Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe
-
Size
234KB
-
MD5
0145eccfee0be8208e4645c1baa71a45
-
SHA1
55b4457c9ff5bdfe0348e7f2b83870549907a4d0
-
SHA256
14db0edec6e95cc9c19278329963a0700fbc9bbf16f4405ba67eb96e41b532c1
-
SHA512
52dfd8b6b2fb8c42eef5466a9c67ab0d6878f6fed9637c2dd3989551d1410a594ed62b1731933f3b6af18e8d5ecff5ce0c27ca5ad8005c513b40141aa3328ede
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QNVrAIwsYs:n3C9BRo7MlrWKo+l0r5wsYs
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2516-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1176-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2516 pvpdv.exe 2900 rlrxlxl.exe 864 jddpp.exe 2876 lxflrrx.exe 1456 bhhhtn.exe 3064 3lxlfrr.exe 2784 lfllflf.exe 2628 bthhnn.exe 2660 ddvpp.exe 2360 7rlxlrl.exe 1624 nnbnht.exe 2680 ppvdp.exe 1948 5ffrfrr.exe 2932 tbnnbb.exe 1832 pppdp.exe 2708 fxrxxfx.exe 2448 bnbnth.exe 792 7dvjd.exe 652 lrrfxxx.exe 1868 nnnhth.exe 1176 1pdpp.exe 1980 vvppv.exe 1152 tnhntt.exe 1360 3thbht.exe 1376 ddddp.exe 2488 nbhbnn.exe 2076 1lxlxfl.exe 2392 bthhnb.exe 2968 vpdpd.exe 900 1jdvj.exe 316 rxrfflx.exe 2516 nnthbn.exe 2800 vdvdp.exe 2228 xfrxrxr.exe 2716 nhbnhh.exe 2824 hthhnh.exe 2744 dvjjv.exe 2840 rfxrffr.exe 1456 rrrrrfl.exe 2656 hnthnn.exe 2780 vdjdj.exe 1620 pjpdp.exe 3056 fxllxlf.exe 1340 lxrflxf.exe 3036 bhbhtb.exe 1056 3hbntt.exe 1624 ddvjp.exe 1840 ffrffrr.exe 1104 rlxrlxl.exe 1880 btbttn.exe 1928 ttnbnt.exe 2376 5pjpj.exe 2708 jdvpv.exe 828 rlfxxxf.exe 324 7xxxfxl.exe 592 bbnthn.exe 1208 pdpvj.exe 624 5llrxrl.exe 2336 lrrxfrl.exe 2584 bthnnn.exe 1096 bbtnbh.exe 1876 5pvdd.exe 1532 dpjdv.exe 1260 xxlfrfx.exe -
resource yara_rule behavioral1/memory/2092-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1176-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-276-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2516 2092 0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe 30 PID 2092 wrote to memory of 2516 2092 0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe 30 PID 2092 wrote to memory of 2516 2092 0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe 30 PID 2092 wrote to memory of 2516 2092 0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe 30 PID 2516 wrote to memory of 2900 2516 pvpdv.exe 31 PID 2516 wrote to memory of 2900 2516 pvpdv.exe 31 PID 2516 wrote to memory of 2900 2516 pvpdv.exe 31 PID 2516 wrote to memory of 2900 2516 pvpdv.exe 31 PID 2900 wrote to memory of 864 2900 rlrxlxl.exe 32 PID 2900 wrote to memory of 864 2900 rlrxlxl.exe 32 PID 2900 wrote to memory of 864 2900 rlrxlxl.exe 32 PID 2900 wrote to memory of 864 2900 rlrxlxl.exe 32 PID 864 wrote to memory of 2876 864 jddpp.exe 33 PID 864 wrote to memory of 2876 864 jddpp.exe 33 PID 864 wrote to memory of 2876 864 jddpp.exe 33 PID 864 wrote to memory of 2876 864 jddpp.exe 33 PID 2876 wrote to memory of 1456 2876 lxflrrx.exe 34 PID 2876 wrote to memory of 1456 2876 lxflrrx.exe 34 PID 2876 wrote to memory of 1456 2876 lxflrrx.exe 34 PID 2876 wrote to memory of 1456 2876 lxflrrx.exe 34 PID 1456 wrote to memory of 3064 1456 bhhhtn.exe 35 PID 1456 wrote to memory of 3064 1456 bhhhtn.exe 35 PID 1456 wrote to memory of 3064 1456 bhhhtn.exe 35 PID 1456 wrote to memory of 3064 1456 bhhhtn.exe 35 PID 3064 wrote to memory of 2784 3064 3lxlfrr.exe 36 PID 3064 wrote to memory of 2784 3064 3lxlfrr.exe 36 PID 3064 wrote to memory of 2784 3064 3lxlfrr.exe 36 PID 3064 wrote to memory of 2784 3064 3lxlfrr.exe 36 PID 2784 wrote to memory of 2628 2784 lfllflf.exe 37 PID 2784 wrote to memory of 2628 2784 lfllflf.exe 37 PID 2784 wrote to memory of 2628 2784 lfllflf.exe 37 PID 2784 wrote to memory of 2628 2784 lfllflf.exe 37 PID 2628 wrote to memory of 2660 2628 bthhnn.exe 38 PID 2628 wrote to memory of 2660 2628 bthhnn.exe 38 PID 2628 wrote to memory of 2660 2628 bthhnn.exe 38 PID 2628 wrote to memory of 2660 2628 bthhnn.exe 38 PID 2660 wrote to memory of 2360 2660 ddvpp.exe 39 PID 2660 wrote to memory of 2360 2660 ddvpp.exe 39 PID 2660 wrote to memory of 2360 2660 ddvpp.exe 39 PID 2660 wrote to memory of 2360 2660 ddvpp.exe 39 PID 2360 wrote to memory of 1624 2360 7rlxlrl.exe 40 PID 2360 wrote to memory of 1624 2360 7rlxlrl.exe 40 PID 2360 wrote to memory of 1624 2360 7rlxlrl.exe 40 PID 2360 wrote to memory of 1624 2360 7rlxlrl.exe 40 PID 1624 wrote to memory of 2680 1624 nnbnht.exe 41 PID 1624 wrote to memory of 2680 1624 nnbnht.exe 41 PID 1624 wrote to memory of 2680 1624 nnbnht.exe 41 PID 1624 wrote to memory of 2680 1624 nnbnht.exe 41 PID 2680 wrote to memory of 1948 2680 ppvdp.exe 42 PID 2680 wrote to memory of 1948 2680 ppvdp.exe 42 PID 2680 wrote to memory of 1948 2680 ppvdp.exe 42 PID 2680 wrote to memory of 1948 2680 ppvdp.exe 42 PID 1948 wrote to memory of 2932 1948 5ffrfrr.exe 43 PID 1948 wrote to memory of 2932 1948 5ffrfrr.exe 43 PID 1948 wrote to memory of 2932 1948 5ffrfrr.exe 43 PID 1948 wrote to memory of 2932 1948 5ffrfrr.exe 43 PID 2932 wrote to memory of 1832 2932 tbnnbb.exe 44 PID 2932 wrote to memory of 1832 2932 tbnnbb.exe 44 PID 2932 wrote to memory of 1832 2932 tbnnbb.exe 44 PID 2932 wrote to memory of 1832 2932 tbnnbb.exe 44 PID 1832 wrote to memory of 2708 1832 pppdp.exe 45 PID 1832 wrote to memory of 2708 1832 pppdp.exe 45 PID 1832 wrote to memory of 2708 1832 pppdp.exe 45 PID 1832 wrote to memory of 2708 1832 pppdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pvpdv.exec:\pvpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rlrxlxl.exec:\rlrxlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jddpp.exec:\jddpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\lxflrrx.exec:\lxflrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\bhhhtn.exec:\bhhhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\3lxlfrr.exec:\3lxlfrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lfllflf.exec:\lfllflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bthhnn.exec:\bthhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\ddvpp.exec:\ddvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7rlxlrl.exec:\7rlxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\nnbnht.exec:\nnbnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ppvdp.exec:\ppvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5ffrfrr.exec:\5ffrfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\tbnnbb.exec:\tbnnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pppdp.exec:\pppdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe17⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bnbnth.exec:\bnbnth.exe18⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7dvjd.exec:\7dvjd.exe19⤵
- Executes dropped EXE
PID:792 -
\??\c:\lrrfxxx.exec:\lrrfxxx.exe20⤵
- Executes dropped EXE
PID:652 -
\??\c:\nnnhth.exec:\nnnhth.exe21⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1pdpp.exec:\1pdpp.exe22⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vvppv.exec:\vvppv.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tnhntt.exec:\tnhntt.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\3thbht.exec:\3thbht.exe25⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ddddp.exec:\ddddp.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\nbhbnn.exec:\nbhbnn.exe27⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1lxlxfl.exec:\1lxlxfl.exe28⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bthhnb.exec:\bthhnb.exe29⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vpdpd.exec:\vpdpd.exe30⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1jdvj.exec:\1jdvj.exe31⤵
- Executes dropped EXE
PID:900 -
\??\c:\rxrfflx.exec:\rxrfflx.exe32⤵
- Executes dropped EXE
PID:316 -
\??\c:\nnthbn.exec:\nnthbn.exe33⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vdvdp.exec:\vdvdp.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xfrxrxr.exec:\xfrxrxr.exe35⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nhbnhh.exec:\nhbnhh.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hthhnh.exec:\hthhnh.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dvjjv.exec:\dvjjv.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rfxrffr.exec:\rfxrffr.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rrrrrfl.exec:\rrrrrfl.exe40⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hnthnn.exec:\hnthnn.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vdjdj.exec:\vdjdj.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pjpdp.exec:\pjpdp.exe43⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fxllxlf.exec:\fxllxlf.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lxrflxf.exec:\lxrflxf.exe45⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bhbhtb.exec:\bhbhtb.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3hbntt.exec:\3hbntt.exe47⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ddvjp.exec:\ddvjp.exe48⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ffrffrr.exec:\ffrffrr.exe49⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rlxrlxl.exec:\rlxrlxl.exe50⤵
- Executes dropped EXE
PID:1104 -
\??\c:\btbttn.exec:\btbttn.exe51⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ttnbnt.exec:\ttnbnt.exe52⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5pjpj.exec:\5pjpj.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jdvpv.exec:\jdvpv.exe54⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe55⤵
- Executes dropped EXE
PID:828 -
\??\c:\7xxxfxl.exec:\7xxxfxl.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\bbnthn.exec:\bbnthn.exe57⤵
- Executes dropped EXE
PID:592 -
\??\c:\pdpvj.exec:\pdpvj.exe58⤵
- Executes dropped EXE
PID:1208 -
\??\c:\5llrxrl.exec:\5llrxrl.exe59⤵
- Executes dropped EXE
PID:624 -
\??\c:\lrrxfrl.exec:\lrrxfrl.exe60⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bthnnn.exec:\bthnnn.exe61⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbtnbh.exec:\bbtnbh.exe62⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5pvdd.exec:\5pvdd.exe63⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dpjdv.exec:\dpjdv.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xxlfrfx.exec:\xxlfrfx.exe65⤵
- Executes dropped EXE
PID:1260 -
\??\c:\thnhht.exec:\thnhht.exe66⤵PID:1500
-
\??\c:\ttnbnt.exec:\ttnbnt.exe67⤵PID:2172
-
\??\c:\jjjdp.exec:\jjjdp.exe68⤵PID:2452
-
\??\c:\9vvdp.exec:\9vvdp.exe69⤵PID:2392
-
\??\c:\lxllrlx.exec:\lxllrlx.exe70⤵PID:2012
-
\??\c:\hbbbnn.exec:\hbbbnn.exe71⤵PID:556
-
\??\c:\nnhhnt.exec:\nnhhnt.exe72⤵PID:2540
-
\??\c:\pdvvp.exec:\pdvvp.exe73⤵PID:1592
-
\??\c:\xrffxfl.exec:\xrffxfl.exe74⤵PID:2260
-
\??\c:\xfxrffr.exec:\xfxrffr.exe75⤵PID:2900
-
\??\c:\tnbnth.exec:\tnbnth.exe76⤵PID:2228
-
\??\c:\bttbth.exec:\bttbth.exe77⤵PID:2828
-
\??\c:\vpdjv.exec:\vpdjv.exe78⤵PID:2292
-
\??\c:\jvdjv.exec:\jvdjv.exe79⤵PID:2884
-
\??\c:\ffrxrfr.exec:\ffrxrfr.exe80⤵PID:2632
-
\??\c:\hbhntt.exec:\hbhntt.exe81⤵PID:2832
-
\??\c:\nnbtnb.exec:\nnbtnb.exe82⤵PID:2668
-
\??\c:\3dvjv.exec:\3dvjv.exe83⤵PID:1760
-
\??\c:\xrfrxrx.exec:\xrfrxrx.exe84⤵PID:1864
-
\??\c:\lrxrlfr.exec:\lrxrlfr.exe85⤵PID:2940
-
\??\c:\tnbhtt.exec:\tnbhtt.exe86⤵PID:1236
-
\??\c:\hhbhbt.exec:\hhbhbt.exe87⤵PID:3036
-
\??\c:\dddjv.exec:\dddjv.exe88⤵PID:1268
-
\??\c:\vpjpp.exec:\vpjpp.exe89⤵PID:2144
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe90⤵PID:1448
-
\??\c:\3rlrrxl.exec:\3rlrrxl.exe91⤵PID:3032
-
\??\c:\tbthth.exec:\tbthth.exe92⤵PID:2052
-
\??\c:\9vpvd.exec:\9vpvd.exe93⤵PID:2460
-
\??\c:\vvppj.exec:\vvppj.exe94⤵PID:2376
-
\??\c:\lllxfrl.exec:\lllxfrl.exe95⤵PID:1640
-
\??\c:\fllfflf.exec:\fllfflf.exe96⤵PID:264
-
\??\c:\tbhnnn.exec:\tbhnnn.exe97⤵PID:2972
-
\??\c:\9vdjv.exec:\9vdjv.exe98⤵PID:1336
-
\??\c:\pjdvv.exec:\pjdvv.exe99⤵PID:1208
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe100⤵PID:2340
-
\??\c:\9llxxlf.exec:\9llxxlf.exe101⤵PID:2336
-
\??\c:\7tbbhh.exec:\7tbbhh.exe102⤵PID:2576
-
\??\c:\9ddpj.exec:\9ddpj.exe103⤵PID:2504
-
\??\c:\ppjdp.exec:\ppjdp.exe104⤵PID:1668
-
\??\c:\rlflfff.exec:\rlflfff.exe105⤵PID:2156
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe106⤵PID:1316
-
\??\c:\nnnbbn.exec:\nnnbbn.exe107⤵PID:1500
-
\??\c:\htntbh.exec:\htntbh.exe108⤵
- System Location Discovery: System Language Discovery
PID:2332 -
\??\c:\7dvjj.exec:\7dvjj.exe109⤵PID:2452
-
\??\c:\rrlrffr.exec:\rrlrffr.exe110⤵PID:2160
-
\??\c:\rllxrff.exec:\rllxrff.exe111⤵PID:2112
-
\??\c:\hhnbtt.exec:\hhnbtt.exe112⤵PID:2204
-
\??\c:\hbbnbh.exec:\hbbnbh.exe113⤵PID:1672
-
\??\c:\jjpjv.exec:\jjpjv.exe114⤵PID:2080
-
\??\c:\dpdjd.exec:\dpdjd.exe115⤵PID:2952
-
\??\c:\xrxxffr.exec:\xrxxffr.exe116⤵PID:2756
-
\??\c:\3bhbbb.exec:\3bhbbb.exe117⤵PID:2820
-
\??\c:\ntbntb.exec:\ntbntb.exe118⤵PID:2836
-
\??\c:\pvjdp.exec:\pvjdp.exe119⤵PID:2852
-
\??\c:\flxllxf.exec:\flxllxf.exe120⤵PID:2128
-
\??\c:\xxflfll.exec:\xxflfll.exe121⤵PID:2188
-
\??\c:\bbthth.exec:\bbthth.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-