Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
055b570b5c7c648baf774447328297e1_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
055b570b5c7c648baf774447328297e1_JaffaCakes118.exe
-
Size
95KB
-
MD5
055b570b5c7c648baf774447328297e1
-
SHA1
c49a53c4b7a031248219b8640ffd3fc88ff9f8d5
-
SHA256
0b3cba31373ae4c648184dd7433c5b24a91b966a1076a227d32e6a1a417fea2c
-
SHA512
df0bc2317114ee4772375e7a0ab99110868b44b191adb6bdd9fdfbbbd2e33aebf9ddabca83081989f73ecdd066c32b4ed2082c731e7d38316ea3a28f6c992092
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzNmNMvVjoq:ymb3NkkiQ3mdBjF+3TYzvTt8q
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/1712-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 djvdv.exe 1956 pdjpd.exe 2680 bnthnt.exe 2868 nbthnt.exe 2884 jjdvd.exe 2312 7lflxfx.exe 2272 bthtbh.exe 2592 djjjj.exe 1740 rxllrxl.exe 2812 ttnbnn.exe 2156 dvjjp.exe 2476 rxrlfrf.exe 2432 hnbnnn.exe 2964 jvdpp.exe 2816 7xxrxrf.exe 2976 bbbbhb.exe 2236 tthnht.exe 1748 pvvvv.exe 2296 xflxfrx.exe 2668 hnhbht.exe 1984 nnnttt.exe 2200 xlrrlrf.exe 1096 httthh.exe 1036 tbnttt.exe 980 vpjdj.exe 2260 rrxrxfr.exe 584 tnhhbn.exe 1556 ppjvv.exe 1572 rxffffl.exe 832 xlxrfll.exe 2036 lrrlxrr.exe 2124 jdvjv.exe 2120 jvvpv.exe 2788 lrrlxfr.exe 2780 btnthb.exe 2444 nttnbt.exe 2736 vpdjv.exe 2956 rflfxxr.exe 2740 bbtbhn.exe 2584 htnbhn.exe 2648 dvpvv.exe 2592 9dpvd.exe 2928 flrllxf.exe 1868 bthnbb.exe 816 pvjjj.exe 2280 vpjvv.exe 760 3xfxrrl.exe 1912 9hthnb.exe 2660 hbnnnb.exe 2908 dpdjv.exe 576 xllrxxl.exe 1784 9hhhnn.exe 2236 3vvdj.exe 2104 djjjv.exe 796 lfrrffr.exe 1500 tnhthn.exe 1744 hbnnht.exe 3036 djvvj.exe 2128 xffxlrx.exe 1248 5rxrrlr.exe 2460 nntbhn.exe 2540 jdvvp.exe 992 jvdpd.exe 2260 xrxxllx.exe -
resource yara_rule behavioral1/memory/1712-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2316 1712 055b570b5c7c648baf774447328297e1_JaffaCakes118.exe 29 PID 1712 wrote to memory of 2316 1712 055b570b5c7c648baf774447328297e1_JaffaCakes118.exe 29 PID 1712 wrote to memory of 2316 1712 055b570b5c7c648baf774447328297e1_JaffaCakes118.exe 29 PID 1712 wrote to memory of 2316 1712 055b570b5c7c648baf774447328297e1_JaffaCakes118.exe 29 PID 2316 wrote to memory of 1956 2316 djvdv.exe 30 PID 2316 wrote to memory of 1956 2316 djvdv.exe 30 PID 2316 wrote to memory of 1956 2316 djvdv.exe 30 PID 2316 wrote to memory of 1956 2316 djvdv.exe 30 PID 1956 wrote to memory of 2680 1956 pdjpd.exe 31 PID 1956 wrote to memory of 2680 1956 pdjpd.exe 31 PID 1956 wrote to memory of 2680 1956 pdjpd.exe 31 PID 1956 wrote to memory of 2680 1956 pdjpd.exe 31 PID 2680 wrote to memory of 2868 2680 bnthnt.exe 32 PID 2680 wrote to memory of 2868 2680 bnthnt.exe 32 PID 2680 wrote to memory of 2868 2680 bnthnt.exe 32 PID 2680 wrote to memory of 2868 2680 bnthnt.exe 32 PID 2868 wrote to memory of 2884 2868 nbthnt.exe 33 PID 2868 wrote to memory of 2884 2868 nbthnt.exe 33 PID 2868 wrote to memory of 2884 2868 nbthnt.exe 33 PID 2868 wrote to memory of 2884 2868 nbthnt.exe 33 PID 2884 wrote to memory of 2312 2884 jjdvd.exe 34 PID 2884 wrote to memory of 2312 2884 jjdvd.exe 34 PID 2884 wrote to memory of 2312 2884 jjdvd.exe 34 PID 2884 wrote to memory of 2312 2884 jjdvd.exe 34 PID 2312 wrote to memory of 2272 2312 7lflxfx.exe 35 PID 2312 wrote to memory of 2272 2312 7lflxfx.exe 35 PID 2312 wrote to memory of 2272 2312 7lflxfx.exe 35 PID 2312 wrote to memory of 2272 2312 7lflxfx.exe 35 PID 2272 wrote to memory of 2592 2272 bthtbh.exe 36 PID 2272 wrote to memory of 2592 2272 bthtbh.exe 36 PID 2272 wrote to memory of 2592 2272 bthtbh.exe 36 PID 2272 wrote to memory of 2592 2272 bthtbh.exe 36 PID 2592 wrote to memory of 1740 2592 djjjj.exe 37 PID 2592 wrote to memory of 1740 2592 djjjj.exe 37 PID 2592 wrote to memory of 1740 2592 djjjj.exe 37 PID 2592 wrote to memory of 1740 2592 djjjj.exe 37 PID 1740 wrote to memory of 2812 1740 rxllrxl.exe 38 PID 1740 wrote to memory of 2812 1740 rxllrxl.exe 38 PID 1740 wrote to memory of 2812 1740 rxllrxl.exe 38 PID 1740 wrote to memory of 2812 1740 rxllrxl.exe 38 PID 2812 wrote to memory of 2156 2812 ttnbnn.exe 39 PID 2812 wrote to memory of 2156 2812 ttnbnn.exe 39 PID 2812 wrote to memory of 2156 2812 ttnbnn.exe 39 PID 2812 wrote to memory of 2156 2812 ttnbnn.exe 39 PID 2156 wrote to memory of 2476 2156 dvjjp.exe 40 PID 2156 wrote to memory of 2476 2156 dvjjp.exe 40 PID 2156 wrote to memory of 2476 2156 dvjjp.exe 40 PID 2156 wrote to memory of 2476 2156 dvjjp.exe 40 PID 2476 wrote to memory of 2432 2476 rxrlfrf.exe 41 PID 2476 wrote to memory of 2432 2476 rxrlfrf.exe 41 PID 2476 wrote to memory of 2432 2476 rxrlfrf.exe 41 PID 2476 wrote to memory of 2432 2476 rxrlfrf.exe 41 PID 2432 wrote to memory of 2964 2432 hnbnnn.exe 42 PID 2432 wrote to memory of 2964 2432 hnbnnn.exe 42 PID 2432 wrote to memory of 2964 2432 hnbnnn.exe 42 PID 2432 wrote to memory of 2964 2432 hnbnnn.exe 42 PID 2964 wrote to memory of 2816 2964 jvdpp.exe 43 PID 2964 wrote to memory of 2816 2964 jvdpp.exe 43 PID 2964 wrote to memory of 2816 2964 jvdpp.exe 43 PID 2964 wrote to memory of 2816 2964 jvdpp.exe 43 PID 2816 wrote to memory of 2976 2816 7xxrxrf.exe 44 PID 2816 wrote to memory of 2976 2816 7xxrxrf.exe 44 PID 2816 wrote to memory of 2976 2816 7xxrxrf.exe 44 PID 2816 wrote to memory of 2976 2816 7xxrxrf.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\055b570b5c7c648baf774447328297e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\055b570b5c7c648baf774447328297e1_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\djvdv.exec:\djvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\pdjpd.exec:\pdjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\bnthnt.exec:\bnthnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nbthnt.exec:\nbthnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\jjdvd.exec:\jjdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7lflxfx.exec:\7lflxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bthtbh.exec:\bthtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\djjjj.exec:\djjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rxllrxl.exec:\rxllrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\ttnbnn.exec:\ttnbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dvjjp.exec:\dvjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\rxrlfrf.exec:\rxrlfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\hnbnnn.exec:\hnbnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\jvdpp.exec:\jvdpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7xxrxrf.exec:\7xxrxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bbbbhb.exec:\bbbbhb.exe17⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tthnht.exec:\tthnht.exe18⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pvvvv.exec:\pvvvv.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xflxfrx.exec:\xflxfrx.exe20⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hnhbht.exec:\hnhbht.exe21⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nnnttt.exec:\nnnttt.exe22⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xlrrlrf.exec:\xlrrlrf.exe23⤵
- Executes dropped EXE
PID:2200 -
\??\c:\httthh.exec:\httthh.exe24⤵
- Executes dropped EXE
PID:1096 -
\??\c:\tbnttt.exec:\tbnttt.exe25⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vpjdj.exec:\vpjdj.exe26⤵
- Executes dropped EXE
PID:980 -
\??\c:\rrxrxfr.exec:\rrxrxfr.exe27⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tnhhbn.exec:\tnhhbn.exe28⤵
- Executes dropped EXE
PID:584 -
\??\c:\ppjvv.exec:\ppjvv.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rxffffl.exec:\rxffffl.exe30⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xlxrfll.exec:\xlxrfll.exe31⤵
- Executes dropped EXE
PID:832 -
\??\c:\lrrlxrr.exec:\lrrlxrr.exe32⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdvjv.exec:\jdvjv.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jvvpv.exec:\jvvpv.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\lrrlxfr.exec:\lrrlxfr.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\btnthb.exec:\btnthb.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nttnbt.exec:\nttnbt.exe37⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vpdjv.exec:\vpdjv.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rflfxxr.exec:\rflfxxr.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bbtbhn.exec:\bbtbhn.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\htnbhn.exec:\htnbhn.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvpvv.exec:\dvpvv.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9dpvd.exec:\9dpvd.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\flrllxf.exec:\flrllxf.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bthnbb.exec:\bthnbb.exe45⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pvjjj.exec:\pvjjj.exe46⤵
- Executes dropped EXE
PID:816 -
\??\c:\vpjvv.exec:\vpjvv.exe47⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3xfxrrl.exec:\3xfxrrl.exe48⤵
- Executes dropped EXE
PID:760 -
\??\c:\9hthnb.exec:\9hthnb.exe49⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hbnnnb.exec:\hbnnnb.exe50⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dpdjv.exec:\dpdjv.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xllrxxl.exec:\xllrxxl.exe52⤵
- Executes dropped EXE
PID:576 -
\??\c:\9hhhnn.exec:\9hhhnn.exe53⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3vvdj.exec:\3vvdj.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\djjjv.exec:\djjjv.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lfrrffr.exec:\lfrrffr.exe56⤵
- Executes dropped EXE
PID:796 -
\??\c:\tnhthn.exec:\tnhthn.exe57⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hbnnht.exec:\hbnnht.exe58⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djvvj.exec:\djvvj.exe59⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xffxlrx.exec:\xffxlrx.exe60⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5rxrrlr.exec:\5rxrrlr.exe61⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nntbhn.exec:\nntbhn.exe62⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jdvvp.exec:\jdvvp.exe63⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jvdpd.exec:\jvdpd.exe64⤵
- Executes dropped EXE
PID:992 -
\??\c:\xrxxllx.exec:\xrxxllx.exe65⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3xfxxxf.exec:\3xfxxxf.exe66⤵PID:2148
-
\??\c:\nhttbh.exec:\nhttbh.exe67⤵PID:1240
-
\??\c:\httthh.exec:\httthh.exe68⤵PID:1908
-
\??\c:\9dvdp.exec:\9dvdp.exe69⤵PID:1920
-
\??\c:\ddjvj.exec:\ddjvj.exe70⤵PID:2316
-
\??\c:\llxlrrl.exec:\llxlrrl.exe71⤵PID:1508
-
\??\c:\llxrrxr.exec:\llxrrxr.exe72⤵PID:2520
-
\??\c:\bbbhnb.exec:\bbbhnb.exe73⤵PID:2664
-
\??\c:\tttbbb.exec:\tttbbb.exe74⤵PID:1284
-
\??\c:\5pjvd.exec:\5pjvd.exe75⤵PID:660
-
\??\c:\1ddpj.exec:\1ddpj.exe76⤵PID:2864
-
\??\c:\llffxxx.exec:\llffxxx.exe77⤵PID:2876
-
\??\c:\rrxfrfr.exec:\rrxfrfr.exe78⤵PID:2748
-
\??\c:\bhhnhn.exec:\bhhnhn.exe79⤵PID:2840
-
\??\c:\hhnhtb.exec:\hhnhtb.exe80⤵PID:2624
-
\??\c:\vdjvp.exec:\vdjvp.exe81⤵PID:2568
-
\??\c:\frfrxrf.exec:\frfrxrf.exe82⤵PID:2256
-
\??\c:\3rrxlll.exec:\3rrxlll.exe83⤵PID:2592
-
\??\c:\nttntt.exec:\nttntt.exe84⤵PID:2804
-
\??\c:\7hnnnn.exec:\7hnnnn.exe85⤵PID:2088
-
\??\c:\dpdvj.exec:\dpdvj.exe86⤵PID:2100
-
\??\c:\xlfrllr.exec:\xlfrllr.exe87⤵PID:2972
-
\??\c:\xfrrfxr.exec:\xfrrfxr.exe88⤵PID:2560
-
\??\c:\tbhhnn.exec:\tbhhnn.exe89⤵PID:2916
-
\??\c:\tthhhn.exec:\tthhhn.exe90⤵PID:2108
-
\??\c:\vdppv.exec:\vdppv.exe91⤵PID:1460
-
\??\c:\vvpjj.exec:\vvpjj.exe92⤵PID:2672
-
\??\c:\rxfxffl.exec:\rxfxffl.exe93⤵PID:748
-
\??\c:\nnbbnn.exec:\nnbbnn.exe94⤵PID:3028
-
\??\c:\ppjvj.exec:\ppjvj.exe95⤵PID:1232
-
\??\c:\pdpvj.exec:\pdpvj.exe96⤵PID:2344
-
\??\c:\1fxxxlx.exec:\1fxxxlx.exe97⤵PID:2228
-
\??\c:\7tnnnh.exec:\7tnnnh.exe98⤵PID:2372
-
\??\c:\vvddd.exec:\vvddd.exe99⤵PID:2200
-
\??\c:\lxffrrf.exec:\lxffrrf.exe100⤵PID:1096
-
\??\c:\1flffrl.exec:\1flffrl.exe101⤵PID:1140
-
\??\c:\httbnt.exec:\httbnt.exe102⤵PID:2152
-
\??\c:\ddvpj.exec:\ddvpj.exe103⤵PID:2248
-
\??\c:\lxfxffr.exec:\lxfxffr.exe104⤵PID:984
-
\??\c:\lrlrfrl.exec:\lrlrfrl.exe105⤵PID:1440
-
\??\c:\bhthtb.exec:\bhthtb.exe106⤵PID:3016
-
\??\c:\vvppd.exec:\vvppd.exe107⤵PID:1240
-
\??\c:\fxrfrfr.exec:\fxrfrfr.exe108⤵PID:1988
-
\??\c:\5xxxlrl.exec:\5xxxlrl.exe109⤵PID:2316
-
\??\c:\1nnhbh.exec:\1nnhbh.exe110⤵PID:2036
-
\??\c:\bbttnn.exec:\bbttnn.exe111⤵PID:1956
-
\??\c:\vvjvj.exec:\vvjvj.exe112⤵PID:2776
-
\??\c:\rlfflrl.exec:\rlfflrl.exe113⤵PID:2856
-
\??\c:\ntbttn.exec:\ntbttn.exe114⤵PID:2196
-
\??\c:\9dpvp.exec:\9dpvp.exe115⤵PID:2444
-
\??\c:\rflfrrr.exec:\rflfrrr.exe116⤵PID:2596
-
\??\c:\xfrrflf.exec:\xfrrflf.exe117⤵PID:2628
-
\??\c:\bnbbhh.exec:\bnbbhh.exe118⤵PID:2572
-
\??\c:\1pjvv.exec:\1pjvv.exe119⤵PID:928
-
\??\c:\xrllxxr.exec:\xrllxxr.exe120⤵PID:2172
-
\??\c:\3lxrxrf.exec:\3lxrxrf.exe121⤵PID:2428
-
\??\c:\hnnnnb.exec:\hnnnnb.exe122⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-