 PID 2192 wrote to memory of 1632 2192 5vpvv.exe 45 PID 2192 wrote to memory of 1632 2192 5vpvv.exe 45 PID 2192 wrote to memory of 1632 2192 5vpvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe"C:\Users\Admin\AppData\Local\Temp\150d68770dd1daebd5489d5d068590640d2fd495898a863836e69db5a8378e54.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9dvdv.exec:\9dvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\bbthtb.exec:\bbthtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\bbhthh.exec:\bbhthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rffrxlr.exec:\rffrxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tnnnhn.exec:\tnnnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\3jpjp.exec:\3jpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\fxxxrlr.exec:\fxxxrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\btnnhn.exec:\btnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vvvjv.exec:\vvvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\hbttbh.exec:\hbttbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjdjj.exec:\pjdjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xxfrxfx.exec:\xxfrxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\bnnbbh.exec:\bnnbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\5vpvv.exec:\5vpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\ffflxxr.exec:\ffflxxr.exe17⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jjjvp.exec:\jjjvp.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rxrlrrl.exec:\rxrlrrl.exe19⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3htbbh.exec:\3htbbh.exe20⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pjvvd.exec:\pjvvd.exe21⤵
- Executes dropped EXE
PID:1132 -
\??\c:\fxlfllx.exec:\fxlfllx.exe22⤵
- Executes dropped EXE
PID:1472 -
\??\c:\hhtthh.exec:\hhtthh.exe23⤵
- Executes dropped EXE
PID:292 -
\??\c:\lxrrffx.exec:\lxrrffx.exe24⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vpppv.exec:\vpppv.exe26⤵
- Executes dropped EXE
PID:600 -
\??\c:\jvjjj.exec:\jvjjj.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tttthh.exec:\tttthh.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\vjdpv.exec:\vjdpv.exe29⤵
- Executes dropped EXE
PID:2176 -
\??\c:\5lrxxfl.exec:\5lrxxfl.exe30⤵
- Executes dropped EXE
PID:876 -
\??\c:\7thhnh.exec:\7thhnh.exe31⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ppdvd.exec:\ppdvd.exe32⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lxlrrxl.exec:\lxlrrxl.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dvjvv.exec:\dvjvv.exe34⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9lrrxfr.exec:\9lrrxfr.exe35⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5xrrrxf.exec:\5xrrrxf.exe36⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ttnntt.exec:\ttnntt.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjdjv.exec:\pjdjv.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7lxxffr.exec:\7lxxffr.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bhttnn.exec:\bhttnn.exe41⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jdjjd.exec:\jdjjd.exe42⤵
- Executes dropped EXE
PID:2016 -
\??\c:\1jdpv.exec:\1jdpv.exe43⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rxxllfx.exec:\rxxllfx.exe44⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nbttbt.exec:\nbttbt.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3tnntt.exec:\3tnntt.exe46⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1djpp.exec:\1djpp.exe47⤵
- Executes dropped EXE
PID:848 -
\??\c:\pdpjp.exec:\pdpjp.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rrfxfff.exec:\rrfxfff.exe49⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hnhtbt.exec:\hnhtbt.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hbnntb.exec:\hbnntb.exe51⤵
- Executes dropped EXE
PID:764 -
\??\c:\vjpjd.exec:\vjpjd.exe52⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rflffxf.exec:\rflffxf.exe53⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3lffffl.exec:\3lffffl.exe54⤵
- Executes dropped EXE
PID:676 -
\??\c:\7nhnnt.exec:\7nhnnt.exe55⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jdvvj.exec:\jdvvj.exe56⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1lfxfll.exec:\1lfxfll.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\5ffrrll.exec:\5ffrrll.exe58⤵
- Executes dropped EXE
PID:2324 -
\??\c:\tnttnt.exec:\tnttnt.exe59⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jjpvv.exec:\jjpvv.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe61⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xlxxrrl.exec:\xlxxrrl.exe62⤵
- Executes dropped EXE
PID:292 -
\??\c:\3bnhbb.exec:\3bnhbb.exe63⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7vpdj.exec:\7vpdj.exe64⤵
- Executes dropped EXE
PID:760 -
\??\c:\flxrflx.exec:\flxrflx.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lfrxflf.exec:\lfrxflf.exe66⤵PID:1892
-
\??\c:\tnhntb.exec:\tnhntb.exe67⤵PID:2516
-
\??\c:\vjddd.exec:\vjddd.exe68⤵PID:772
-
\??\c:\ddjpj.exec:\ddjpj.exe69⤵PID:2984
-
\??\c:\7xllxfl.exec:\7xllxfl.exe70⤵PID:1800
-
\??\c:\nhbtth.exec:\nhbtth.exe71⤵PID:3032
-
\??\c:\7thhnt.exec:\7thhnt.exe72⤵PID:2892
-
\??\c:\ddpvv.exec:\ddpvv.exe73⤵PID:2860
-
\??\c:\rlxlrrf.exec:\rlxlrrf.exe74⤵PID:1596
-
\??\c:\9xxrlrf.exec:\9xxrlrf.exe75⤵PID:2716
-
\??\c:\ttthbn.exec:\ttthbn.exe76⤵PID:2924
-
\??\c:\3djpv.exec:\3djpv.exe77⤵PID:2944
-
\??\c:\pjjjp.exec:\pjjjp.exe78⤵PID:2204
-
\??\c:\lxlfrxl.exec:\lxlfrxl.exe79⤵PID:2652
-
\??\c:\nhhnbn.exec:\nhhnbn.exe80⤵PID:2684
-
\??\c:\nhbtbb.exec:\nhbtbb.exe81⤵PID:2680
-
\??\c:\9jpvd.exec:\9jpvd.exe82⤵PID:800
-
\??\c:\flffrxl.exec:\flffrxl.exe83⤵PID:2052
-
\??\c:\thtttt.exec:\thtttt.exe84⤵PID:1636
-
\??\c:\bnbbbb.exec:\bnbbbb.exe85⤵PID:664
-
\??\c:\vjvpp.exec:\vjvpp.exe86⤵PID:1280
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe87⤵PID:532
-
\??\c:\7lrllfl.exec:\7lrllfl.exe88⤵PID:2696
-
\??\c:\5bbtbh.exec:\5bbtbh.exe89⤵PID:2804
-
\??\c:\nntttt.exec:\nntttt.exe90⤵PID:2340
-
\??\c:\jjvvj.exec:\jjvvj.exe91⤵PID:1248
-
\??\c:\rrlfffr.exec:\rrlfffr.exe92⤵PID:1652
-
\??\c:\fxrxflr.exec:\fxrxflr.exe93⤵PID:2024
-
\??\c:\thtbnh.exec:\thtbnh.exe94⤵PID:584
-
\??\c:\thbbtt.exec:\thbbtt.exe95⤵PID:2120
-
\??\c:\jvjdd.exec:\jvjdd.exe96⤵PID:1432
-
\??\c:\llxrlff.exec:\llxrlff.exe97⤵PID:548
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe98⤵PID:1660
-
\??\c:\7tbttt.exec:\7tbttt.exe99⤵PID:1244
-
\??\c:\pdpdj.exec:\pdpdj.exe100⤵PID:1688
-
\??\c:\7djvj.exec:\7djvj.exe101⤵PID:1608
-
\??\c:\llxflfl.exec:\llxflfl.exe102⤵PID:860
-
\??\c:\bhhbnh.exec:\bhhbnh.exe103⤵PID:1540
-
\??\c:\9djvd.exec:\9djvd.exe104⤵PID:920
-
\??\c:\7vpvd.exec:\7vpvd.exe105⤵PID:1164
-
\??\c:\ffxrfxf.exec:\ffxrfxf.exe106⤵PID:2148
-
\??\c:\ttbtht.exec:\ttbtht.exe107⤵PID:2392
-
\??\c:\9dvdp.exec:\9dvdp.exe108⤵PID:1848
-
\??\c:\vppvj.exec:\vppvj.exe109⤵PID:2692
-
\??\c:\5rffrrf.exec:\5rffrrf.exe110⤵PID:2532
-
\??\c:\tbnhtt.exec:\tbnhtt.exe111⤵PID:2748
-
\??\c:\vdpdj.exec:\vdpdj.exe112⤵PID:1584
-
\??\c:\jdpjp.exec:\jdpjp.exe113⤵PID:2868
-
\??\c:\xrllrxf.exec:\xrllrxf.exe114⤵PID:2756
-
\??\c:\ttttbh.exec:\ttttbh.exe115⤵PID:1592
-
\??\c:\9tntth.exec:\9tntth.exe116⤵PID:2864
-
\??\c:\dpppd.exec:\dpppd.exe117⤵PID:2924
-
\??\c:\jdvdj.exec:\jdvdj.exe118⤵PID:2932
-
\??\c:\xrffrrx.exec:\xrffrrx.exe119⤵PID:2204
-
\??\c:\btnnnn.exec:\btnnnn.exe120⤵PID:2780
-
\??\c:\ttnnhh.exec:\ttnnhh.exe121⤵PID:2624
-
\??\c:\3pdjp.exec:\3pdjp.exe122⤵PID:2220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-