Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe
-
Size
132KB
-
MD5
1203015e3c1fc213eee40870a1bdbf1c
-
SHA1
d31d27d7fa6db7bc1ba4ee10083accae6f77b39a
-
SHA256
764ea099bfbee95b8522ae91095b8f8b936591af40ae35f916f7d338278fe18b
-
SHA512
5c57b96576a9a79ed061592792352be3c5654c6276873605091ffac1262ea1e5b07f2cb90045effa55a9d5436b954993d45ef276953e3a0182943d32c08ef138
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUgJu:n3C9BRo7tvnJ9oH0IRgZvjD1u
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/3044-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 nhttbh.exe 2748 vpddp.exe 2568 frfrxff.exe 980 xrfllrx.exe 2536 1bbbhh.exe 2976 ppdjv.exe 2708 5fxflrr.exe 2072 xxxfxxl.exe 2344 vpdjp.exe 1188 vpjjp.exe 1296 lxlxlrf.exe 536 tnbntb.exe 1712 9jvdv.exe 2360 3fxfrlx.exe 1776 lllffxf.exe 1560 bthnhh.exe 2224 7vddd.exe 1272 9jjdv.exe 1232 7rflrlx.exe 404 tnbhnn.exe 348 vpdjv.exe 1320 pjppv.exe 2488 rrrlxfx.exe 2112 btbbnh.exe 2464 hbhthh.exe 2996 3jddp.exe 2284 xrlrrrx.exe 2096 hthhnt.exe 1036 3vdvd.exe 872 lfxlxxr.exe 2888 htbttt.exe 2676 nhhhtb.exe 2752 jvdpp.exe 2756 9frrxxf.exe 2796 1rrfflx.exe 2648 btnbnb.exe 2808 5bhntn.exe 2608 vjdvv.exe 2600 lfllxrx.exe 1492 lfxfrxl.exe 1520 hhhbbn.exe 1932 9nhntb.exe 2396 jvddj.exe 572 dpppv.exe 1220 1xxxlfl.exe 1692 rrflxxf.exe 328 bhnhtn.exe 2016 nntttb.exe 3020 pdjvd.exe 2988 7vpdp.exe 1776 lxflflf.exe 2212 xrlrffx.exe 2192 5hnnbb.exe 2928 dvjjv.exe 3012 7jpvd.exe 1940 7lffffr.exe 1824 7lrrxrx.exe 1916 ttnntt.exe 616 1ntbhh.exe 596 3pdjp.exe 1920 lfrlrrr.exe 1772 lfrrllr.exe 1496 bnhhbb.exe 2328 hbhnnt.exe -
resource yara_rule behavioral1/memory/3044-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2676 3044 1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2676 3044 1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2676 3044 1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2676 3044 1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe 30 PID 2676 wrote to memory of 2748 2676 nhttbh.exe 31 PID 2676 wrote to memory of 2748 2676 nhttbh.exe 31 PID 2676 wrote to memory of 2748 2676 nhttbh.exe 31 PID 2676 wrote to memory of 2748 2676 nhttbh.exe 31 PID 2748 wrote to memory of 2568 2748 vpddp.exe 32 PID 2748 wrote to memory of 2568 2748 vpddp.exe 32 PID 2748 wrote to memory of 2568 2748 vpddp.exe 32 PID 2748 wrote to memory of 2568 2748 vpddp.exe 32 PID 2568 wrote to memory of 980 2568 frfrxff.exe 33 PID 2568 wrote to memory of 980 2568 frfrxff.exe 33 PID 2568 wrote to memory of 980 2568 frfrxff.exe 33 PID 2568 wrote to memory of 980 2568 frfrxff.exe 33 PID 980 wrote to memory of 2536 980 xrfllrx.exe 34 PID 980 wrote to memory of 2536 980 xrfllrx.exe 34 PID 980 wrote to memory of 2536 980 xrfllrx.exe 34 PID 980 wrote to memory of 2536 980 xrfllrx.exe 34 PID 2536 wrote to memory of 2976 2536 1bbbhh.exe 35 PID 2536 wrote to memory of 2976 2536 1bbbhh.exe 35 PID 2536 wrote to memory of 2976 2536 1bbbhh.exe 35 PID 2536 wrote to memory of 2976 2536 1bbbhh.exe 35 PID 2976 wrote to memory of 2708 2976 ppdjv.exe 36 PID 2976 wrote to memory of 2708 2976 ppdjv.exe 36 PID 2976 wrote to memory of 2708 2976 ppdjv.exe 36 PID 2976 wrote to memory of 2708 2976 ppdjv.exe 36 PID 2708 wrote to memory of 2072 2708 5fxflrr.exe 37 PID 2708 wrote to memory of 2072 2708 5fxflrr.exe 37 PID 2708 wrote to memory of 2072 2708 5fxflrr.exe 37 PID 2708 wrote to memory of 2072 2708 5fxflrr.exe 37 PID 2072 wrote to memory of 2344 2072 xxxfxxl.exe 38 PID 2072 wrote to memory of 2344 2072 xxxfxxl.exe 38 PID 2072 wrote to memory of 2344 2072 xxxfxxl.exe 38 PID 2072 wrote to memory of 2344 2072 xxxfxxl.exe 38 PID 2344 wrote to memory of 1188 2344 vpdjp.exe 39 PID 2344 wrote to memory of 1188 2344 vpdjp.exe 39 PID 2344 wrote to memory of 1188 2344 vpdjp.exe 39 PID 2344 wrote to memory of 1188 2344 vpdjp.exe 39 PID 1188 wrote to memory of 1296 1188 vpjjp.exe 40 PID 1188 wrote to memory of 1296 1188 vpjjp.exe 40 PID 1188 wrote to memory of 1296 1188 vpjjp.exe 40 PID 1188 wrote to memory of 1296 1188 vpjjp.exe 40 PID 1296 wrote to memory of 536 1296 lxlxlrf.exe 41 PID 1296 wrote to memory of 536 1296 lxlxlrf.exe 41 PID 1296 wrote to memory of 536 1296 lxlxlrf.exe 41 PID 1296 wrote to memory of 536 1296 lxlxlrf.exe 41 PID 536 wrote to memory of 1712 536 tnbntb.exe 42 PID 536 wrote to memory of 1712 536 tnbntb.exe 42 PID 536 wrote to memory of 1712 536 tnbntb.exe 42 PID 536 wrote to memory of 1712 536 tnbntb.exe 42 PID 1712 wrote to memory of 2360 1712 9jvdv.exe 43 PID 1712 wrote to memory of 2360 1712 9jvdv.exe 43 PID 1712 wrote to memory of 2360 1712 9jvdv.exe 43 PID 1712 wrote to memory of 2360 1712 9jvdv.exe 43 PID 2360 wrote to memory of 1776 2360 3fxfrlx.exe 44 PID 2360 wrote to memory of 1776 2360 3fxfrlx.exe 44 PID 2360 wrote to memory of 1776 2360 3fxfrlx.exe 44 PID 2360 wrote to memory of 1776 2360 3fxfrlx.exe 44 PID 1776 wrote to memory of 1560 1776 lllffxf.exe 45 PID 1776 wrote to memory of 1560 1776 lllffxf.exe 45 PID 1776 wrote to memory of 1560 1776 lllffxf.exe 45 PID 1776 wrote to memory of 1560 1776 lllffxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\nhttbh.exec:\nhttbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vpddp.exec:\vpddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\frfrxff.exec:\frfrxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\xrfllrx.exec:\xrfllrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\1bbbhh.exec:\1bbbhh.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ppdjv.exec:\ppdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\5fxflrr.exec:\5fxflrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xxxfxxl.exec:\xxxfxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpdjp.exec:\vpdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vpjjp.exec:\vpjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\lxlxlrf.exec:\lxlxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\tnbntb.exec:\tnbntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\9jvdv.exec:\9jvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\3fxfrlx.exec:\3fxfrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\lllffxf.exec:\lllffxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\bthnhh.exec:\bthnhh.exe17⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7vddd.exec:\7vddd.exe18⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9jjdv.exec:\9jjdv.exe19⤵
- Executes dropped EXE
PID:1272 -
\??\c:\7rflrlx.exec:\7rflrlx.exe20⤵
- Executes dropped EXE
PID:1232 -
\??\c:\tnbhnn.exec:\tnbhnn.exe21⤵
- Executes dropped EXE
PID:404 -
\??\c:\vpdjv.exec:\vpdjv.exe22⤵
- Executes dropped EXE
PID:348 -
\??\c:\pjppv.exec:\pjppv.exe23⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rrrlxfx.exec:\rrrlxfx.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\btbbnh.exec:\btbbnh.exe25⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hbhthh.exec:\hbhthh.exe26⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3jddp.exec:\3jddp.exe27⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xrlrrrx.exec:\xrlrrrx.exe28⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hthhnt.exec:\hthhnt.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\3vdvd.exec:\3vdvd.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lfxlxxr.exec:\lfxlxxr.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\htbttt.exec:\htbttt.exe32⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nhhhtb.exec:\nhhhtb.exe33⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jvdpp.exec:\jvdpp.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9frrxxf.exec:\9frrxxf.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1rrfflx.exec:\1rrfflx.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\btnbnb.exec:\btnbnb.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5bhntn.exec:\5bhntn.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vjdvv.exec:\vjdvv.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lfllxrx.exec:\lfllxrx.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe41⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hhhbbn.exec:\hhhbbn.exe42⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9nhntb.exec:\9nhntb.exe43⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jvddj.exec:\jvddj.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dpppv.exec:\dpppv.exe45⤵
- Executes dropped EXE
PID:572 -
\??\c:\1xxxlfl.exec:\1xxxlfl.exe46⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rrflxxf.exec:\rrflxxf.exe47⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bhnhtn.exec:\bhnhtn.exe48⤵
- Executes dropped EXE
PID:328 -
\??\c:\nntttb.exec:\nntttb.exe49⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pdjvd.exec:\pdjvd.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7vpdp.exec:\7vpdp.exe51⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lxflflf.exec:\lxflflf.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776 -
\??\c:\xrlrffx.exec:\xrlrffx.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5hnnbb.exec:\5hnnbb.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dvjjv.exec:\dvjjv.exe55⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7jpvd.exec:\7jpvd.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7lffffr.exec:\7lffffr.exe57⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7lrrxrx.exec:\7lrrxrx.exe58⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ttnntt.exec:\ttnntt.exe59⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1ntbhh.exec:\1ntbhh.exe60⤵
- Executes dropped EXE
PID:616 -
\??\c:\3pdjp.exec:\3pdjp.exe61⤵
- Executes dropped EXE
PID:596 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe62⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lfrrllr.exec:\lfrrllr.exe63⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bnhhbb.exec:\bnhhbb.exe64⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hbhnnt.exec:\hbhnnt.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dpdjp.exec:\dpdjp.exe66⤵PID:2996
-
\??\c:\lflllrf.exec:\lflllrf.exe67⤵PID:2452
-
\??\c:\lxxfllr.exec:\lxxfllr.exe68⤵PID:1640
-
\??\c:\9fxlxxl.exec:\9fxlxxl.exe69⤵PID:296
-
\??\c:\btbhth.exec:\btbhth.exe70⤵PID:2132
-
\??\c:\dppjp.exec:\dppjp.exe71⤵PID:872
-
\??\c:\5vpdd.exec:\5vpdd.exe72⤵PID:2700
-
\??\c:\1xffllx.exec:\1xffllx.exe73⤵PID:2736
-
\??\c:\rlxfllr.exec:\rlxfllr.exe74⤵PID:2812
-
\??\c:\5bttbh.exec:\5bttbh.exe75⤵PID:2784
-
\??\c:\9nhtbt.exec:\9nhtbt.exe76⤵PID:2672
-
\??\c:\ppppd.exec:\ppppd.exe77⤵PID:2732
-
\??\c:\dppjj.exec:\dppjj.exe78⤵PID:980
-
\??\c:\3xllrxl.exec:\3xllrxl.exe79⤵PID:2584
-
\??\c:\5frxfff.exec:\5frxfff.exe80⤵PID:2656
-
\??\c:\bthnhn.exec:\bthnhn.exe81⤵PID:2984
-
\??\c:\hbnhtn.exec:\hbnhtn.exe82⤵PID:2780
-
\??\c:\pjvvv.exec:\pjvvv.exe83⤵PID:2160
-
\??\c:\5lxrrrr.exec:\5lxrrrr.exe84⤵PID:1372
-
\??\c:\rffxfxx.exec:\rffxfxx.exe85⤵PID:2520
-
\??\c:\nbhntb.exec:\nbhntb.exe86⤵PID:1076
-
\??\c:\tnttnt.exec:\tnttnt.exe87⤵PID:2008
-
\??\c:\3jpdd.exec:\3jpdd.exe88⤵PID:1324
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe89⤵PID:2064
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe90⤵PID:1660
-
\??\c:\btnthn.exec:\btnthn.exe91⤵PID:2360
-
\??\c:\3hnntn.exec:\3hnntn.exe92⤵PID:2044
-
\??\c:\3dpvv.exec:\3dpvv.exe93⤵
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\ppddp.exec:\ppddp.exe94⤵PID:2224
-
\??\c:\pdpjp.exec:\pdpjp.exe95⤵PID:3016
-
\??\c:\7lxxffl.exec:\7lxxffl.exe96⤵PID:2196
-
\??\c:\hbnntn.exec:\hbnntn.exe97⤵PID:2052
-
\??\c:\bntnnn.exec:\bntnnn.exe98⤵PID:1864
-
\??\c:\7pddp.exec:\7pddp.exe99⤵
- System Location Discovery: System Language Discovery
PID:676 -
\??\c:\jvjvj.exec:\jvjvj.exe100⤵PID:2500
-
\??\c:\lflrflx.exec:\lflrflx.exe101⤵PID:2236
-
\??\c:\1xfffxx.exec:\1xfffxx.exe102⤵PID:1732
-
\??\c:\ttnhnb.exec:\ttnhnb.exe103⤵PID:1948
-
\??\c:\hthbbt.exec:\hthbbt.exe104⤵PID:3056
-
\??\c:\3jvdd.exec:\3jvdd.exe105⤵PID:2240
-
\??\c:\5jvpj.exec:\5jvpj.exe106⤵PID:1028
-
\??\c:\9xrrrxl.exec:\9xrrrxl.exe107⤵PID:924
-
\??\c:\rlflxxl.exec:\rlflxxl.exe108⤵PID:2096
-
\??\c:\tnbhtb.exec:\tnbhtb.exe109⤵PID:1716
-
\??\c:\9nnntn.exec:\9nnntn.exe110⤵PID:2448
-
\??\c:\5dvdj.exec:\5dvdj.exe111⤵PID:2644
-
\??\c:\jdpvd.exec:\jdpvd.exe112⤵PID:2640
-
\??\c:\lxffrxf.exec:\lxffrxf.exe113⤵PID:1604
-
\??\c:\5flllfl.exec:\5flllfl.exe114⤵PID:2752
-
\??\c:\nnhhtb.exec:\nnhhtb.exe115⤵PID:2568
-
\??\c:\jvddj.exec:\jvddj.exe116⤵PID:2548
-
\??\c:\pdppd.exec:\pdppd.exe117⤵PID:2696
-
\??\c:\3rlrxfl.exec:\3rlrxfl.exe118⤵PID:2808
-
\??\c:\xrffrrx.exec:\xrffrrx.exe119⤵PID:1508
-
\??\c:\9bnnbb.exec:\9bnnbb.exe120⤵PID:2600
-
\??\c:\thttnn.exec:\thttnn.exe121⤵PID:2208
-
\??\c:\pjppp.exec:\pjppp.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-