Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe
-
Size
76KB
-
MD5
56c815ec26cacd728c009d4bf1fb4c4e
-
SHA1
571e1cf81f8105e2d33ed0bbe26ab8ea3879cb0f
-
SHA256
efb7a67bd171bb0039de2d6cb871c2f368ac4f5bf134e38f412b5652457820b1
-
SHA512
4f1fa1c8b7497394517cb32489a9ddbbf3f20696bbd1a1068e19d47f4465c09f5fc6fe2241c160346de35d7827d976b75c2dea023de51c11530870cbed28ff26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpiZBf7+JB46m:ymb3NkkiQ3mdBjFIjZsJu
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2136-8-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/336-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2568 vvvvp.exe 792 3tbtbt.exe 2196 7lxfrxr.exe 2724 1ttnbn.exe 2780 jdvdj.exe 2756 vvpdj.exe 2896 rlfrlxl.exe 2332 ttntht.exe 2632 jjvdv.exe 808 5ffrlrr.exe 2304 bbnthn.exe 1268 bbtnbh.exe 2964 ddpdv.exe 2128 3rrflrl.exe 1396 nnbntn.exe 2952 3bhnbn.exe 1860 vvjdj.exe 2160 pjdpj.exe 2192 5xrxllx.exe 2468 hhthnb.exe 2532 vvvdp.exe 1380 jddjv.exe 628 xfllxrl.exe 548 9thbbn.exe 1524 1hthbn.exe 2100 vvvvp.exe 2400 xfrllff.exe 1084 nnnhbn.exe 336 hhhhtn.exe 2280 vpdjd.exe 1560 fxxfxfr.exe 2120 lfxllrf.exe 2568 5hbhht.exe 2716 jdvdv.exe 2380 ddvpj.exe 1908 flfrrrl.exe 2852 llfxrfl.exe 2892 ttnbbn.exe 2484 thhthn.exe 2980 jdppj.exe 2836 xlfrllf.exe 2796 7lxlflf.exe 2644 nhtnhn.exe 2636 hbtnhn.exe 2708 ddvjd.exe 2384 lxrrlrf.exe 2948 1ffffxr.exe 2920 3hntht.exe 2956 1bbbtt.exe 2040 ppdvd.exe 1872 1ddjd.exe 1944 7lllflf.exe 2996 xxlflrx.exe 1404 hbbtht.exe 844 hhbtnb.exe 2052 vddpd.exe 2552 jvdjv.exe 1476 fxlrrfr.exe 2532 5fxxrff.exe 1744 hbntth.exe 2204 3tnbhn.exe 1532 5jvdp.exe 1400 rrxlrfl.exe 1016 xxfflxf.exe -
resource yara_rule behavioral1/memory/2568-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/336-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-307-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2568 2136 56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe 30 PID 2136 wrote to memory of 2568 2136 56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe 30 PID 2136 wrote to memory of 2568 2136 56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe 30 PID 2136 wrote to memory of 2568 2136 56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe 30 PID 2568 wrote to memory of 792 2568 vvvvp.exe 31 PID 2568 wrote to memory of 792 2568 vvvvp.exe 31 PID 2568 wrote to memory of 792 2568 vvvvp.exe 31 PID 2568 wrote to memory of 792 2568 vvvvp.exe 31 PID 792 wrote to memory of 2196 792 3tbtbt.exe 32 PID 792 wrote to memory of 2196 792 3tbtbt.exe 32 PID 792 wrote to memory of 2196 792 3tbtbt.exe 32 PID 792 wrote to memory of 2196 792 3tbtbt.exe 32 PID 2196 wrote to memory of 2724 2196 7lxfrxr.exe 33 PID 2196 wrote to memory of 2724 2196 7lxfrxr.exe 33 PID 2196 wrote to memory of 2724 2196 7lxfrxr.exe 33 PID 2196 wrote to memory of 2724 2196 7lxfrxr.exe 33 PID 2724 wrote to memory of 2780 2724 1ttnbn.exe 34 PID 2724 wrote to memory of 2780 2724 1ttnbn.exe 34 PID 2724 wrote to memory of 2780 2724 1ttnbn.exe 34 PID 2724 wrote to memory of 2780 2724 1ttnbn.exe 34 PID 2780 wrote to memory of 2756 2780 jdvdj.exe 35 PID 2780 wrote to memory of 2756 2780 jdvdj.exe 35 PID 2780 wrote to memory of 2756 2780 jdvdj.exe 35 PID 2780 wrote to memory of 2756 2780 jdvdj.exe 35 PID 2756 wrote to memory of 2896 2756 vvpdj.exe 36 PID 2756 wrote to memory of 2896 2756 vvpdj.exe 36 PID 2756 wrote to memory of 2896 2756 vvpdj.exe 36 PID 2756 wrote to memory of 2896 2756 vvpdj.exe 36 PID 2896 wrote to memory of 2332 2896 rlfrlxl.exe 37 PID 2896 wrote to memory of 2332 2896 rlfrlxl.exe 37 PID 2896 wrote to memory of 2332 2896 rlfrlxl.exe 37 PID 2896 wrote to memory of 2332 2896 rlfrlxl.exe 37 PID 2332 wrote to memory of 2632 2332 ttntht.exe 38 PID 2332 wrote to memory of 2632 2332 ttntht.exe 38 PID 2332 wrote to memory of 2632 2332 ttntht.exe 38 PID 2332 wrote to memory of 2632 2332 ttntht.exe 38 PID 2632 wrote to memory of 808 2632 jjvdv.exe 39 PID 2632 wrote to memory of 808 2632 jjvdv.exe 39 PID 2632 wrote to memory of 808 2632 jjvdv.exe 39 PID 2632 wrote to memory of 808 2632 jjvdv.exe 39 PID 808 wrote to memory of 2304 808 5ffrlrr.exe 40 PID 808 wrote to memory of 2304 808 5ffrlrr.exe 40 PID 808 wrote to memory of 2304 808 5ffrlrr.exe 40 PID 808 wrote to memory of 2304 808 5ffrlrr.exe 40 PID 2304 wrote to memory of 1268 2304 bbnthn.exe 41 PID 2304 wrote to memory of 1268 2304 bbnthn.exe 41 PID 2304 wrote to memory of 1268 2304 bbnthn.exe 41 PID 2304 wrote to memory of 1268 2304 bbnthn.exe 41 PID 1268 wrote to memory of 2964 1268 bbtnbh.exe 42 PID 1268 wrote to memory of 2964 1268 bbtnbh.exe 42 PID 1268 wrote to memory of 2964 1268 bbtnbh.exe 42 PID 1268 wrote to memory of 2964 1268 bbtnbh.exe 42 PID 2964 wrote to memory of 2128 2964 ddpdv.exe 43 PID 2964 wrote to memory of 2128 2964 ddpdv.exe 43 PID 2964 wrote to memory of 2128 2964 ddpdv.exe 43 PID 2964 wrote to memory of 2128 2964 ddpdv.exe 43 PID 2128 wrote to memory of 1396 2128 3rrflrl.exe 44 PID 2128 wrote to memory of 1396 2128 3rrflrl.exe 44 PID 2128 wrote to memory of 1396 2128 3rrflrl.exe 44 PID 2128 wrote to memory of 1396 2128 3rrflrl.exe 44 PID 1396 wrote to memory of 2952 1396 nnbntn.exe 45 PID 1396 wrote to memory of 2952 1396 nnbntn.exe 45 PID 1396 wrote to memory of 2952 1396 nnbntn.exe 45 PID 1396 wrote to memory of 2952 1396 nnbntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\vvvvp.exec:\vvvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\3tbtbt.exec:\3tbtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\7lxfrxr.exec:\7lxfrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\1ttnbn.exec:\1ttnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jdvdj.exec:\jdvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vvpdj.exec:\vvpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rlfrlxl.exec:\rlfrlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ttntht.exec:\ttntht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\jjvdv.exec:\jjvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5ffrlrr.exec:\5ffrlrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\bbnthn.exec:\bbnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\bbtnbh.exec:\bbtnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\ddpdv.exec:\ddpdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\3rrflrl.exec:\3rrflrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\nnbntn.exec:\nnbntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\3bhnbn.exec:\3bhnbn.exe17⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vvjdj.exec:\vvjdj.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\pjdpj.exec:\pjdpj.exe19⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5xrxllx.exec:\5xrxllx.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hhthnb.exec:\hhthnb.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vvvdp.exec:\vvvdp.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jddjv.exec:\jddjv.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xfllxrl.exec:\xfllxrl.exe24⤵
- Executes dropped EXE
PID:628 -
\??\c:\9thbbn.exec:\9thbbn.exe25⤵
- Executes dropped EXE
PID:548 -
\??\c:\1hthbn.exec:\1hthbn.exe26⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vvvvp.exec:\vvvvp.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100 -
\??\c:\xfrllff.exec:\xfrllff.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nnnhbn.exec:\nnnhbn.exe29⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hhhhtn.exec:\hhhhtn.exe30⤵
- Executes dropped EXE
PID:336 -
\??\c:\vpdjd.exec:\vpdjd.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\fxxfxfr.exec:\fxxfxfr.exe32⤵
- Executes dropped EXE
PID:1560 -
\??\c:\lfxllrf.exec:\lfxllrf.exe33⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5hbhht.exec:\5hbhht.exe34⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jdvdv.exec:\jdvdv.exe35⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ddvpj.exec:\ddvpj.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\flfrrrl.exec:\flfrrrl.exe37⤵
- Executes dropped EXE
PID:1908 -
\??\c:\llfxrfl.exec:\llfxrfl.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ttnbbn.exec:\ttnbbn.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\thhthn.exec:\thhthn.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jdppj.exec:\jdppj.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xlfrllf.exec:\xlfrllf.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7lxlflf.exec:\7lxlflf.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nhtnhn.exec:\nhtnhn.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbtnhn.exec:\hbtnhn.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ddvjd.exec:\ddvjd.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lxrrlrf.exec:\lxrrlrf.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1ffffxr.exec:\1ffffxr.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3hntht.exec:\3hntht.exe49⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1bbbtt.exec:\1bbbtt.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ppdvd.exec:\ppdvd.exe51⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1ddjd.exec:\1ddjd.exe52⤵
- Executes dropped EXE
PID:1872 -
\??\c:\7lllflf.exec:\7lllflf.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xxlflrx.exec:\xxlflrx.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbbtht.exec:\hbbtht.exe55⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hhbtnb.exec:\hhbtnb.exe56⤵
- Executes dropped EXE
PID:844 -
\??\c:\vddpd.exec:\vddpd.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jvdjv.exec:\jvdjv.exe58⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxlrrfr.exec:\fxlrrfr.exe59⤵
- Executes dropped EXE
PID:1476 -
\??\c:\5fxxrff.exec:\5fxxrff.exe60⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbntth.exec:\hbntth.exe61⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3tnbhn.exec:\3tnbhn.exe62⤵
- Executes dropped EXE
PID:2204 -
\??\c:\5jvdp.exec:\5jvdp.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrxlrfl.exec:\rrxlrfl.exe64⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xxfflxf.exec:\xxfflxf.exe65⤵
- Executes dropped EXE
PID:1016 -
\??\c:\nhntnt.exec:\nhntnt.exe66⤵PID:2500
-
\??\c:\nbthth.exec:\nbthth.exe67⤵PID:1712
-
\??\c:\dvpdj.exec:\dvpdj.exe68⤵PID:1160
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe69⤵PID:744
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe70⤵PID:2272
-
\??\c:\9nbhtb.exec:\9nbhtb.exe71⤵PID:2016
-
\??\c:\nnhbth.exec:\nnhbth.exe72⤵PID:2544
-
\??\c:\vvvjp.exec:\vvvjp.exe73⤵PID:2564
-
\??\c:\ppdvj.exec:\ppdvj.exe74⤵PID:2420
-
\??\c:\rrlrxlx.exec:\rrlrxlx.exe75⤵PID:2568
-
\??\c:\7rlxlxl.exec:\7rlxlxl.exe76⤵PID:2716
-
\??\c:\tnhthn.exec:\tnhthn.exe77⤵PID:2504
-
\??\c:\pjjjp.exec:\pjjjp.exe78⤵PID:1908
-
\??\c:\1dvdp.exec:\1dvdp.exe79⤵PID:2736
-
\??\c:\lfflrrf.exec:\lfflrrf.exe80⤵PID:3008
-
\??\c:\xrxrxlx.exec:\xrxrxlx.exe81⤵PID:2788
-
\??\c:\tnnbth.exec:\tnnbth.exe82⤵PID:2980
-
\??\c:\nhtbbn.exec:\nhtbbn.exe83⤵PID:2804
-
\??\c:\7dvjd.exec:\7dvjd.exe84⤵PID:2828
-
\??\c:\xrlfxff.exec:\xrlfxff.exe85⤵PID:2644
-
\??\c:\lfllxxl.exec:\lfllxxl.exe86⤵PID:2636
-
\??\c:\9hnhth.exec:\9hnhth.exe87⤵PID:1912
-
\??\c:\9ththn.exec:\9ththn.exe88⤵PID:2384
-
\??\c:\vppvp.exec:\vppvp.exe89⤵PID:2372
-
\??\c:\vvvvd.exec:\vvvvd.exe90⤵PID:2920
-
\??\c:\fxfrxrx.exec:\fxfrxrx.exe91⤵PID:1828
-
\??\c:\frrfrff.exec:\frrfrff.exe92⤵PID:2040
-
\??\c:\bthhnt.exec:\bthhnt.exe93⤵PID:1936
-
\??\c:\bthntb.exec:\bthntb.exe94⤵PID:2952
-
\??\c:\vpvvp.exec:\vpvvp.exe95⤵PID:1256
-
\??\c:\rlxflxf.exec:\rlxflxf.exe96⤵PID:1404
-
\??\c:\xrrlrlr.exec:\xrrlrlr.exe97⤵PID:2168
-
\??\c:\9htbhn.exec:\9htbhn.exe98⤵PID:2052
-
\??\c:\hhtnth.exec:\hhtnth.exe99⤵PID:1796
-
\??\c:\3dvvv.exec:\3dvvv.exe100⤵PID:1476
-
\??\c:\ppjpp.exec:\ppjpp.exe101⤵PID:1380
-
\??\c:\ffrfxlr.exec:\ffrfxlr.exe102⤵PID:448
-
\??\c:\bthntb.exec:\bthntb.exe103⤵PID:376
-
\??\c:\bbtbbh.exec:\bbtbbh.exe104⤵PID:1532
-
\??\c:\vvvjj.exec:\vvvjj.exe105⤵PID:2348
-
\??\c:\vdjdv.exec:\vdjdv.exe106⤵PID:1016
-
\??\c:\xrrfxfr.exec:\xrrfxfr.exe107⤵PID:2500
-
\??\c:\xxxffrl.exec:\xxxffrl.exe108⤵PID:580
-
\??\c:\ttnnbt.exec:\ttnnbt.exe109⤵PID:2444
-
\??\c:\hnhhth.exec:\hnhhth.exe110⤵PID:744
-
\??\c:\1dvpd.exec:\1dvpd.exe111⤵PID:2272
-
\??\c:\7vjpp.exec:\7vjpp.exe112⤵PID:1560
-
\??\c:\llxffrl.exec:\llxffrl.exe113⤵PID:1612
-
\??\c:\xxllxxf.exec:\xxllxxf.exe114⤵PID:2564
-
\??\c:\thhbht.exec:\thhbht.exe115⤵PID:792
-
\??\c:\vvvvp.exec:\vvvvp.exe116⤵PID:2568
-
\??\c:\dvvdd.exec:\dvvdd.exe117⤵PID:2760
-
\??\c:\vvvpd.exec:\vvvpd.exe118⤵PID:2504
-
\??\c:\fllrxlx.exec:\fllrxlx.exe119⤵PID:2780
-
\??\c:\tttbnh.exec:\tttbnh.exe120⤵PID:2736
-
\??\c:\bbtnnh.exec:\bbtnnh.exe121⤵PID:3008
-
\??\c:\9ddpp.exec:\9ddpp.exe122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-