Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe
-
Size
71KB
-
MD5
0057f5981340c395f2aadb5470fdd417
-
SHA1
938b64cd08a98e85e84c7833ec6b6f42df24eeca
-
SHA256
52fdb89aff0058aea86edb849145f59dfd1ad6cd418f92fa6288cef8e95b1583
-
SHA512
0da1626910f368be776b26dd4bb5598b865a5a600970f58d963164c26485c8471880438183aaebf817081ea15de2df41498cce0daa75be3855a529136e988baf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIuyldHinxpifW6WLT65W:ymb3NkkiQ3mdBjFIuyldH+keL+W
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/2468-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3560 xlflrff.exe 1324 vvvvp.exe 4276 lffxrrr.exe 4192 bbtnhb.exe 3488 hhttbb.exe 2984 lrrfrlx.exe 4628 08606.exe 1884 ffxxxxr.exe 3648 5ppjv.exe 3112 nbbtnn.exe 4532 8848822.exe 3276 6484826.exe 5068 428800.exe 1620 402226.exe 2016 jjvvd.exe 1244 ppvpj.exe 544 fffffll.exe 4536 i220066.exe 2960 vppvv.exe 2408 frrrrxx.exe 1240 248868.exe 4876 46220.exe 3688 c260444.exe 4436 402460.exe 3712 ddddv.exe 2132 vvjjd.exe 1612 lxflrxf.exe 2804 44806.exe 4524 xxxxlfx.exe 5036 4242222.exe 2300 288688.exe 4588 u444608.exe 3532 w68660.exe 4596 8848280.exe 3840 0424002.exe 2476 684822.exe 1744 2080008.exe 3960 6848260.exe 3672 flrrrrr.exe 4344 btttnn.exe 3040 4466000.exe 644 8222844.exe 4844 o022266.exe 384 g8048.exe 2888 860806.exe 2420 xrrxlfx.exe 2816 82444.exe 844 i660800.exe 2264 rxfxrrl.exe 4656 44662.exe 3452 080044.exe 2052 pvvjd.exe 4884 tnbntn.exe 3112 jjjvp.exe 1972 htnnbn.exe 3708 62442.exe 1136 lrrfxxx.exe 408 7pppj.exe 4904 thbbhh.exe 1620 40260.exe 4136 068826.exe 3944 442484.exe 5008 042666.exe 2036 86480.exe -
resource yara_rule behavioral2/memory/2468-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-177-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 886006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c844262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 606444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2846044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u202802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 626406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k84488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 3560 2468 0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe 84 PID 2468 wrote to memory of 3560 2468 0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe 84 PID 2468 wrote to memory of 3560 2468 0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe 84 PID 3560 wrote to memory of 1324 3560 xlflrff.exe 85 PID 3560 wrote to memory of 1324 3560 xlflrff.exe 85 PID 3560 wrote to memory of 1324 3560 xlflrff.exe 85 PID 1324 wrote to memory of 4276 1324 vvvvp.exe 86 PID 1324 wrote to memory of 4276 1324 vvvvp.exe 86 PID 1324 wrote to memory of 4276 1324 vvvvp.exe 86 PID 4276 wrote to memory of 4192 4276 lffxrrr.exe 87 PID 4276 wrote to memory of 4192 4276 lffxrrr.exe 87 PID 4276 wrote to memory of 4192 4276 lffxrrr.exe 87 PID 4192 wrote to memory of 3488 4192 bbtnhb.exe 88 PID 4192 wrote to memory of 3488 4192 bbtnhb.exe 88 PID 4192 wrote to memory of 3488 4192 bbtnhb.exe 88 PID 3488 wrote to memory of 2984 3488 hhttbb.exe 89 PID 3488 wrote to memory of 2984 3488 hhttbb.exe 89 PID 3488 wrote to memory of 2984 3488 hhttbb.exe 89 PID 2984 wrote to memory of 4628 2984 lrrfrlx.exe 90 PID 2984 wrote to memory of 4628 2984 lrrfrlx.exe 90 PID 2984 wrote to memory of 4628 2984 lrrfrlx.exe 90 PID 4628 wrote to memory of 1884 4628 08606.exe 91 PID 4628 wrote to memory of 1884 4628 08606.exe 91 PID 4628 wrote to memory of 1884 4628 08606.exe 91 PID 1884 wrote to memory of 3648 1884 ffxxxxr.exe 93 PID 1884 wrote to memory of 3648 1884 ffxxxxr.exe 93 PID 1884 wrote to memory of 3648 1884 ffxxxxr.exe 93 PID 3648 wrote to memory of 3112 3648 5ppjv.exe 94 PID 3648 wrote to memory of 3112 3648 5ppjv.exe 94 PID 3648 wrote to memory of 3112 3648 5ppjv.exe 94 PID 3112 wrote to memory of 4532 3112 nbbtnn.exe 95 PID 3112 wrote to memory of 4532 3112 nbbtnn.exe 95 PID 3112 wrote to memory of 4532 3112 nbbtnn.exe 95 PID 4532 wrote to memory of 3276 4532 8848822.exe 96 PID 4532 wrote to memory of 3276 4532 8848822.exe 96 PID 4532 wrote to memory of 3276 4532 8848822.exe 96 PID 3276 wrote to memory of 5068 3276 6484826.exe 97 PID 3276 wrote to memory of 5068 3276 6484826.exe 97 PID 3276 wrote to memory of 5068 3276 6484826.exe 97 PID 5068 wrote to memory of 1620 5068 428800.exe 98 PID 5068 wrote to memory of 1620 5068 428800.exe 98 PID 5068 wrote to memory of 1620 5068 428800.exe 98 PID 1620 wrote to memory of 2016 1620 402226.exe 99 PID 1620 wrote to memory of 2016 1620 402226.exe 99 PID 1620 wrote to memory of 2016 1620 402226.exe 99 PID 2016 wrote to memory of 1244 2016 jjvvd.exe 100 PID 2016 wrote to memory of 1244 2016 jjvvd.exe 100 PID 2016 wrote to memory of 1244 2016 jjvvd.exe 100 PID 1244 wrote to memory of 544 1244 ppvpj.exe 101 PID 1244 wrote to memory of 544 1244 ppvpj.exe 101 PID 1244 wrote to memory of 544 1244 ppvpj.exe 101 PID 544 wrote to memory of 4536 544 fffffll.exe 102 PID 544 wrote to memory of 4536 544 fffffll.exe 102 PID 544 wrote to memory of 4536 544 fffffll.exe 102 PID 4536 wrote to memory of 2960 4536 i220066.exe 103 PID 4536 wrote to memory of 2960 4536 i220066.exe 103 PID 4536 wrote to memory of 2960 4536 i220066.exe 103 PID 2960 wrote to memory of 2408 2960 vppvv.exe 104 PID 2960 wrote to memory of 2408 2960 vppvv.exe 104 PID 2960 wrote to memory of 2408 2960 vppvv.exe 104 PID 2408 wrote to memory of 1240 2408 frrrrxx.exe 105 PID 2408 wrote to memory of 1240 2408 frrrrxx.exe 105 PID 2408 wrote to memory of 1240 2408 frrrrxx.exe 105 PID 1240 wrote to memory of 4876 1240 248868.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\xlflrff.exec:\xlflrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\vvvvp.exec:\vvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\lffxrrr.exec:\lffxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\bbtnhb.exec:\bbtnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\hhttbb.exec:\hhttbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\08606.exec:\08606.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\5ppjv.exec:\5ppjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\nbbtnn.exec:\nbbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\8848822.exec:\8848822.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\6484826.exec:\6484826.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\428800.exec:\428800.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\402226.exec:\402226.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jjvvd.exec:\jjvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\ppvpj.exec:\ppvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\fffffll.exec:\fffffll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\i220066.exec:\i220066.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\vppvv.exec:\vppvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\frrrrxx.exec:\frrrrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\248868.exec:\248868.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\46220.exec:\46220.exe23⤵
- Executes dropped EXE
PID:4876 -
\??\c:\c260444.exec:\c260444.exe24⤵
- Executes dropped EXE
PID:3688 -
\??\c:\402460.exec:\402460.exe25⤵
- Executes dropped EXE
PID:4436 -
\??\c:\ddddv.exec:\ddddv.exe26⤵
- Executes dropped EXE
PID:3712 -
\??\c:\vvjjd.exec:\vvjjd.exe27⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lxflrxf.exec:\lxflrxf.exe28⤵
- Executes dropped EXE
PID:1612 -
\??\c:\44806.exec:\44806.exe29⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xxxxlfx.exec:\xxxxlfx.exe30⤵
- Executes dropped EXE
PID:4524 -
\??\c:\4242222.exec:\4242222.exe31⤵
- Executes dropped EXE
PID:5036 -
\??\c:\288688.exec:\288688.exe32⤵
- Executes dropped EXE
PID:2300 -
\??\c:\u444608.exec:\u444608.exe33⤵
- Executes dropped EXE
PID:4588 -
\??\c:\w68660.exec:\w68660.exe34⤵
- Executes dropped EXE
PID:3532 -
\??\c:\8848280.exec:\8848280.exe35⤵
- Executes dropped EXE
PID:4596 -
\??\c:\0424002.exec:\0424002.exe36⤵
- Executes dropped EXE
PID:3840 -
\??\c:\684822.exec:\684822.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\2080008.exec:\2080008.exe38⤵
- Executes dropped EXE
PID:1744 -
\??\c:\6848260.exec:\6848260.exe39⤵
- Executes dropped EXE
PID:3960 -
\??\c:\flrrrrr.exec:\flrrrrr.exe40⤵
- Executes dropped EXE
PID:3672 -
\??\c:\btttnn.exec:\btttnn.exe41⤵
- Executes dropped EXE
PID:4344 -
\??\c:\4466000.exec:\4466000.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\8222844.exec:\8222844.exe43⤵
- Executes dropped EXE
PID:644 -
\??\c:\o022266.exec:\o022266.exe44⤵
- Executes dropped EXE
PID:4844 -
\??\c:\g8048.exec:\g8048.exe45⤵
- Executes dropped EXE
PID:384 -
\??\c:\860806.exec:\860806.exe46⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrrxlfx.exec:\xrrxlfx.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\82444.exec:\82444.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\i660800.exec:\i660800.exe49⤵
- Executes dropped EXE
PID:844 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe50⤵
- Executes dropped EXE
PID:2264 -
\??\c:\44662.exec:\44662.exe51⤵
- Executes dropped EXE
PID:4656 -
\??\c:\080044.exec:\080044.exe52⤵
- Executes dropped EXE
PID:3452 -
\??\c:\pvvjd.exec:\pvvjd.exe53⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tnbntn.exec:\tnbntn.exe54⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jjjvp.exec:\jjjvp.exe55⤵
- Executes dropped EXE
PID:3112 -
\??\c:\htnnbn.exec:\htnnbn.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\62442.exec:\62442.exe57⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lrrfxxx.exec:\lrrfxxx.exe58⤵
- Executes dropped EXE
PID:1136 -
\??\c:\7pppj.exec:\7pppj.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\thbbhh.exec:\thbbhh.exe60⤵
- Executes dropped EXE
PID:4904 -
\??\c:\40260.exec:\40260.exe61⤵
- Executes dropped EXE
PID:1620 -
\??\c:\068826.exec:\068826.exe62⤵
- Executes dropped EXE
PID:4136 -
\??\c:\442484.exec:\442484.exe63⤵
- Executes dropped EXE
PID:3944 -
\??\c:\042666.exec:\042666.exe64⤵
- Executes dropped EXE
PID:5008 -
\??\c:\86480.exec:\86480.exe65⤵
- Executes dropped EXE
PID:2036 -
\??\c:\0204204.exec:\0204204.exe66⤵PID:4184
-
\??\c:\w44482.exec:\w44482.exe67⤵PID:1548
-
\??\c:\a0848.exec:\a0848.exe68⤵PID:3964
-
\??\c:\lllxxrx.exec:\lllxxrx.exe69⤵PID:2900
-
\??\c:\u222266.exec:\u222266.exe70⤵PID:4072
-
\??\c:\nntnnn.exec:\nntnnn.exe71⤵PID:1552
-
\??\c:\04044.exec:\04044.exe72⤵PID:3120
-
\??\c:\5hhbtt.exec:\5hhbtt.exe73⤵PID:4388
-
\??\c:\0802480.exec:\0802480.exe74⤵PID:4560
-
\??\c:\646660.exec:\646660.exe75⤵PID:2132
-
\??\c:\6620000.exec:\6620000.exe76⤵PID:2492
-
\??\c:\i244040.exec:\i244040.exe77⤵PID:2804
-
\??\c:\40666.exec:\40666.exe78⤵PID:4452
-
\??\c:\0822686.exec:\0822686.exe79⤵PID:3552
-
\??\c:\0000448.exec:\0000448.exe80⤵PID:2400
-
\??\c:\vdpjd.exec:\vdpjd.exe81⤵PID:3472
-
\??\c:\q42628.exec:\q42628.exe82⤵PID:3532
-
\??\c:\7ddpj.exec:\7ddpj.exe83⤵PID:1964
-
\??\c:\4044666.exec:\4044666.exe84⤵PID:4520
-
\??\c:\60886.exec:\60886.exe85⤵PID:1744
-
\??\c:\rflfflf.exec:\rflfflf.exe86⤵PID:3960
-
\??\c:\bttnnn.exec:\bttnnn.exe87⤵PID:2220
-
\??\c:\9djdd.exec:\9djdd.exe88⤵PID:2468
-
\??\c:\9nbthb.exec:\9nbthb.exe89⤵PID:4492
-
\??\c:\ddddd.exec:\ddddd.exe90⤵PID:2924
-
\??\c:\rxrxfxf.exec:\rxrxfxf.exe91⤵PID:4760
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe92⤵PID:3084
-
\??\c:\jvddv.exec:\jvddv.exe93⤵PID:2396
-
\??\c:\646844.exec:\646844.exe94⤵PID:2660
-
\??\c:\6004822.exec:\6004822.exe95⤵PID:1368
-
\??\c:\8282444.exec:\8282444.exe96⤵PID:3088
-
\??\c:\jvdpv.exec:\jvdpv.exe97⤵PID:100
-
\??\c:\9pvdd.exec:\9pvdd.exe98⤵PID:3852
-
\??\c:\6226044.exec:\6226044.exe99⤵PID:744
-
\??\c:\42804.exec:\42804.exe100⤵PID:3452
-
\??\c:\4840482.exec:\4840482.exe101⤵PID:2052
-
\??\c:\vjdjv.exec:\vjdjv.exe102⤵PID:4884
-
\??\c:\3vvpv.exec:\3vvpv.exe103⤵PID:4140
-
\??\c:\bhbbbt.exec:\bhbbbt.exe104⤵PID:4428
-
\??\c:\8864468.exec:\8864468.exe105⤵PID:4976
-
\??\c:\882628.exec:\882628.exe106⤵PID:740
-
\??\c:\lxxffxx.exec:\lxxffxx.exe107⤵PID:2056
-
\??\c:\886000.exec:\886000.exe108⤵PID:4900
-
\??\c:\06444.exec:\06444.exe109⤵PID:1244
-
\??\c:\ntnbth.exec:\ntnbth.exe110⤵PID:1104
-
\??\c:\xlfrrlf.exec:\xlfrrlf.exe111⤵PID:5008
-
\??\c:\886468.exec:\886468.exe112⤵PID:2036
-
\??\c:\484046.exec:\484046.exe113⤵PID:4988
-
\??\c:\nhbbbb.exec:\nhbbbb.exe114⤵PID:1668
-
\??\c:\ppdjv.exec:\ppdjv.exe115⤵PID:3784
-
\??\c:\c844262.exec:\c844262.exe116⤵
- System Location Discovery: System Language Discovery
PID:4232 -
\??\c:\tbhhtt.exec:\tbhhtt.exe117⤵PID:4728
-
\??\c:\7vvpd.exec:\7vvpd.exe118⤵PID:736
-
\??\c:\jvvpj.exec:\jvvpj.exe119⤵PID:4380
-
\??\c:\dddpd.exec:\dddpd.exe120⤵PID:3036
-
\??\c:\k06004.exec:\k06004.exe121⤵PID:1868
-
\??\c:\6464266.exec:\6464266.exe122⤵PID:2012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-