Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe
-
Size
219KB
-
MD5
f529b34255b8bb76491c487db563bb2c
-
SHA1
1b49026c3556038259b17c38a8deed31d287e679
-
SHA256
32db4231dd42dc03c492f7ff48c9bde6a22cad07274019585ff511656593614a
-
SHA512
fd9cd0890fd18888c7966aaa0e13f78ebbba9ab8f19aa426e541d2b76cf29298c63e8f7b1736eb764e545572815c40278ad174cd656e67110362a0e23c3d81b1
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4SS4:n3C9BRo7MlrWKo+lx64
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2752-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/656-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 hhhttt.exe 2484 3pddd.exe 2832 9rllrxl.exe 2712 7hbhnt.exe 2012 xrllxxf.exe 3028 lfxxrrf.exe 656 nbbhhb.exe 632 vjddj.exe 2432 dppjj.exe 2384 xxrxlrf.exe 2892 thhnht.exe 2044 vjpvp.exe 1968 1xrrxxx.exe 1040 hbnthn.exe 2272 7hbhtt.exe 1188 pdppv.exe 2952 lxfflfx.exe 2948 lxlrllx.exe 2452 bhbtht.exe 2260 pdpdp.exe 1684 1flrxfl.exe 848 thtthb.exe 1100 jvdjv.exe 1252 xrfxflf.exe 872 hthhhh.exe 1736 nbhhnb.exe 2972 vjpdj.exe 2536 lxfllrr.exe 1300 5nbhnn.exe 2240 ppjjv.exe 2724 rlxfrxf.exe 2752 7bhntt.exe 2784 dpddp.exe 3052 7jvdp.exe 2764 3xrxxfl.exe 2612 rrfxfff.exe 2676 nbhbbb.exe 3000 7hnnhb.exe 768 dpvvd.exe 3028 3dvvd.exe 2024 frfxxxx.exe 2180 hbntht.exe 1912 1btbtn.exe 2432 vjjjj.exe 2208 dpdvj.exe 2040 xrxxfxl.exe 2896 xrfxrrf.exe 1396 thttbb.exe 1780 hbnntt.exe 3012 5jvvv.exe 1728 vjpjj.exe 1148 frxxlfr.exe 1720 hbnhtt.exe 2276 nbhhhh.exe 2944 pdppp.exe 2444 vpddd.exe 308 rxfxxll.exe 1248 rfrxxxf.exe 2524 9tbttn.exe 1696 thntbb.exe 108 pddjp.exe 1620 rlffrrx.exe 560 xxfflfl.exe 1768 tbbtnt.exe -
resource yara_rule behavioral1/memory/2820-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/656-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2752 2820 f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2752 2820 f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2752 2820 f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2752 2820 f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe 30 PID 2752 wrote to memory of 2484 2752 hhhttt.exe 31 PID 2752 wrote to memory of 2484 2752 hhhttt.exe 31 PID 2752 wrote to memory of 2484 2752 hhhttt.exe 31 PID 2752 wrote to memory of 2484 2752 hhhttt.exe 31 PID 2484 wrote to memory of 2832 2484 3pddd.exe 32 PID 2484 wrote to memory of 2832 2484 3pddd.exe 32 PID 2484 wrote to memory of 2832 2484 3pddd.exe 32 PID 2484 wrote to memory of 2832 2484 3pddd.exe 32 PID 2832 wrote to memory of 2712 2832 9rllrxl.exe 33 PID 2832 wrote to memory of 2712 2832 9rllrxl.exe 33 PID 2832 wrote to memory of 2712 2832 9rllrxl.exe 33 PID 2832 wrote to memory of 2712 2832 9rllrxl.exe 33 PID 2712 wrote to memory of 2012 2712 7hbhnt.exe 34 PID 2712 wrote to memory of 2012 2712 7hbhnt.exe 34 PID 2712 wrote to memory of 2012 2712 7hbhnt.exe 34 PID 2712 wrote to memory of 2012 2712 7hbhnt.exe 34 PID 2012 wrote to memory of 3028 2012 xrllxxf.exe 35 PID 2012 wrote to memory of 3028 2012 xrllxxf.exe 35 PID 2012 wrote to memory of 3028 2012 xrllxxf.exe 35 PID 2012 wrote to memory of 3028 2012 xrllxxf.exe 35 PID 3028 wrote to memory of 656 3028 lfxxrrf.exe 36 PID 3028 wrote to memory of 656 3028 lfxxrrf.exe 36 PID 3028 wrote to memory of 656 3028 lfxxrrf.exe 36 PID 3028 wrote to memory of 656 3028 lfxxrrf.exe 36 PID 656 wrote to memory of 632 656 nbbhhb.exe 37 PID 656 wrote to memory of 632 656 nbbhhb.exe 37 PID 656 wrote to memory of 632 656 nbbhhb.exe 37 PID 656 wrote to memory of 632 656 nbbhhb.exe 37 PID 632 wrote to memory of 2432 632 vjddj.exe 38 PID 632 wrote to memory of 2432 632 vjddj.exe 38 PID 632 wrote to memory of 2432 632 vjddj.exe 38 PID 632 wrote to memory of 2432 632 vjddj.exe 38 PID 2432 wrote to memory of 2384 2432 dppjj.exe 39 PID 2432 wrote to memory of 2384 2432 dppjj.exe 39 PID 2432 wrote to memory of 2384 2432 dppjj.exe 39 PID 2432 wrote to memory of 2384 2432 dppjj.exe 39 PID 2384 wrote to memory of 2892 2384 xxrxlrf.exe 40 PID 2384 wrote to memory of 2892 2384 xxrxlrf.exe 40 PID 2384 wrote to memory of 2892 2384 xxrxlrf.exe 40 PID 2384 wrote to memory of 2892 2384 xxrxlrf.exe 40 PID 2892 wrote to memory of 2044 2892 thhnht.exe 41 PID 2892 wrote to memory of 2044 2892 thhnht.exe 41 PID 2892 wrote to memory of 2044 2892 thhnht.exe 41 PID 2892 wrote to memory of 2044 2892 thhnht.exe 41 PID 2044 wrote to memory of 1968 2044 vjpvp.exe 42 PID 2044 wrote to memory of 1968 2044 vjpvp.exe 42 PID 2044 wrote to memory of 1968 2044 vjpvp.exe 42 PID 2044 wrote to memory of 1968 2044 vjpvp.exe 42 PID 1968 wrote to memory of 1040 1968 1xrrxxx.exe 43 PID 1968 wrote to memory of 1040 1968 1xrrxxx.exe 43 PID 1968 wrote to memory of 1040 1968 1xrrxxx.exe 43 PID 1968 wrote to memory of 1040 1968 1xrrxxx.exe 43 PID 1040 wrote to memory of 2272 1040 hbnthn.exe 44 PID 1040 wrote to memory of 2272 1040 hbnthn.exe 44 PID 1040 wrote to memory of 2272 1040 hbnthn.exe 44 PID 1040 wrote to memory of 2272 1040 hbnthn.exe 44 PID 2272 wrote to memory of 1188 2272 7hbhtt.exe 45 PID 2272 wrote to memory of 1188 2272 7hbhtt.exe 45 PID 2272 wrote to memory of 1188 2272 7hbhtt.exe 45 PID 2272 wrote to memory of 1188 2272 7hbhtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\hhhttt.exec:\hhhttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3pddd.exec:\3pddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9rllrxl.exec:\9rllrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7hbhnt.exec:\7hbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xrllxxf.exec:\xrllxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\nbbhhb.exec:\nbbhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\vjddj.exec:\vjddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\dppjj.exec:\dppjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\thhnht.exec:\thhnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vjpvp.exec:\vjpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\1xrrxxx.exec:\1xrrxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\hbnthn.exec:\hbnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\7hbhtt.exec:\7hbhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\pdppv.exec:\pdppv.exe17⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lxfflfx.exec:\lxfflfx.exe18⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lxlrllx.exec:\lxlrllx.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bhbtht.exec:\bhbtht.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pdpdp.exec:\pdpdp.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1flrxfl.exec:\1flrxfl.exe22⤵
- Executes dropped EXE
PID:1684 -
\??\c:\thtthb.exec:\thtthb.exe23⤵
- Executes dropped EXE
PID:848 -
\??\c:\jvdjv.exec:\jvdjv.exe24⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrfxflf.exec:\xrfxflf.exe25⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hthhhh.exec:\hthhhh.exe26⤵
- Executes dropped EXE
PID:872 -
\??\c:\nbhhnb.exec:\nbhhnb.exe27⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vjpdj.exec:\vjpdj.exe28⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lxfllrr.exec:\lxfllrr.exe29⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5nbhnn.exec:\5nbhnn.exe30⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ppjjv.exec:\ppjjv.exe31⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe32⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7bhntt.exec:\7bhntt.exe33⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dpddp.exec:\dpddp.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7jvdp.exec:\7jvdp.exe35⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3xrxxfl.exec:\3xrxxfl.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rrfxfff.exec:\rrfxfff.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbhbbb.exec:\nbhbbb.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7hnnhb.exec:\7hnnhb.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dpvvd.exec:\dpvvd.exe40⤵
- Executes dropped EXE
PID:768 -
\??\c:\3dvvd.exec:\3dvvd.exe41⤵
- Executes dropped EXE
PID:3028 -
\??\c:\frfxxxx.exec:\frfxxxx.exe42⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbntht.exec:\hbntht.exe43⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1btbtn.exec:\1btbtn.exe44⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vjjjj.exec:\vjjjj.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dpdvj.exec:\dpdvj.exe46⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrxxfxl.exec:\xrxxfxl.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrfxrrf.exec:\xrfxrrf.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thttbb.exec:\thttbb.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hbnntt.exec:\hbnntt.exe50⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5jvvv.exec:\5jvvv.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vjpjj.exec:\vjpjj.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\frxxlfr.exec:\frxxlfr.exe53⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hbnhtt.exec:\hbnhtt.exe54⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nbhhhh.exec:\nbhhhh.exe55⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pdppp.exec:\pdppp.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpddd.exec:\vpddd.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rxfxxll.exec:\rxfxxll.exe58⤵
- Executes dropped EXE
PID:308 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe59⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9tbttn.exec:\9tbttn.exe60⤵
- Executes dropped EXE
PID:2524 -
\??\c:\thntbb.exec:\thntbb.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pddjp.exec:\pddjp.exe62⤵
- Executes dropped EXE
PID:108 -
\??\c:\rlffrrx.exec:\rlffrrx.exe63⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xxfflfl.exec:\xxfflfl.exe64⤵
- Executes dropped EXE
PID:560 -
\??\c:\tbbtnt.exec:\tbbtnt.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hbnnbh.exec:\hbnnbh.exe66⤵PID:1736
-
\??\c:\9dvdj.exec:\9dvdj.exe67⤵PID:2412
-
\??\c:\9pddd.exec:\9pddd.exe68⤵PID:2876
-
\??\c:\lxlffxx.exec:\lxlffxx.exe69⤵PID:1816
-
\??\c:\3frrxfl.exec:\3frrxfl.exe70⤵PID:2852
-
\??\c:\nhnnnn.exec:\nhnnnn.exe71⤵PID:2404
-
\??\c:\bbhnhh.exec:\bbhnhh.exe72⤵PID:2756
-
\??\c:\ddvdp.exec:\ddvdp.exe73⤵PID:1600
-
\??\c:\vpjjv.exec:\vpjjv.exe74⤵PID:2800
-
\??\c:\rfxxllr.exec:\rfxxllr.exe75⤵PID:2736
-
\??\c:\xlxxffr.exec:\xlxxffr.exe76⤵PID:2624
-
\??\c:\thnntt.exec:\thnntt.exe77⤵PID:2672
-
\??\c:\ntbhhn.exec:\ntbhhn.exe78⤵PID:3004
-
\??\c:\vjdvv.exec:\vjdvv.exe79⤵PID:1744
-
\??\c:\7vjpd.exec:\7vjpd.exe80⤵PID:1484
-
\??\c:\5xffxxf.exec:\5xffxxf.exe81⤵PID:656
-
\??\c:\btbhnt.exec:\btbhnt.exe82⤵PID:840
-
\??\c:\7bnnnt.exec:\7bnnnt.exe83⤵PID:632
-
\??\c:\pdjjp.exec:\pdjjp.exe84⤵PID:2124
-
\??\c:\jdvvj.exec:\jdvvj.exe85⤵PID:2420
-
\??\c:\ffflrrr.exec:\ffflrrr.exe86⤵PID:2428
-
\??\c:\rfrrxff.exec:\rfrrxff.exe87⤵PID:1748
-
\??\c:\hhthtt.exec:\hhthtt.exe88⤵PID:2044
-
\??\c:\3nbtth.exec:\3nbtth.exe89⤵PID:1676
-
\??\c:\pvjjp.exec:\pvjjp.exe90⤵PID:1144
-
\??\c:\dvjjp.exec:\dvjjp.exe91⤵PID:1908
-
\??\c:\xflrfxx.exec:\xflrfxx.exe92⤵PID:1536
-
\??\c:\9hntht.exec:\9hntht.exe93⤵PID:2492
-
\??\c:\tnhnbb.exec:\tnhnbb.exe94⤵PID:2952
-
\??\c:\dpddd.exec:\dpddd.exe95⤵PID:2488
-
\??\c:\jvdvd.exec:\jvdvd.exe96⤵PID:2116
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe97⤵PID:2960
-
\??\c:\3flrxxf.exec:\3flrxxf.exe98⤵PID:1112
-
\??\c:\1tnthb.exec:\1tnthb.exe99⤵PID:1636
-
\??\c:\nhbbnb.exec:\nhbbnb.exe100⤵PID:1828
-
\??\c:\jdjpd.exec:\jdjpd.exe101⤵PID:2984
-
\??\c:\pdpjv.exec:\pdpjv.exe102⤵PID:1368
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe103⤵PID:2192
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe104⤵
- System Location Discovery: System Language Discovery
PID:1556 -
\??\c:\hhthnt.exec:\hhthnt.exe105⤵PID:2228
-
\??\c:\tntbhh.exec:\tntbhh.exe106⤵PID:992
-
\??\c:\jvddd.exec:\jvddd.exe107⤵PID:1016
-
\??\c:\dpdpp.exec:\dpdpp.exe108⤵PID:468
-
\??\c:\lfrrfrr.exec:\lfrrfrr.exe109⤵PID:1300
-
\??\c:\7xrxxfl.exec:\7xrxxfl.exe110⤵PID:2516
-
\??\c:\bnbbnn.exec:\bnbbnn.exe111⤵PID:2732
-
\??\c:\pjjdj.exec:\pjjdj.exe112⤵PID:2716
-
\??\c:\7dvvd.exec:\7dvvd.exe113⤵PID:1608
-
\??\c:\rlfffxl.exec:\rlfffxl.exe114⤵PID:2904
-
\??\c:\rflrxxf.exec:\rflrxxf.exe115⤵PID:1996
-
\??\c:\1bnntt.exec:\1bnntt.exe116⤵PID:2632
-
\??\c:\nhbbnt.exec:\nhbbnt.exe117⤵PID:2864
-
\??\c:\vpvjd.exec:\vpvjd.exe118⤵PID:380
-
\??\c:\dpvdj.exec:\dpvdj.exe119⤵PID:2268
-
\??\c:\9lfxllr.exec:\9lfxllr.exe120⤵PID:1388
-
\??\c:\rlrxffl.exec:\rlrxffl.exe121⤵PID:2236
-
\??\c:\9nttbb.exec:\9nttbb.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-