Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe
-
Size
52KB
-
MD5
ac27c6b54a296dbd640115bfdabd85b2
-
SHA1
e7cccb0998b22af764d8a76c94c1d8a25c2c8750
-
SHA256
794dee63f6fc393e9ea70e448d5307d78a45c7b34e6151893816d202fbf4afee
-
SHA512
135a15c5cec81af209dd9e7b0aab9e5b4b96061049947a7fddbeb69b8ac8bf5f7d8977a15b1e9a2e5518614478d210565ecbf0fe31d21fb90026ff3c7f958723
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDod5k2nd:ymb3NkkiQ3mdBjFod5znd
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/624-10-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2288 hvdbdb.exe 2740 tpjdxp.exe 2976 fppvlpp.exe 2196 rpdtpn.exe 2812 vvdpx.exe 2628 nvvjrtd.exe 3048 hdhfbht.exe 2292 jjhhr.exe 2304 pvdbt.exe 1264 ttvtvv.exe 1244 bdxhpj.exe 568 phtrlrb.exe 2940 ndtvbjj.exe 2148 xjpnl.exe 848 ltdfbbr.exe 1756 dftbrb.exe 2236 frhrrjr.exe 2208 hvptj.exe 1344 btrbhb.exe 2192 hbfrl.exe 1520 njndftb.exe 1900 btntn.exe 1808 vjxbvt.exe 1536 lvdhj.exe 640 ltjnn.exe 1016 rlbldxv.exe 540 hthdh.exe 2464 xthllr.exe 2444 bpxfbn.exe 876 ntrpv.exe 2244 nblxh.exe 2416 dtldd.exe 2168 bbtlprv.exe 1596 ppffbj.exe 2740 fbxjv.exe 2296 pbxtjv.exe 2752 txhnrpl.exe 2808 hbbhvrf.exe 2900 pltjn.exe 892 djdbxl.exe 576 lxpdn.exe 2448 tdfhdb.exe 3056 fhnvfft.exe 2516 xlrphr.exe 1092 ltftp.exe 2304 jbbrxdt.exe 1296 fdtdr.exe 1864 lhtptb.exe 2736 ppxlfbv.exe 2036 plhpjv.exe 1276 vbvhjx.exe 2148 vxvjhtv.exe 1996 xhvtjlp.exe 1484 hrdnvx.exe 2876 vhvlphv.exe 1148 jnfdvh.exe 1196 dxxrv.exe 2216 phftl.exe 1940 plnxp.exe 2164 ndhhl.exe 1784 rjvvfhj.exe 2492 dljfrjb.exe 2968 jbxfb.exe 1544 xhjhd.exe -
resource yara_rule behavioral1/memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfpjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhxtvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rppnxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfrnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxplvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdfnfdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfbtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjjdlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtrdxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvrrtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfjfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvtdhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbhbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdfhdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njjbbtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plxppxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjfldjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndphlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbjfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttdrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txfbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phllbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvfxvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vblff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dprvjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxxvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnlhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rphnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlnrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjpxprn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllxx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 624 wrote to memory of 2288 624 ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe 30 PID 624 wrote to memory of 2288 624 ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe 30 PID 624 wrote to memory of 2288 624 ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe 30 PID 624 wrote to memory of 2288 624 ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe 30 PID 2288 wrote to memory of 2740 2288 hvdbdb.exe 31 PID 2288 wrote to memory of 2740 2288 hvdbdb.exe 31 PID 2288 wrote to memory of 2740 2288 hvdbdb.exe 31 PID 2288 wrote to memory of 2740 2288 hvdbdb.exe 31 PID 2740 wrote to memory of 2976 2740 tpjdxp.exe 32 PID 2740 wrote to memory of 2976 2740 tpjdxp.exe 32 PID 2740 wrote to memory of 2976 2740 tpjdxp.exe 32 PID 2740 wrote to memory of 2976 2740 tpjdxp.exe 32 PID 2976 wrote to memory of 2196 2976 fppvlpp.exe 33 PID 2976 wrote to memory of 2196 2976 fppvlpp.exe 33 PID 2976 wrote to memory of 2196 2976 fppvlpp.exe 33 PID 2976 wrote to memory of 2196 2976 fppvlpp.exe 33 PID 2196 wrote to memory of 2812 2196 rpdtpn.exe 34 PID 2196 wrote to memory of 2812 2196 rpdtpn.exe 34 PID 2196 wrote to memory of 2812 2196 rpdtpn.exe 34 PID 2196 wrote to memory of 2812 2196 rpdtpn.exe 34 PID 2812 wrote to memory of 2628 2812 vvdpx.exe 35 PID 2812 wrote to memory of 2628 2812 vvdpx.exe 35 PID 2812 wrote to memory of 2628 2812 vvdpx.exe 35 PID 2812 wrote to memory of 2628 2812 vvdpx.exe 35 PID 2628 wrote to memory of 3048 2628 nvvjrtd.exe 36 PID 2628 wrote to memory of 3048 2628 nvvjrtd.exe 36 PID 2628 wrote to memory of 3048 2628 nvvjrtd.exe 36 PID 2628 wrote to memory of 3048 2628 nvvjrtd.exe 36 PID 3048 wrote to memory of 2292 3048 hdhfbht.exe 37 PID 3048 wrote to memory of 2292 3048 hdhfbht.exe 37 PID 3048 wrote to memory of 2292 3048 hdhfbht.exe 37 PID 3048 wrote to memory of 2292 3048 hdhfbht.exe 37 PID 2292 wrote to memory of 2304 2292 jjhhr.exe 38 PID 2292 wrote to memory of 2304 2292 jjhhr.exe 38 PID 2292 wrote to memory of 2304 2292 jjhhr.exe 38 PID 2292 wrote to memory of 2304 2292 jjhhr.exe 38 PID 2304 wrote to memory of 1264 2304 pvdbt.exe 39 PID 2304 wrote to memory of 1264 2304 pvdbt.exe 39 PID 2304 wrote to memory of 1264 2304 pvdbt.exe 39 PID 2304 wrote to memory of 1264 2304 pvdbt.exe 39 PID 1264 wrote to memory of 1244 1264 ttvtvv.exe 40 PID 1264 wrote to memory of 1244 1264 ttvtvv.exe 40 PID 1264 wrote to memory of 1244 1264 ttvtvv.exe 40 PID 1264 wrote to memory of 1244 1264 ttvtvv.exe 40 PID 1244 wrote to memory of 568 1244 bdxhpj.exe 41 PID 1244 wrote to memory of 568 1244 bdxhpj.exe 41 PID 1244 wrote to memory of 568 1244 bdxhpj.exe 41 PID 1244 wrote to memory of 568 1244 bdxhpj.exe 41 PID 568 wrote to memory of 2940 568 phtrlrb.exe 42 PID 568 wrote to memory of 2940 568 phtrlrb.exe 42 PID 568 wrote to memory of 2940 568 phtrlrb.exe 42 PID 568 wrote to memory of 2940 568 phtrlrb.exe 42 PID 2940 wrote to memory of 2148 2940 ndtvbjj.exe 43 PID 2940 wrote to memory of 2148 2940 ndtvbjj.exe 43 PID 2940 wrote to memory of 2148 2940 ndtvbjj.exe 43 PID 2940 wrote to memory of 2148 2940 ndtvbjj.exe 43 PID 2148 wrote to memory of 848 2148 xjpnl.exe 44 PID 2148 wrote to memory of 848 2148 xjpnl.exe 44 PID 2148 wrote to memory of 848 2148 xjpnl.exe 44 PID 2148 wrote to memory of 848 2148 xjpnl.exe 44 PID 848 wrote to memory of 1756 848 ltdfbbr.exe 45 PID 848 wrote to memory of 1756 848 ltdfbbr.exe 45 PID 848 wrote to memory of 1756 848 ltdfbbr.exe 45 PID 848 wrote to memory of 1756 848 ltdfbbr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\hvdbdb.exec:\hvdbdb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\tpjdxp.exec:\tpjdxp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fppvlpp.exec:\fppvlpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rpdtpn.exec:\rpdtpn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\vvdpx.exec:\vvdpx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nvvjrtd.exec:\nvvjrtd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\hdhfbht.exec:\hdhfbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jjhhr.exec:\jjhhr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pvdbt.exec:\pvdbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\ttvtvv.exec:\ttvtvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\bdxhpj.exec:\bdxhpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\phtrlrb.exec:\phtrlrb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\ndtvbjj.exec:\ndtvbjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xjpnl.exec:\xjpnl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ltdfbbr.exec:\ltdfbbr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\dftbrb.exec:\dftbrb.exe17⤵
- Executes dropped EXE
PID:1756 -
\??\c:\frhrrjr.exec:\frhrrjr.exe18⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hvptj.exec:\hvptj.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\btrbhb.exec:\btrbhb.exe20⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hbfrl.exec:\hbfrl.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\njndftb.exec:\njndftb.exe22⤵
- Executes dropped EXE
PID:1520 -
\??\c:\btntn.exec:\btntn.exe23⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vjxbvt.exec:\vjxbvt.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lvdhj.exec:\lvdhj.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ltjnn.exec:\ltjnn.exe26⤵
- Executes dropped EXE
PID:640 -
\??\c:\rlbldxv.exec:\rlbldxv.exe27⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hthdh.exec:\hthdh.exe28⤵
- Executes dropped EXE
PID:540 -
\??\c:\xthllr.exec:\xthllr.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bpxfbn.exec:\bpxfbn.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ntrpv.exec:\ntrpv.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\nblxh.exec:\nblxh.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dtldd.exec:\dtldd.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbtlprv.exec:\bbtlprv.exe34⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ppffbj.exec:\ppffbj.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fbxjv.exec:\fbxjv.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pbxtjv.exec:\pbxtjv.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\txhnrpl.exec:\txhnrpl.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbbhvrf.exec:\hbbhvrf.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pltjn.exec:\pltjn.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\djdbxl.exec:\djdbxl.exe41⤵
- Executes dropped EXE
PID:892 -
\??\c:\lxpdn.exec:\lxpdn.exe42⤵
- Executes dropped EXE
PID:576 -
\??\c:\tdfhdb.exec:\tdfhdb.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\fhnvfft.exec:\fhnvfft.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xlrphr.exec:\xlrphr.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\ltftp.exec:\ltftp.exe46⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jbbrxdt.exec:\jbbrxdt.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fdtdr.exec:\fdtdr.exe48⤵
- Executes dropped EXE
PID:1296 -
\??\c:\lhtptb.exec:\lhtptb.exe49⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ppxlfbv.exec:\ppxlfbv.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\plhpjv.exec:\plhpjv.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vbvhjx.exec:\vbvhjx.exe52⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vxvjhtv.exec:\vxvjhtv.exe53⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xhvtjlp.exec:\xhvtjlp.exe54⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hrdnvx.exec:\hrdnvx.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vhvlphv.exec:\vhvlphv.exe56⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jnfdvh.exec:\jnfdvh.exe57⤵
- Executes dropped EXE
PID:1148 -
\??\c:\dxxrv.exec:\dxxrv.exe58⤵
- Executes dropped EXE
PID:1196 -
\??\c:\phftl.exec:\phftl.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\plnxp.exec:\plnxp.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ndhhl.exec:\ndhhl.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\rjvvfhj.exec:\rjvvfhj.exe62⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dljfrjb.exec:\dljfrjb.exe63⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jbxfb.exec:\jbxfb.exe64⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xhjhd.exec:\xhjhd.exe65⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ftnlnvt.exec:\ftnlnvt.exe66⤵PID:1536
-
\??\c:\vfnjhnb.exec:\vfnjhnb.exe67⤵PID:1372
-
\??\c:\rtbbvr.exec:\rtbbvr.exe68⤵PID:3068
-
\??\c:\trhnhp.exec:\trhnhp.exe69⤵PID:2388
-
\??\c:\lvbfj.exec:\lvbfj.exe70⤵PID:2364
-
\??\c:\bftxvv.exec:\bftxvv.exe71⤵PID:2464
-
\??\c:\nvllxhl.exec:\nvllxhl.exe72⤵PID:2444
-
\??\c:\vjnvvj.exec:\vjnvvj.exe73⤵PID:1112
-
\??\c:\phfjrtd.exec:\phfjrtd.exe74⤵PID:2912
-
\??\c:\nprxrj.exec:\nprxrj.exe75⤵PID:2188
-
\??\c:\nvfhr.exec:\nvfhr.exe76⤵PID:2836
-
\??\c:\ffrbpdv.exec:\ffrbpdv.exe77⤵PID:2264
-
\??\c:\vhhhhhh.exec:\vhhhhhh.exe78⤵PID:2640
-
\??\c:\nhdxjf.exec:\nhdxjf.exe79⤵PID:2796
-
\??\c:\frrhfx.exec:\frrhfx.exe80⤵PID:2924
-
\??\c:\vbblrpp.exec:\vbblrpp.exe81⤵PID:2972
-
\??\c:\rpfttxn.exec:\rpfttxn.exe82⤵PID:2636
-
\??\c:\fxxjdjj.exec:\fxxjdjj.exe83⤵PID:2900
-
\??\c:\pbxrj.exec:\pbxrj.exe84⤵PID:3052
-
\??\c:\xltphjh.exec:\xltphjh.exe85⤵PID:2612
-
\??\c:\rlfdbx.exec:\rlfdbx.exe86⤵PID:1528
-
\??\c:\rnxht.exec:\rnxht.exe87⤵PID:344
-
\??\c:\rrvhfd.exec:\rrvhfd.exe88⤵PID:2132
-
\??\c:\bpjfh.exec:\bpjfh.exe89⤵PID:2544
-
\??\c:\vjfnbp.exec:\vjfnbp.exe90⤵PID:1460
-
\??\c:\hlbfrph.exec:\hlbfrph.exe91⤵PID:1216
-
\??\c:\nbvvrn.exec:\nbvvrn.exe92⤵PID:2696
-
\??\c:\trdrxbn.exec:\trdrxbn.exe93⤵PID:2144
-
\??\c:\fnhrtd.exec:\fnhrtd.exe94⤵PID:2036
-
\??\c:\lbtddvb.exec:\lbtddvb.exe95⤵PID:1276
-
\??\c:\bvpbb.exec:\bvpbb.exe96⤵PID:848
-
\??\c:\hfrdt.exec:\hfrdt.exe97⤵PID:948
-
\??\c:\bvdnlv.exec:\bvdnlv.exe98⤵PID:2268
-
\??\c:\ndtrrh.exec:\ndtrrh.exe99⤵PID:2236
-
\??\c:\nrftx.exec:\nrftx.exe100⤵PID:2180
-
\??\c:\lxbvpff.exec:\lxbvpff.exe101⤵PID:2320
-
\??\c:\ttbhr.exec:\ttbhr.exe102⤵PID:2024
-
\??\c:\lfpjh.exec:\lfpjh.exe103⤵
- System Location Discovery: System Language Discovery
PID:2428 -
\??\c:\nptfv.exec:\nptfv.exe104⤵PID:1616
-
\??\c:\rfddfxr.exec:\rfddfxr.exe105⤵PID:1748
-
\??\c:\nbbjh.exec:\nbbjh.exe106⤵PID:1808
-
\??\c:\hpxnhr.exec:\hpxnhr.exe107⤵PID:2348
-
\??\c:\fjpxprn.exec:\fjpxprn.exe108⤵
- System Location Discovery: System Language Discovery
PID:1064 -
\??\c:\ljrdxlb.exec:\ljrdxlb.exe109⤵PID:1820
-
\??\c:\hrlph.exec:\hrlph.exe110⤵PID:1188
-
\??\c:\tpjlbv.exec:\tpjlbv.exe111⤵PID:2152
-
\??\c:\djxhprf.exec:\djxhprf.exe112⤵PID:1920
-
\??\c:\bpxlbt.exec:\bpxlbt.exe113⤵PID:2568
-
\??\c:\jhnplpt.exec:\jhnplpt.exe114⤵PID:2528
-
\??\c:\jdnnpb.exec:\jdnnpb.exe115⤵PID:2472
-
\??\c:\lrvxf.exec:\lrvxf.exe116⤵PID:3044
-
\??\c:\jjlnhl.exec:\jjlnhl.exe117⤵PID:2840
-
\??\c:\hrrxfh.exec:\hrrxfh.exe118⤵PID:1712
-
\??\c:\vtdbdn.exec:\vtdbdn.exe119⤵PID:2576
-
\??\c:\txfbj.exec:\txfbj.exe120⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\ttbfnj.exec:\ttbfnj.exe121⤵PID:2436
-
\??\c:\rnnvnlp.exec:\rnnvnlp.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-