Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe
-
Size
75KB
-
MD5
0174b93ab08c055273c5e126421e18ee
-
SHA1
52a91934614d6e07925b0cb8c4fde5bb831b25ce
-
SHA256
a1d88bfc96adeae6cc6430ac63b3482d035d859010b64c765b73617b22901ca9
-
SHA512
165ea6925e7baf2a7529e5fca13c29bd008883bbf404dc93160fb03342bfaaa4a5c938d9e6dfa006ec3b34708a4ad94178fa3741ad27c82940510012d04254de
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfotGpSy5wAP:ymb3NkkiQ3mdBjFWXkj7afowp7DP
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/2312-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 hbnthh.exe 1804 9jpjd.exe 2700 5ddpj.exe 2828 ntnthb.exe 2732 pdjpd.exe 2940 xxfxfff.exe 2636 tbttbb.exe 2616 thhnbh.exe 1728 jjjjp.exe 836 lrrlflf.exe 2008 rxfxrrr.exe 1724 bbhhtt.exe 2676 djdvv.exe 1168 lrrxllr.exe 2040 xlrxlrx.exe 1928 tthtbt.exe 2868 dpdjv.exe 2196 jjjvj.exe 2276 nhbnbh.exe 2212 hntnbb.exe 1132 jpvdp.exe 2020 lflffrf.exe 2284 fflrxxf.exe 840 hbhhnt.exe 908 djdjd.exe 2092 vdjjp.exe 3068 fffxrfr.exe 1496 bbnbhn.exe 2956 vjpdp.exe 2300 ppdjd.exe 2012 lrlxrxl.exe 1712 hhtbnt.exe 2516 nnbtht.exe 2792 7vvdj.exe 2748 dvjvv.exe 2700 frxrffr.exe 2740 ntbntt.exe 2964 3nhntn.exe 2848 jjjjv.exe 2412 vddjd.exe 2632 lxffxrf.exe 2680 3xrxrrf.exe 2656 flflrrx.exe 1732 bbhnbn.exe 1576 pvvdv.exe 1828 vdvjj.exe 2324 lrlrlll.exe 1800 xxrrrfr.exe 1636 fxfrxxf.exe 1748 nhtbhn.exe 548 jpdvj.exe 2928 vddpv.exe 2216 vdddp.exe 2788 xfrlrll.exe 2464 3ttbnt.exe 1088 ppvjd.exe 1144 dpvdj.exe 3060 3fxlfrf.exe 948 bhhbth.exe 2020 tbnbhb.exe 2420 pdvdp.exe 344 vjvjv.exe 2584 frxxfrl.exe 2372 rrfrlrl.exe -
resource yara_rule behavioral1/memory/2312-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1132-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2312 2052 0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe 31 PID 2052 wrote to memory of 2312 2052 0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe 31 PID 2052 wrote to memory of 2312 2052 0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe 31 PID 2052 wrote to memory of 2312 2052 0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe 31 PID 2312 wrote to memory of 1804 2312 hbnthh.exe 32 PID 2312 wrote to memory of 1804 2312 hbnthh.exe 32 PID 2312 wrote to memory of 1804 2312 hbnthh.exe 32 PID 2312 wrote to memory of 1804 2312 hbnthh.exe 32 PID 1804 wrote to memory of 2700 1804 9jpjd.exe 33 PID 1804 wrote to memory of 2700 1804 9jpjd.exe 33 PID 1804 wrote to memory of 2700 1804 9jpjd.exe 33 PID 1804 wrote to memory of 2700 1804 9jpjd.exe 33 PID 2700 wrote to memory of 2828 2700 5ddpj.exe 34 PID 2700 wrote to memory of 2828 2700 5ddpj.exe 34 PID 2700 wrote to memory of 2828 2700 5ddpj.exe 34 PID 2700 wrote to memory of 2828 2700 5ddpj.exe 34 PID 2828 wrote to memory of 2732 2828 ntnthb.exe 35 PID 2828 wrote to memory of 2732 2828 ntnthb.exe 35 PID 2828 wrote to memory of 2732 2828 ntnthb.exe 35 PID 2828 wrote to memory of 2732 2828 ntnthb.exe 35 PID 2732 wrote to memory of 2940 2732 pdjpd.exe 36 PID 2732 wrote to memory of 2940 2732 pdjpd.exe 36 PID 2732 wrote to memory of 2940 2732 pdjpd.exe 36 PID 2732 wrote to memory of 2940 2732 pdjpd.exe 36 PID 2940 wrote to memory of 2636 2940 xxfxfff.exe 37 PID 2940 wrote to memory of 2636 2940 xxfxfff.exe 37 PID 2940 wrote to memory of 2636 2940 xxfxfff.exe 37 PID 2940 wrote to memory of 2636 2940 xxfxfff.exe 37 PID 2636 wrote to memory of 2616 2636 tbttbb.exe 38 PID 2636 wrote to memory of 2616 2636 tbttbb.exe 38 PID 2636 wrote to memory of 2616 2636 tbttbb.exe 38 PID 2636 wrote to memory of 2616 2636 tbttbb.exe 38 PID 2616 wrote to memory of 1728 2616 thhnbh.exe 39 PID 2616 wrote to memory of 1728 2616 thhnbh.exe 39 PID 2616 wrote to memory of 1728 2616 thhnbh.exe 39 PID 2616 wrote to memory of 1728 2616 thhnbh.exe 39 PID 1728 wrote to memory of 836 1728 jjjjp.exe 40 PID 1728 wrote to memory of 836 1728 jjjjp.exe 40 PID 1728 wrote to memory of 836 1728 jjjjp.exe 40 PID 1728 wrote to memory of 836 1728 jjjjp.exe 40 PID 836 wrote to memory of 2008 836 lrrlflf.exe 41 PID 836 wrote to memory of 2008 836 lrrlflf.exe 41 PID 836 wrote to memory of 2008 836 lrrlflf.exe 41 PID 836 wrote to memory of 2008 836 lrrlflf.exe 41 PID 2008 wrote to memory of 1724 2008 rxfxrrr.exe 42 PID 2008 wrote to memory of 1724 2008 rxfxrrr.exe 42 PID 2008 wrote to memory of 1724 2008 rxfxrrr.exe 42 PID 2008 wrote to memory of 1724 2008 rxfxrrr.exe 42 PID 1724 wrote to memory of 2676 1724 bbhhtt.exe 43 PID 1724 wrote to memory of 2676 1724 bbhhtt.exe 43 PID 1724 wrote to memory of 2676 1724 bbhhtt.exe 43 PID 1724 wrote to memory of 2676 1724 bbhhtt.exe 43 PID 2676 wrote to memory of 1168 2676 djdvv.exe 44 PID 2676 wrote to memory of 1168 2676 djdvv.exe 44 PID 2676 wrote to memory of 1168 2676 djdvv.exe 44 PID 2676 wrote to memory of 1168 2676 djdvv.exe 44 PID 1168 wrote to memory of 2040 1168 lrrxllr.exe 45 PID 1168 wrote to memory of 2040 1168 lrrxllr.exe 45 PID 1168 wrote to memory of 2040 1168 lrrxllr.exe 45 PID 1168 wrote to memory of 2040 1168 lrrxllr.exe 45 PID 2040 wrote to memory of 1928 2040 xlrxlrx.exe 46 PID 2040 wrote to memory of 1928 2040 xlrxlrx.exe 46 PID 2040 wrote to memory of 1928 2040 xlrxlrx.exe 46 PID 2040 wrote to memory of 1928 2040 xlrxlrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\hbnthh.exec:\hbnthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\9jpjd.exec:\9jpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\5ddpj.exec:\5ddpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ntnthb.exec:\ntnthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\pdjpd.exec:\pdjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xxfxfff.exec:\xxfxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\tbttbb.exec:\tbttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\thhnbh.exec:\thhnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jjjjp.exec:\jjjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\lrrlflf.exec:\lrrlflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bbhhtt.exec:\bbhhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\djdvv.exec:\djdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lrrxllr.exec:\lrrxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\xlrxlrx.exec:\xlrxlrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\tthtbt.exec:\tthtbt.exe17⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dpdjv.exec:\dpdjv.exe18⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjjvj.exec:\jjjvj.exe19⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nhbnbh.exec:\nhbnbh.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hntnbb.exec:\hntnbb.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jpvdp.exec:\jpvdp.exe22⤵
- Executes dropped EXE
PID:1132 -
\??\c:\lflffrf.exec:\lflffrf.exe23⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fflrxxf.exec:\fflrxxf.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hbhhnt.exec:\hbhhnt.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\djdjd.exec:\djdjd.exe26⤵
- Executes dropped EXE
PID:908 -
\??\c:\vdjjp.exec:\vdjjp.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fffxrfr.exec:\fffxrfr.exe28⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bbnbhn.exec:\bbnbhn.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vjpdp.exec:\vjpdp.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ppdjd.exec:\ppdjd.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lrlxrxl.exec:\lrlxrxl.exe32⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hhtbnt.exec:\hhtbnt.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\nnbtht.exec:\nnbtht.exe34⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7vvdj.exec:\7vvdj.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dvjvv.exec:\dvjvv.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\frxrffr.exec:\frxrffr.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ntbntt.exec:\ntbntt.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3nhntn.exec:\3nhntn.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jjjjv.exec:\jjjjv.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vddjd.exec:\vddjd.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lxffxrf.exec:\lxffxrf.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3xrxrrf.exec:\3xrxrrf.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\flflrrx.exec:\flflrrx.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbhnbn.exec:\bbhnbn.exe45⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pvvdv.exec:\pvvdv.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vdvjj.exec:\vdvjj.exe47⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lrlrlll.exec:\lrlrlll.exe48⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xxrrrfr.exec:\xxrrrfr.exe49⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxfrxxf.exec:\fxfrxxf.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhtbhn.exec:\nhtbhn.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jpdvj.exec:\jpdvj.exe52⤵
- Executes dropped EXE
PID:548 -
\??\c:\vddpv.exec:\vddpv.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vdddp.exec:\vdddp.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xfrlrll.exec:\xfrlrll.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3ttbnt.exec:\3ttbnt.exe56⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ppvjd.exec:\ppvjd.exe57⤵
- Executes dropped EXE
PID:1088 -
\??\c:\dpvdj.exec:\dpvdj.exe58⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3fxlfrf.exec:\3fxlfrf.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhhbth.exec:\bhhbth.exe60⤵
- Executes dropped EXE
PID:948 -
\??\c:\tbnbhb.exec:\tbnbhb.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pdvdp.exec:\pdvdp.exe62⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vjvjv.exec:\vjvjv.exe63⤵
- Executes dropped EXE
PID:344 -
\??\c:\frxxfrl.exec:\frxxfrl.exe64⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrfrlrl.exec:\rrfrlrl.exe65⤵
- Executes dropped EXE
PID:2372 -
\??\c:\thhnbb.exec:\thhnbb.exe66⤵PID:2092
-
\??\c:\bnntnt.exec:\bnntnt.exe67⤵PID:1152
-
\??\c:\nnbbbh.exec:\nnbbbh.exe68⤵PID:892
-
\??\c:\jjdpp.exec:\jjdpp.exe69⤵PID:2340
-
\??\c:\lxxrllx.exec:\lxxrllx.exe70⤵PID:1880
-
\??\c:\xxrxfrx.exec:\xxrxfrx.exe71⤵PID:2300
-
\??\c:\thtbhb.exec:\thtbhb.exe72⤵PID:2552
-
\??\c:\nhtnhn.exec:\nhtnhn.exe73⤵PID:2348
-
\??\c:\pvpjd.exec:\pvpjd.exe74⤵PID:2084
-
\??\c:\9vpvp.exec:\9vpvp.exe75⤵PID:2716
-
\??\c:\1rlllrf.exec:\1rlllrf.exe76⤵PID:2820
-
\??\c:\rrflrxl.exec:\rrflrxl.exe77⤵PID:2752
-
\??\c:\tnnbth.exec:\tnnbth.exe78⤵PID:2828
-
\??\c:\dpjdj.exec:\dpjdj.exe79⤵PID:2852
-
\??\c:\ddddv.exec:\ddddv.exe80⤵PID:2624
-
\??\c:\xlrllxf.exec:\xlrllxf.exe81⤵PID:1116
-
\??\c:\xfrxxxf.exec:\xfrxxxf.exe82⤵PID:2672
-
\??\c:\1hbnnn.exec:\1hbnnn.exe83⤵PID:2620
-
\??\c:\nhttbt.exec:\nhttbt.exe84⤵PID:2604
-
\??\c:\9vpdv.exec:\9vpdv.exe85⤵PID:1524
-
\??\c:\dvpdp.exec:\dvpdp.exe86⤵PID:532
-
\??\c:\fxlxrxr.exec:\fxlxrxr.exe87⤵PID:1632
-
\??\c:\lxfxxrl.exec:\lxfxxrl.exe88⤵PID:1592
-
\??\c:\thtnnn.exec:\thtnnn.exe89⤵PID:2676
-
\??\c:\jpvvd.exec:\jpvvd.exe90⤵PID:1440
-
\??\c:\vvpjv.exec:\vvpjv.exe91⤵PID:1924
-
\??\c:\7lrllxf.exec:\7lrllxf.exe92⤵PID:3064
-
\??\c:\xxxxxlr.exec:\xxxxxlr.exe93⤵PID:2920
-
\??\c:\hnhtnt.exec:\hnhtnt.exe94⤵PID:1980
-
\??\c:\hthntb.exec:\hthntb.exe95⤵PID:540
-
\??\c:\vddjd.exec:\vddjd.exe96⤵PID:1492
-
\??\c:\dvdvj.exec:\dvdvj.exe97⤵PID:952
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe98⤵PID:1960
-
\??\c:\1bnbnt.exec:\1bnbnt.exe99⤵PID:1292
-
\??\c:\tnhnbh.exec:\tnhnbh.exe100⤵PID:2548
-
\??\c:\ppjvj.exec:\ppjvj.exe101⤵PID:1264
-
\??\c:\dvjvj.exec:\dvjvj.exe102⤵PID:1768
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe103⤵PID:648
-
\??\c:\nthhhh.exec:\nthhhh.exe104⤵PID:1148
-
\??\c:\ttnbth.exec:\ttnbth.exe105⤵PID:1668
-
\??\c:\pddvj.exec:\pddvj.exe106⤵PID:2468
-
\??\c:\rflxffx.exec:\rflxffx.exe107⤵PID:996
-
\??\c:\flrrxll.exec:\flrrxll.exe108⤵PID:1832
-
\??\c:\tnhthn.exec:\tnhthn.exe109⤵PID:1844
-
\??\c:\nhtbnt.exec:\nhtbnt.exe110⤵PID:2336
-
\??\c:\ddddp.exec:\ddddp.exe111⤵PID:1612
-
\??\c:\fllxrxr.exec:\fllxrxr.exe112⤵PID:1700
-
\??\c:\lrrfrll.exec:\lrrfrll.exe113⤵PID:3056
-
\??\c:\bbbttn.exec:\bbbttn.exe114⤵PID:592
-
\??\c:\tnhbhn.exec:\tnhbhn.exe115⤵PID:2840
-
\??\c:\pjvpd.exec:\pjvpd.exe116⤵PID:2976
-
\??\c:\jjvvp.exec:\jjvvp.exe117⤵PID:2608
-
\??\c:\rrllrrx.exec:\rrllrrx.exe118⤵PID:2888
-
\??\c:\lrflffx.exec:\lrflffx.exe119⤵PID:2652
-
\??\c:\7bhthn.exec:\7bhthn.exe120⤵PID:2660
-
\??\c:\thhhhb.exec:\thhhhb.exe121⤵PID:2728
-
\??\c:\dddpp.exec:\dddpp.exe122⤵PID:3044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-