Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0137c659077f481a20e5951b5f319abd_JaffaCakes118.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
0137c659077f481a20e5951b5f319abd_JaffaCakes118.exe
-
Size
136KB
-
MD5
0137c659077f481a20e5951b5f319abd
-
SHA1
dd23c8c1f62b09a2dbed7beaab9e66c425a4a9ce
-
SHA256
11816f15de585c344773798081be6b1253b779c641bf4182e6e58e9a6061d191
-
SHA512
360e196eb269c3b1541981eb1caa378e546a1573f974394055218644021ab34044e32f33b58c656f610efd03f5881e37249565c20f374af824f5fe8d54b8c37a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoH/lQa:n3C9BRW0j/1px+dGkdQa
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral2/memory/5040-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1096 lxfrrlr.exe 4136 rrrlfrr.exe 2624 ntbbbt.exe 1576 xfxxrrl.exe 2992 5xrrlfx.exe 1168 htttnh.exe 1556 lrrrxxf.exe 1296 hnbbhn.exe 3900 1pppp.exe 3416 rrlxxrx.exe 1948 bhnnhh.exe 2964 ddvpp.exe 4516 xrxxrll.exe 4316 tthhnn.exe 3008 vpvpj.exe 2704 rllrrfx.exe 3668 ttbtbb.exe 1164 jdjdp.exe 3836 lrllxfl.exe 3200 ttttnt.exe 2488 pvddd.exe 4480 jpddd.exe 3904 lxrlrrl.exe 2480 hnhnbn.exe 1852 btbtbb.exe 1872 dvpvp.exe 2792 nnthbn.exe 2396 vdddv.exe 1316 rfrlllx.exe 3424 rlxxlfx.exe 4072 tthtnt.exe 1472 vjvdp.exe 1460 rlxrfff.exe 384 hbhnhh.exe 996 jdddv.exe 3084 rflxfxx.exe 704 hhhbbh.exe 3504 tthhht.exe 5088 dpppp.exe 4416 flxflxf.exe 4636 rlxxfxl.exe 2512 tnttbh.exe 3332 rlfxrrr.exe 848 hntttt.exe 3000 xxfrxrf.exe 2996 frfflll.exe 900 nnbthn.exe 1592 7xfxrrr.exe 220 hnnnbh.exe 3144 9jpjd.exe 1296 frfxlfr.exe 3528 lfrrflx.exe 4212 hbbthh.exe 4832 vvddd.exe 2964 pdvvd.exe 1972 lfrxrxf.exe 3168 5bthnn.exe 1820 pdjdd.exe 3312 fffflrr.exe 3668 tnhbtt.exe 428 bbnhnh.exe 3836 dppdv.exe 440 ddppv.exe 2560 5rxfrxx.exe -
resource yara_rule behavioral2/memory/5040-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 1096 5040 0137c659077f481a20e5951b5f319abd_JaffaCakes118.exe 83 PID 5040 wrote to memory of 1096 5040 0137c659077f481a20e5951b5f319abd_JaffaCakes118.exe 83 PID 5040 wrote to memory of 1096 5040 0137c659077f481a20e5951b5f319abd_JaffaCakes118.exe 83 PID 1096 wrote to memory of 4136 1096 lxfrrlr.exe 84 PID 1096 wrote to memory of 4136 1096 lxfrrlr.exe 84 PID 1096 wrote to memory of 4136 1096 lxfrrlr.exe 84 PID 4136 wrote to memory of 2624 4136 rrrlfrr.exe 85 PID 4136 wrote to memory of 2624 4136 rrrlfrr.exe 85 PID 4136 wrote to memory of 2624 4136 rrrlfrr.exe 85 PID 2624 wrote to memory of 1576 2624 ntbbbt.exe 86 PID 2624 wrote to memory of 1576 2624 ntbbbt.exe 86 PID 2624 wrote to memory of 1576 2624 ntbbbt.exe 86 PID 1576 wrote to memory of 2992 1576 xfxxrrl.exe 87 PID 1576 wrote to memory of 2992 1576 xfxxrrl.exe 87 PID 1576 wrote to memory of 2992 1576 xfxxrrl.exe 87 PID 2992 wrote to memory of 1168 2992 5xrrlfx.exe 88 PID 2992 wrote to memory of 1168 2992 5xrrlfx.exe 88 PID 2992 wrote to memory of 1168 2992 5xrrlfx.exe 88 PID 1168 wrote to memory of 1556 1168 htttnh.exe 89 PID 1168 wrote to memory of 1556 1168 htttnh.exe 89 PID 1168 wrote to memory of 1556 1168 htttnh.exe 89 PID 1556 wrote to memory of 1296 1556 lrrrxxf.exe 90 PID 1556 wrote to memory of 1296 1556 lrrrxxf.exe 90 PID 1556 wrote to memory of 1296 1556 lrrrxxf.exe 90 PID 1296 wrote to memory of 3900 1296 hnbbhn.exe 91 PID 1296 wrote to memory of 3900 1296 hnbbhn.exe 91 PID 1296 wrote to memory of 3900 1296 hnbbhn.exe 91 PID 3900 wrote to memory of 3416 3900 1pppp.exe 92 PID 3900 wrote to memory of 3416 3900 1pppp.exe 92 PID 3900 wrote to memory of 3416 3900 1pppp.exe 92 PID 3416 wrote to memory of 1948 3416 rrlxxrx.exe 93 PID 3416 wrote to memory of 1948 3416 rrlxxrx.exe 93 PID 3416 wrote to memory of 1948 3416 rrlxxrx.exe 93 PID 1948 wrote to memory of 2964 1948 bhnnhh.exe 94 PID 1948 wrote to memory of 2964 1948 bhnnhh.exe 94 PID 1948 wrote to memory of 2964 1948 bhnnhh.exe 94 PID 2964 wrote to memory of 4516 2964 ddvpp.exe 95 PID 2964 wrote to memory of 4516 2964 ddvpp.exe 95 PID 2964 wrote to memory of 4516 2964 ddvpp.exe 95 PID 4516 wrote to memory of 4316 4516 xrxxrll.exe 96 PID 4516 wrote to memory of 4316 4516 xrxxrll.exe 96 PID 4516 wrote to memory of 4316 4516 xrxxrll.exe 96 PID 4316 wrote to memory of 3008 4316 tthhnn.exe 97 PID 4316 wrote to memory of 3008 4316 tthhnn.exe 97 PID 4316 wrote to memory of 3008 4316 tthhnn.exe 97 PID 3008 wrote to memory of 2704 3008 vpvpj.exe 98 PID 3008 wrote to memory of 2704 3008 vpvpj.exe 98 PID 3008 wrote to memory of 2704 3008 vpvpj.exe 98 PID 2704 wrote to memory of 3668 2704 rllrrfx.exe 99 PID 2704 wrote to memory of 3668 2704 rllrrfx.exe 99 PID 2704 wrote to memory of 3668 2704 rllrrfx.exe 99 PID 3668 wrote to memory of 1164 3668 ttbtbb.exe 100 PID 3668 wrote to memory of 1164 3668 ttbtbb.exe 100 PID 3668 wrote to memory of 1164 3668 ttbtbb.exe 100 PID 1164 wrote to memory of 3836 1164 jdjdp.exe 101 PID 1164 wrote to memory of 3836 1164 jdjdp.exe 101 PID 1164 wrote to memory of 3836 1164 jdjdp.exe 101 PID 3836 wrote to memory of 3200 3836 lrllxfl.exe 102 PID 3836 wrote to memory of 3200 3836 lrllxfl.exe 102 PID 3836 wrote to memory of 3200 3836 lrllxfl.exe 102 PID 3200 wrote to memory of 2488 3200 ttttnt.exe 103 PID 3200 wrote to memory of 2488 3200 ttttnt.exe 103 PID 3200 wrote to memory of 2488 3200 ttttnt.exe 103 PID 2488 wrote to memory of 4480 2488 pvddd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0137c659077f481a20e5951b5f319abd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0137c659077f481a20e5951b5f319abd_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\lxfrrlr.exec:\lxfrrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\rrrlfrr.exec:\rrrlfrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\ntbbbt.exec:\ntbbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\5xrrlfx.exec:\5xrrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\htttnh.exec:\htttnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\lrrrxxf.exec:\lrrrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\hnbbhn.exec:\hnbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\1pppp.exec:\1pppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\rrlxxrx.exec:\rrlxxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\bhnnhh.exec:\bhnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\ddvpp.exec:\ddvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xrxxrll.exec:\xrxxrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\tthhnn.exec:\tthhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\vpvpj.exec:\vpvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rllrrfx.exec:\rllrrfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\ttbtbb.exec:\ttbtbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\jdjdp.exec:\jdjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\lrllxfl.exec:\lrllxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\ttttnt.exec:\ttttnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\pvddd.exec:\pvddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jpddd.exec:\jpddd.exe23⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lxrlrrl.exec:\lxrlrrl.exe24⤵
- Executes dropped EXE
PID:3904 -
\??\c:\hnhnbn.exec:\hnhnbn.exe25⤵
- Executes dropped EXE
PID:2480 -
\??\c:\btbtbb.exec:\btbtbb.exe26⤵
- Executes dropped EXE
PID:1852 -
\??\c:\dvpvp.exec:\dvpvp.exe27⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nnthbn.exec:\nnthbn.exe28⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vdddv.exec:\vdddv.exe29⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rfrlllx.exec:\rfrlllx.exe30⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rlxxlfx.exec:\rlxxlfx.exe31⤵
- Executes dropped EXE
PID:3424 -
\??\c:\tthtnt.exec:\tthtnt.exe32⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vjvdp.exec:\vjvdp.exe33⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rlxrfff.exec:\rlxrfff.exe34⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hbhnhh.exec:\hbhnhh.exe35⤵
- Executes dropped EXE
PID:384 -
\??\c:\jdddv.exec:\jdddv.exe36⤵
- Executes dropped EXE
PID:996 -
\??\c:\rflxfxx.exec:\rflxfxx.exe37⤵
- Executes dropped EXE
PID:3084 -
\??\c:\hhhbbh.exec:\hhhbbh.exe38⤵
- Executes dropped EXE
PID:704 -
\??\c:\tthhht.exec:\tthhht.exe39⤵
- Executes dropped EXE
PID:3504 -
\??\c:\dpppp.exec:\dpppp.exe40⤵
- Executes dropped EXE
PID:5088 -
\??\c:\flxflxf.exec:\flxflxf.exe41⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rlxxfxl.exec:\rlxxfxl.exe42⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tnttbh.exec:\tnttbh.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe44⤵
- Executes dropped EXE
PID:3332 -
\??\c:\hntttt.exec:\hntttt.exe45⤵
- Executes dropped EXE
PID:848 -
\??\c:\xxfrxrf.exec:\xxfrxrf.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\frfflll.exec:\frfflll.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nnbthn.exec:\nnbthn.exe48⤵
- Executes dropped EXE
PID:900 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hnnnbh.exec:\hnnnbh.exe50⤵
- Executes dropped EXE
PID:220 -
\??\c:\9jpjd.exec:\9jpjd.exe51⤵
- Executes dropped EXE
PID:3144 -
\??\c:\frfxlfr.exec:\frfxlfr.exe52⤵
- Executes dropped EXE
PID:1296 -
\??\c:\lfrrflx.exec:\lfrrflx.exe53⤵
- Executes dropped EXE
PID:3528 -
\??\c:\hbbthh.exec:\hbbthh.exe54⤵
- Executes dropped EXE
PID:4212 -
\??\c:\vvddd.exec:\vvddd.exe55⤵
- Executes dropped EXE
PID:4832 -
\??\c:\pdvvd.exec:\pdvvd.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfrxrxf.exec:\lfrxrxf.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5bthnn.exec:\5bthnn.exe58⤵
- Executes dropped EXE
PID:3168 -
\??\c:\pdjdd.exec:\pdjdd.exe59⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fffflrr.exec:\fffflrr.exe60⤵
- Executes dropped EXE
PID:3312 -
\??\c:\tnhbtt.exec:\tnhbtt.exe61⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bbnhnh.exec:\bbnhnh.exe62⤵
- Executes dropped EXE
PID:428 -
\??\c:\dppdv.exec:\dppdv.exe63⤵
- Executes dropped EXE
PID:3836 -
\??\c:\ddppv.exec:\ddppv.exe64⤵
- Executes dropped EXE
PID:440 -
\??\c:\5rxfrxx.exec:\5rxfrxx.exe65⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nnbhnt.exec:\nnbhnt.exe66⤵PID:4104
-
\??\c:\nbbbbb.exec:\nbbbbb.exe67⤵PID:1048
-
\??\c:\vdjpp.exec:\vdjpp.exe68⤵
- System Location Discovery: System Language Discovery
PID:3904 -
\??\c:\llffffl.exec:\llffffl.exe69⤵PID:2384
-
\??\c:\nbnbbh.exec:\nbnbbh.exe70⤵PID:4572
-
\??\c:\nttbtn.exec:\nttbtn.exe71⤵PID:4576
-
\??\c:\vjjdd.exec:\vjjdd.exe72⤵PID:888
-
\??\c:\xfflfff.exec:\xfflfff.exe73⤵PID:1216
-
\??\c:\xxxlxll.exec:\xxxlxll.exe74⤵PID:1632
-
\??\c:\hbbtnn.exec:\hbbtnn.exe75⤵PID:1012
-
\??\c:\vjpjd.exec:\vjpjd.exe76⤵PID:5004
-
\??\c:\jjvdj.exec:\jjvdj.exe77⤵PID:4876
-
\??\c:\flxfxfl.exec:\flxfxfl.exe78⤵PID:3868
-
\??\c:\hhnttb.exec:\hhnttb.exe79⤵PID:2436
-
\??\c:\nntbnb.exec:\nntbnb.exe80⤵PID:2080
-
\??\c:\jddvv.exec:\jddvv.exe81⤵PID:4848
-
\??\c:\fflxlrr.exec:\fflxlrr.exe82⤵PID:4852
-
\??\c:\rxrrlxl.exec:\rxrrlxl.exe83⤵PID:1924
-
\??\c:\bnnnhh.exec:\bnnnhh.exe84⤵PID:640
-
\??\c:\bnnhbt.exec:\bnnhbt.exe85⤵PID:4356
-
\??\c:\dpdjd.exec:\dpdjd.exe86⤵PID:5088
-
\??\c:\vdjdp.exec:\vdjdp.exe87⤵PID:5036
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe88⤵PID:4636
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe89⤵PID:4132
-
\??\c:\bthhhh.exec:\bthhhh.exe90⤵PID:2624
-
\??\c:\vddjj.exec:\vddjj.exe91⤵PID:4088
-
\??\c:\1jdjp.exec:\1jdjp.exe92⤵
- System Location Discovery: System Language Discovery
PID:3000 -
\??\c:\7lrfxxr.exec:\7lrfxxr.exe93⤵
- System Location Discovery: System Language Discovery
PID:3680 -
\??\c:\thhhth.exec:\thhhth.exe94⤵PID:3220
-
\??\c:\7tthnb.exec:\7tthnb.exe95⤵PID:4816
-
\??\c:\vddpj.exec:\vddpj.exe96⤵PID:3480
-
\??\c:\djppp.exec:\djppp.exe97⤵PID:2940
-
\??\c:\frffrxr.exec:\frffrxr.exe98⤵PID:4400
-
\??\c:\flxlrxr.exec:\flxlrxr.exe99⤵PID:3104
-
\??\c:\hhhtnb.exec:\hhhtnb.exe100⤵PID:2144
-
\??\c:\dvdpj.exec:\dvdpj.exe101⤵PID:2316
-
\??\c:\jdvdp.exec:\jdvdp.exe102⤵PID:3980
-
\??\c:\5lrrlll.exec:\5lrrlll.exe103⤵PID:4432
-
\??\c:\frrxxxx.exec:\frrxxxx.exe104⤵PID:2756
-
\??\c:\hnnhnt.exec:\hnnhnt.exe105⤵PID:5056
-
\??\c:\ddpvj.exec:\ddpvj.exe106⤵PID:5012
-
\??\c:\vdppp.exec:\vdppp.exe107⤵PID:3204
-
\??\c:\lflfrxf.exec:\lflfrxf.exe108⤵PID:4480
-
\??\c:\tntbbn.exec:\tntbbn.exe109⤵PID:1320
-
\??\c:\ntbbbt.exec:\ntbbbt.exe110⤵PID:1608
-
\??\c:\9jdvv.exec:\9jdvv.exe111⤵PID:4920
-
\??\c:\rxxllxr.exec:\rxxllxr.exe112⤵PID:312
-
\??\c:\nbtbtt.exec:\nbtbtt.exe113⤵
- System Location Discovery: System Language Discovery
PID:5008 -
\??\c:\btbbnh.exec:\btbbnh.exe114⤵PID:3884
-
\??\c:\pvjpj.exec:\pvjpj.exe115⤵PID:1604
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe116⤵PID:2244
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe117⤵PID:4896
-
\??\c:\htnhtt.exec:\htnhtt.exe118⤵PID:3212
-
\??\c:\jpjvj.exec:\jpjvj.exe119⤵PID:2320
-
\??\c:\5pppj.exec:\5pppj.exe120⤵PID:4072
-
\??\c:\bbttbt.exec:\bbttbt.exe121⤵PID:448
-
\??\c:\vdvvj.exec:\vdvvj.exe122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-