Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe
-
Size
374KB
-
MD5
01bf4cc33e71c7226563435e6059aeff
-
SHA1
2da5e466fe8065424b0a90ead94f5e91ea46ae8d
-
SHA256
a2a6dfb0d39d5e2b98cbaf8175b9be05b2c8a4c0dbc48123fe4785e6b00affe6
-
SHA512
323628b0d48d41d3ff61f9d4da71006bf07b6e0ccb53ffc31d9e69daf741da1924cedb9dd3c95d4df5cc0d99de4aa0ec8e456da532f3ce3aa523ed26c82507d1
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QOhsJ4BCW6EW:n3C9BRo7MlrWKo+lBhW
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2708-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2708 ddpdv.exe 2844 pjvjp.exe 1984 9djdp.exe 2724 vpjjj.exe 2628 frrffrr.exe 1736 bhthnb.exe 2884 pjvdv.exe 2344 lrxxxrr.exe 2536 ttbhtn.exe 2876 jvppd.exe 2796 ffllxfr.exe 2948 bbtthh.exe 3068 djvdj.exe 2480 rrflffl.exe 340 7bhhnh.exe 2428 pdjdv.exe 2064 rxffllf.exe 2124 bhnbth.exe 2116 vppdj.exe 844 lrrrlxr.exe 2312 5hhnth.exe 2524 ttnhbt.exe 2504 pddvj.exe 860 lxfxfrx.exe 2332 tbhbhb.exe 2472 jpjvp.exe 984 5rfflrl.exe 348 bhthbb.exe 1504 xxrxflx.exe 2776 bbtbtb.exe 2704 vvjpd.exe 2680 rfrlffl.exe 2844 tttnth.exe 2572 ppvjd.exe 2092 3dvdp.exe 2628 vjvjp.exe 764 ttthbh.exe 2476 jvjdd.exe 2616 vjpjd.exe 2224 fllfrff.exe 2820 thbttt.exe 2788 3ddvv.exe 2944 jppdd.exe 1472 rrrxlrf.exe 1272 tbnhhh.exe 2540 djjdd.exe 2480 djjdj.exe 2620 xffxxxr.exe 2360 frfrxfr.exe 1300 btbbht.exe 1552 pdpjj.exe 3020 lflfxxl.exe 612 hhntth.exe 2080 thbbhb.exe 1364 vvjjp.exe 2104 lxfffxr.exe 692 rlxlrfr.exe 1820 bbbtnt.exe 3024 vvdpj.exe 448 ddpdj.exe 1240 rlfrfrx.exe 2472 9frrxfr.exe 1712 nhthth.exe 348 jdpvd.exe -
resource yara_rule behavioral1/memory/2708-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2708 2772 01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe 30 PID 2772 wrote to memory of 2708 2772 01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe 30 PID 2772 wrote to memory of 2708 2772 01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe 30 PID 2772 wrote to memory of 2708 2772 01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2844 2708 ddpdv.exe 31 PID 2708 wrote to memory of 2844 2708 ddpdv.exe 31 PID 2708 wrote to memory of 2844 2708 ddpdv.exe 31 PID 2708 wrote to memory of 2844 2708 ddpdv.exe 31 PID 2844 wrote to memory of 1984 2844 pjvjp.exe 137 PID 2844 wrote to memory of 1984 2844 pjvjp.exe 137 PID 2844 wrote to memory of 1984 2844 pjvjp.exe 137 PID 2844 wrote to memory of 1984 2844 pjvjp.exe 137 PID 1984 wrote to memory of 2724 1984 9djdp.exe 33 PID 1984 wrote to memory of 2724 1984 9djdp.exe 33 PID 1984 wrote to memory of 2724 1984 9djdp.exe 33 PID 1984 wrote to memory of 2724 1984 9djdp.exe 33 PID 2724 wrote to memory of 2628 2724 vpjjj.exe 34 PID 2724 wrote to memory of 2628 2724 vpjjj.exe 34 PID 2724 wrote to memory of 2628 2724 vpjjj.exe 34 PID 2724 wrote to memory of 2628 2724 vpjjj.exe 34 PID 2628 wrote to memory of 1736 2628 frrffrr.exe 35 PID 2628 wrote to memory of 1736 2628 frrffrr.exe 35 PID 2628 wrote to memory of 1736 2628 frrffrr.exe 35 PID 2628 wrote to memory of 1736 2628 frrffrr.exe 35 PID 1736 wrote to memory of 2884 1736 bhthnb.exe 36 PID 1736 wrote to memory of 2884 1736 bhthnb.exe 36 PID 1736 wrote to memory of 2884 1736 bhthnb.exe 36 PID 1736 wrote to memory of 2884 1736 bhthnb.exe 36 PID 2884 wrote to memory of 2344 2884 pjvdv.exe 37 PID 2884 wrote to memory of 2344 2884 pjvdv.exe 37 PID 2884 wrote to memory of 2344 2884 pjvdv.exe 37 PID 2884 wrote to memory of 2344 2884 pjvdv.exe 37 PID 2344 wrote to memory of 2536 2344 lrxxxrr.exe 38 PID 2344 wrote to memory of 2536 2344 lrxxxrr.exe 38 PID 2344 wrote to memory of 2536 2344 lrxxxrr.exe 38 PID 2344 wrote to memory of 2536 2344 lrxxxrr.exe 38 PID 2536 wrote to memory of 2876 2536 ttbhtn.exe 39 PID 2536 wrote to memory of 2876 2536 ttbhtn.exe 39 PID 2536 wrote to memory of 2876 2536 ttbhtn.exe 39 PID 2536 wrote to memory of 2876 2536 ttbhtn.exe 39 PID 2876 wrote to memory of 2796 2876 jvppd.exe 40 PID 2876 wrote to memory of 2796 2876 jvppd.exe 40 PID 2876 wrote to memory of 2796 2876 jvppd.exe 40 PID 2876 wrote to memory of 2796 2876 jvppd.exe 40 PID 2796 wrote to memory of 2948 2796 ffllxfr.exe 41 PID 2796 wrote to memory of 2948 2796 ffllxfr.exe 41 PID 2796 wrote to memory of 2948 2796 ffllxfr.exe 41 PID 2796 wrote to memory of 2948 2796 ffllxfr.exe 41 PID 2948 wrote to memory of 3068 2948 bbtthh.exe 42 PID 2948 wrote to memory of 3068 2948 bbtthh.exe 42 PID 2948 wrote to memory of 3068 2948 bbtthh.exe 42 PID 2948 wrote to memory of 3068 2948 bbtthh.exe 42 PID 3068 wrote to memory of 2480 3068 djvdj.exe 43 PID 3068 wrote to memory of 2480 3068 djvdj.exe 43 PID 3068 wrote to memory of 2480 3068 djvdj.exe 43 PID 3068 wrote to memory of 2480 3068 djvdj.exe 43 PID 2480 wrote to memory of 340 2480 rrflffl.exe 154 PID 2480 wrote to memory of 340 2480 rrflffl.exe 154 PID 2480 wrote to memory of 340 2480 rrflffl.exe 154 PID 2480 wrote to memory of 340 2480 rrflffl.exe 154 PID 340 wrote to memory of 2428 340 7bhhnh.exe 45 PID 340 wrote to memory of 2428 340 7bhhnh.exe 45 PID 340 wrote to memory of 2428 340 7bhhnh.exe 45 PID 340 wrote to memory of 2428 340 7bhhnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01bf4cc33e71c7226563435e6059aeff_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ddpdv.exec:\ddpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pjvjp.exec:\pjvjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\9djdp.exec:\9djdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\vpjjj.exec:\vpjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\frrffrr.exec:\frrffrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\bhthnb.exec:\bhthnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\pjvdv.exec:\pjvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\lrxxxrr.exec:\lrxxxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\ttbhtn.exec:\ttbhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jvppd.exec:\jvppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ffllxfr.exec:\ffllxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bbtthh.exec:\bbtthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\djvdj.exec:\djvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rrflffl.exec:\rrflffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\7bhhnh.exec:\7bhhnh.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\pdjdv.exec:\pdjdv.exe17⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rxffllf.exec:\rxffllf.exe18⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bhnbth.exec:\bhnbth.exe19⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vppdj.exec:\vppdj.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lrrrlxr.exec:\lrrrlxr.exe21⤵
- Executes dropped EXE
PID:844 -
\??\c:\5hhnth.exec:\5hhnth.exe22⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ttnhbt.exec:\ttnhbt.exe23⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pddvj.exec:\pddvj.exe24⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lxfxfrx.exec:\lxfxfrx.exe25⤵
- Executes dropped EXE
PID:860 -
\??\c:\tbhbhb.exec:\tbhbhb.exe26⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jpjvp.exec:\jpjvp.exe27⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5rfflrl.exec:\5rfflrl.exe28⤵
- Executes dropped EXE
PID:984 -
\??\c:\bhthbb.exec:\bhthbb.exe29⤵
- Executes dropped EXE
PID:348 -
\??\c:\xxrxflx.exec:\xxrxflx.exe30⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bbtbtb.exec:\bbtbtb.exe31⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vvjpd.exec:\vvjpd.exe32⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rfrlffl.exec:\rfrlffl.exe33⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tttnth.exec:\tttnth.exe34⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ppvjd.exec:\ppvjd.exe35⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3dvdp.exec:\3dvdp.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vjvjp.exec:\vjvjp.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ttthbh.exec:\ttthbh.exe38⤵
- Executes dropped EXE
PID:764 -
\??\c:\jvjdd.exec:\jvjdd.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vjpjd.exec:\vjpjd.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fllfrff.exec:\fllfrff.exe41⤵
- Executes dropped EXE
PID:2224 -
\??\c:\thbttt.exec:\thbttt.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3ddvv.exec:\3ddvv.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jppdd.exec:\jppdd.exe44⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe45⤵
- Executes dropped EXE
PID:1472 -
\??\c:\tbnhhh.exec:\tbnhhh.exe46⤵
- Executes dropped EXE
PID:1272 -
\??\c:\djjdd.exec:\djjdd.exe47⤵
- Executes dropped EXE
PID:2540 -
\??\c:\djjdj.exec:\djjdj.exe48⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xffxxxr.exec:\xffxxxr.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\frfrxfr.exec:\frfrxfr.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\btbbht.exec:\btbbht.exe51⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pdpjj.exec:\pdpjj.exe52⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lflfxxl.exec:\lflfxxl.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhntth.exec:\hhntth.exe54⤵
- Executes dropped EXE
PID:612 -
\??\c:\thbbhb.exec:\thbbhb.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vvjjp.exec:\vvjjp.exe56⤵
- Executes dropped EXE
PID:1364 -
\??\c:\lxfffxr.exec:\lxfffxr.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlxlrfr.exec:\rlxlrfr.exe58⤵
- Executes dropped EXE
PID:692 -
\??\c:\bbbtnt.exec:\bbbtnt.exe59⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vvdpj.exec:\vvdpj.exe60⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ddpdj.exec:\ddpdj.exe61⤵
- Executes dropped EXE
PID:448 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe62⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9frrxfr.exec:\9frrxfr.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nhthth.exec:\nhthth.exe64⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jdpvd.exec:\jdpvd.exe65⤵
- Executes dropped EXE
PID:348 -
\??\c:\jddvv.exec:\jddvv.exe66⤵PID:832
-
\??\c:\rxlxxrx.exec:\rxlxxrx.exe67⤵PID:1504
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe68⤵PID:2976
-
\??\c:\hbhtht.exec:\hbhtht.exe69⤵PID:2704
-
\??\c:\ppddd.exec:\ppddd.exe70⤵PID:2748
-
\??\c:\jjpdp.exec:\jjpdp.exe71⤵PID:2436
-
\??\c:\fxflrrf.exec:\fxflrrf.exe72⤵PID:2516
-
\??\c:\fllllxr.exec:\fllllxr.exe73⤵PID:1764
-
\??\c:\btntbn.exec:\btntbn.exe74⤵PID:2672
-
\??\c:\hnbhtt.exec:\hnbhtt.exe75⤵PID:2092
-
\??\c:\dpdjv.exec:\dpdjv.exe76⤵PID:828
-
\??\c:\pdvvv.exec:\pdvvv.exe77⤵PID:1728
-
\??\c:\fffrxll.exec:\fffrxll.exe78⤵PID:2588
-
\??\c:\tnnbhh.exec:\tnnbhh.exe79⤵PID:868
-
\??\c:\tbbhht.exec:\tbbhht.exe80⤵PID:2532
-
\??\c:\1vpvp.exec:\1vpvp.exe81⤵PID:1544
-
\??\c:\rxxrlxl.exec:\rxxrlxl.exe82⤵
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\lfxxlrl.exec:\lfxxlrl.exe83⤵PID:1096
-
\??\c:\thbnth.exec:\thbnth.exe84⤵PID:2356
-
\??\c:\vvdpj.exec:\vvdpj.exe85⤵PID:3036
-
\??\c:\jjdvd.exec:\jjdvd.exe86⤵PID:1492
-
\??\c:\ffflffr.exec:\ffflffr.exe87⤵PID:2868
-
\??\c:\3lrrxfl.exec:\3lrrxfl.exe88⤵PID:2180
-
\??\c:\bnhhtb.exec:\bnhhtb.exe89⤵PID:2420
-
\??\c:\5pddp.exec:\5pddp.exe90⤵PID:2912
-
\??\c:\1xlrflx.exec:\1xlrflx.exe91⤵PID:3028
-
\??\c:\xfrrrxr.exec:\xfrrrxr.exe92⤵PID:2056
-
\??\c:\1nbntt.exec:\1nbntt.exe93⤵PID:2016
-
\??\c:\tthtbh.exec:\tthtbh.exe94⤵PID:536
-
\??\c:\ppjpj.exec:\ppjpj.exe95⤵PID:1056
-
\??\c:\5ffxlrl.exec:\5ffxlrl.exe96⤵PID:2376
-
\??\c:\xrlxflx.exec:\xrlxflx.exe97⤵PID:928
-
\??\c:\9hthtb.exec:\9hthtb.exe98⤵PID:2972
-
\??\c:\bbhnnb.exec:\bbhnnb.exe99⤵PID:1536
-
\??\c:\jjdjv.exec:\jjdjv.exe100⤵PID:1488
-
\??\c:\dvppd.exec:\dvppd.exe101⤵PID:2984
-
\??\c:\flrfrrl.exec:\flrfrrl.exe102⤵PID:1656
-
\??\c:\nthbbn.exec:\nthbbn.exe103⤵PID:872
-
\??\c:\hnhbbt.exec:\hnhbbt.exe104⤵PID:408
-
\??\c:\vpddd.exec:\vpddd.exe105⤵PID:2836
-
\??\c:\pvpdv.exec:\pvpdv.exe106⤵PID:2212
-
\??\c:\rxxxffl.exec:\rxxxffl.exe107⤵PID:2200
-
\??\c:\hhhtnb.exec:\hhhtnb.exe108⤵PID:1296
-
\??\c:\nhbtbn.exec:\nhbtbn.exe109⤵PID:1984
-
\??\c:\ddvjv.exec:\ddvjv.exe110⤵PID:1800
-
\??\c:\djddj.exec:\djddj.exe111⤵PID:2228
-
\??\c:\xfxllrx.exec:\xfxllrx.exe112⤵PID:2444
-
\??\c:\llllxrr.exec:\llllxrr.exe113⤵PID:344
-
\??\c:\hnnbbt.exec:\hnnbbt.exe114⤵PID:1716
-
\??\c:\dvvjp.exec:\dvvjp.exe115⤵PID:2668
-
\??\c:\djppp.exec:\djppp.exe116⤵PID:1904
-
\??\c:\lxfxxlr.exec:\lxfxxlr.exe117⤵PID:3004
-
\??\c:\1flflxf.exec:\1flflxf.exe118⤵PID:1144
-
\??\c:\hnbthb.exec:\hnbthb.exe119⤵PID:2900
-
\??\c:\bhtbth.exec:\bhtbth.exe120⤵PID:1860
-
\??\c:\jvvjd.exec:\jvvjd.exe121⤵PID:2788
-
\??\c:\1xfrfrl.exec:\1xfrfrl.exe122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-