Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe
-
Size
95KB
-
MD5
02c2e6a174e98ebf3cf4c2335e1179fa
-
SHA1
d141daef1610d075c5cf6f2d9f1773ce0a0dbae1
-
SHA256
2766a48ab490f4b8c03f745b0445b0e45301bc927e4cc8581eaf9de41d66b1d2
-
SHA512
4e48a8fa9b8d89d9aa3ce4ed8b73a0446b078f1112edf97b2f14fe8ee589d58e59e93b9a8336a7abdfac51fab59ab861673be72505e9dd2f27fc2aea0c6737c9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzNcI2gxprr4H8YoC:ymb3NkkiQ3mdBjF+3TYzvTbrr4Hj
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2232-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-52-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 3pjjj.exe 2792 9ppjv.exe 2588 9frxxrx.exe 2804 3hbbhh.exe 2764 3djpv.exe 2592 9rfxxff.exe 2632 frrxffr.exe 2648 1hnntt.exe 1356 bbnnbh.exe 2208 3vppv.exe 1868 pddpv.exe 540 frfxllx.exe 1652 fxfrrll.exe 2476 bnbttn.exe 2168 bhhnbh.exe 2924 jvjdj.exe 484 3pjvj.exe 536 9fxxffl.exe 2152 btbhhn.exe 848 tnhnnh.exe 2488 dvjjp.exe 2076 3pvpv.exe 2464 bnhttt.exe 2684 9btbhh.exe 824 nnbnhn.exe 264 dpdpp.exe 2496 fxfxlrl.exe 1284 lrfllxr.exe 1988 btnttb.exe 876 tnthbb.exe 2068 pjvvd.exe 2800 dvddd.exe 1596 lfllllr.exe 2896 7lxfrxl.exe 2608 bhbnhb.exe 2776 btbbhn.exe 2784 dvpjv.exe 2644 pjdjd.exe 2348 lfrfrxf.exe 2892 xlxxfxf.exe 2424 7xffrrr.exe 2216 hbhnbn.exe 2056 5nbhnt.exe 904 hbnbtb.exe 2816 dvdjp.exe 2836 pddvv.exe 1104 frrlxxx.exe 2060 frrxllr.exe 2884 1fflxrf.exe 2116 nhntht.exe 2924 htttbt.exe 948 9hbbhn.exe 2840 dpdpd.exe 1632 1dpjp.exe 2012 vppdp.exe 1000 rlrlxxf.exe 2948 frxflrx.exe 2488 lxfxlfl.exe 2076 tnbntt.exe 1016 9bntbh.exe 1704 ppdpd.exe 1576 7dppp.exe 1924 dpjdp.exe 2300 7frxlll.exe -
resource yara_rule behavioral1/memory/2232-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-63-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2232 2188 02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe 30 PID 2188 wrote to memory of 2232 2188 02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe 30 PID 2188 wrote to memory of 2232 2188 02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe 30 PID 2188 wrote to memory of 2232 2188 02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe 30 PID 2232 wrote to memory of 2792 2232 3pjjj.exe 31 PID 2232 wrote to memory of 2792 2232 3pjjj.exe 31 PID 2232 wrote to memory of 2792 2232 3pjjj.exe 31 PID 2232 wrote to memory of 2792 2232 3pjjj.exe 31 PID 2792 wrote to memory of 2588 2792 9ppjv.exe 32 PID 2792 wrote to memory of 2588 2792 9ppjv.exe 32 PID 2792 wrote to memory of 2588 2792 9ppjv.exe 32 PID 2792 wrote to memory of 2588 2792 9ppjv.exe 32 PID 2588 wrote to memory of 2804 2588 9frxxrx.exe 33 PID 2588 wrote to memory of 2804 2588 9frxxrx.exe 33 PID 2588 wrote to memory of 2804 2588 9frxxrx.exe 33 PID 2588 wrote to memory of 2804 2588 9frxxrx.exe 33 PID 2804 wrote to memory of 2764 2804 3hbbhh.exe 34 PID 2804 wrote to memory of 2764 2804 3hbbhh.exe 34 PID 2804 wrote to memory of 2764 2804 3hbbhh.exe 34 PID 2804 wrote to memory of 2764 2804 3hbbhh.exe 34 PID 2764 wrote to memory of 2592 2764 3djpv.exe 35 PID 2764 wrote to memory of 2592 2764 3djpv.exe 35 PID 2764 wrote to memory of 2592 2764 3djpv.exe 35 PID 2764 wrote to memory of 2592 2764 3djpv.exe 35 PID 2592 wrote to memory of 2632 2592 9rfxxff.exe 36 PID 2592 wrote to memory of 2632 2592 9rfxxff.exe 36 PID 2592 wrote to memory of 2632 2592 9rfxxff.exe 36 PID 2592 wrote to memory of 2632 2592 9rfxxff.exe 36 PID 2632 wrote to memory of 2648 2632 frrxffr.exe 37 PID 2632 wrote to memory of 2648 2632 frrxffr.exe 37 PID 2632 wrote to memory of 2648 2632 frrxffr.exe 37 PID 2632 wrote to memory of 2648 2632 frrxffr.exe 37 PID 2648 wrote to memory of 1356 2648 1hnntt.exe 38 PID 2648 wrote to memory of 1356 2648 1hnntt.exe 38 PID 2648 wrote to memory of 1356 2648 1hnntt.exe 38 PID 2648 wrote to memory of 1356 2648 1hnntt.exe 38 PID 1356 wrote to memory of 2208 1356 bbnnbh.exe 39 PID 1356 wrote to memory of 2208 1356 bbnnbh.exe 39 PID 1356 wrote to memory of 2208 1356 bbnnbh.exe 39 PID 1356 wrote to memory of 2208 1356 bbnnbh.exe 39 PID 2208 wrote to memory of 1868 2208 3vppv.exe 40 PID 2208 wrote to memory of 1868 2208 3vppv.exe 40 PID 2208 wrote to memory of 1868 2208 3vppv.exe 40 PID 2208 wrote to memory of 1868 2208 3vppv.exe 40 PID 1868 wrote to memory of 540 1868 pddpv.exe 41 PID 1868 wrote to memory of 540 1868 pddpv.exe 41 PID 1868 wrote to memory of 540 1868 pddpv.exe 41 PID 1868 wrote to memory of 540 1868 pddpv.exe 41 PID 540 wrote to memory of 1652 540 frfxllx.exe 42 PID 540 wrote to memory of 1652 540 frfxllx.exe 42 PID 540 wrote to memory of 1652 540 frfxllx.exe 42 PID 540 wrote to memory of 1652 540 frfxllx.exe 42 PID 1652 wrote to memory of 2476 1652 fxfrrll.exe 43 PID 1652 wrote to memory of 2476 1652 fxfrrll.exe 43 PID 1652 wrote to memory of 2476 1652 fxfrrll.exe 43 PID 1652 wrote to memory of 2476 1652 fxfrrll.exe 43 PID 2476 wrote to memory of 2168 2476 bnbttn.exe 44 PID 2476 wrote to memory of 2168 2476 bnbttn.exe 44 PID 2476 wrote to memory of 2168 2476 bnbttn.exe 44 PID 2476 wrote to memory of 2168 2476 bnbttn.exe 44 PID 2168 wrote to memory of 2924 2168 bhhnbh.exe 45 PID 2168 wrote to memory of 2924 2168 bhhnbh.exe 45 PID 2168 wrote to memory of 2924 2168 bhhnbh.exe 45 PID 2168 wrote to memory of 2924 2168 bhhnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02c2e6a174e98ebf3cf4c2335e1179fa_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\3pjjj.exec:\3pjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9ppjv.exec:\9ppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9frxxrx.exec:\9frxxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\3hbbhh.exec:\3hbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3djpv.exec:\3djpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\9rfxxff.exec:\9rfxxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\frrxffr.exec:\frrxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\1hnntt.exec:\1hnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bbnnbh.exec:\bbnnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\3vppv.exec:\3vppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\pddpv.exec:\pddpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\frfxllx.exec:\frfxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\fxfrrll.exec:\fxfrrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\bnbttn.exec:\bnbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bhhnbh.exec:\bhhnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\jvjdj.exec:\jvjdj.exe17⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3pjvj.exec:\3pjvj.exe18⤵
- Executes dropped EXE
PID:484 -
\??\c:\9fxxffl.exec:\9fxxffl.exe19⤵
- Executes dropped EXE
PID:536 -
\??\c:\btbhhn.exec:\btbhhn.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tnhnnh.exec:\tnhnnh.exe21⤵
- Executes dropped EXE
PID:848 -
\??\c:\dvjjp.exec:\dvjjp.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3pvpv.exec:\3pvpv.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bnhttt.exec:\bnhttt.exe24⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9btbhh.exec:\9btbhh.exe25⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nnbnhn.exec:\nnbnhn.exe26⤵
- Executes dropped EXE
PID:824 -
\??\c:\dpdpp.exec:\dpdpp.exe27⤵
- Executes dropped EXE
PID:264 -
\??\c:\fxfxlrl.exec:\fxfxlrl.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lrfllxr.exec:\lrfllxr.exe29⤵
- Executes dropped EXE
PID:1284 -
\??\c:\btnttb.exec:\btnttb.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnthbb.exec:\tnthbb.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\pjvvd.exec:\pjvvd.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dvddd.exec:\dvddd.exe33⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lfllllr.exec:\lfllllr.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7lxfrxl.exec:\7lxfrxl.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bhbnhb.exec:\bhbnhb.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\btbbhn.exec:\btbbhn.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dvpjv.exec:\dvpjv.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjdjd.exec:\pjdjd.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lfrfrxf.exec:\lfrfrxf.exe40⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe41⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7xffrrr.exec:\7xffrrr.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hbhnbn.exec:\hbhnbn.exe43⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5nbhnt.exec:\5nbhnt.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hbnbtb.exec:\hbnbtb.exe45⤵
- Executes dropped EXE
PID:904 -
\??\c:\dvdjp.exec:\dvdjp.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pddvv.exec:\pddvv.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\frrlxxx.exec:\frrlxxx.exe48⤵
- Executes dropped EXE
PID:1104 -
\??\c:\frrxllr.exec:\frrxllr.exe49⤵
- Executes dropped EXE
PID:2060 -
\??\c:\1fflxrf.exec:\1fflxrf.exe50⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nhntht.exec:\nhntht.exe51⤵
- Executes dropped EXE
PID:2116 -
\??\c:\htttbt.exec:\htttbt.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9hbbhn.exec:\9hbbhn.exe53⤵
- Executes dropped EXE
PID:948 -
\??\c:\dpdpd.exec:\dpdpd.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1dpjp.exec:\1dpjp.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vppdp.exec:\vppdp.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\rlrlxxf.exec:\rlrlxxf.exe57⤵
- Executes dropped EXE
PID:1000 -
\??\c:\frxflrx.exec:\frxflrx.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lxfxlfl.exec:\lxfxlfl.exe59⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tnbntt.exec:\tnbntt.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9bntbh.exec:\9bntbh.exe61⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ppdpd.exec:\ppdpd.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7dppp.exec:\7dppp.exe63⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dpjdp.exec:\dpjdp.exe64⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7frxlll.exec:\7frxlll.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lffrrxl.exec:\lffrrxl.exe66⤵PID:2304
-
\??\c:\lrlrrxl.exec:\lrlrrxl.exe67⤵PID:1284
-
\??\c:\bbbbbb.exec:\bbbbbb.exe68⤵PID:2236
-
\??\c:\tthbnb.exec:\tthbnb.exe69⤵PID:2404
-
\??\c:\hthntt.exec:\hthntt.exe70⤵PID:2876
-
\??\c:\jvjdj.exec:\jvjdj.exe71⤵PID:2524
-
\??\c:\pjpvj.exec:\pjpvj.exe72⤵PID:2780
-
\??\c:\vppvd.exec:\vppvd.exe73⤵PID:1484
-
\??\c:\xxrrlrx.exec:\xxrrlrx.exe74⤵PID:1716
-
\??\c:\fxrxffr.exec:\fxrxffr.exe75⤵PID:2864
-
\??\c:\thbhth.exec:\thbhth.exe76⤵PID:2628
-
\??\c:\3vvjd.exec:\3vvjd.exe77⤵PID:2868
-
\??\c:\vpdpd.exec:\vpdpd.exe78⤵PID:2784
-
\??\c:\5thnth.exec:\5thnth.exe79⤵PID:2988
-
\??\c:\ppvvd.exec:\ppvvd.exe80⤵PID:1456
-
\??\c:\rflllrx.exec:\rflllrx.exe81⤵PID:2724
-
\??\c:\9thnbh.exec:\9thnbh.exe82⤵PID:900
-
\??\c:\vpjvp.exec:\vpjvp.exe83⤵PID:1240
-
\??\c:\dpdjv.exec:\dpdjv.exe84⤵PID:2460
-
\??\c:\rffllrf.exec:\rffllrf.exe85⤵PID:296
-
\??\c:\7btbhn.exec:\7btbhn.exe86⤵PID:2848
-
\??\c:\frxxlfx.exec:\frxxlfx.exe87⤵PID:2248
-
\??\c:\rllfrfl.exec:\rllfrfl.exe88⤵PID:1020
-
\??\c:\btnntb.exec:\btnntb.exe89⤵PID:2676
-
\??\c:\vjpdj.exec:\vjpdj.exe90⤵PID:2852
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe91⤵PID:1528
-
\??\c:\hbhnbn.exec:\hbhnbn.exe92⤵PID:1932
-
\??\c:\rllrxxr.exec:\rllrxxr.exe93⤵PID:1648
-
\??\c:\httbnn.exec:\httbnn.exe94⤵PID:2204
-
\??\c:\vpdpd.exec:\vpdpd.exe95⤵PID:2336
-
\??\c:\lxlxffl.exec:\lxlxffl.exe96⤵PID:2332
-
\??\c:\bntbhn.exec:\bntbhn.exe97⤵PID:1860
-
\??\c:\5thhtb.exec:\5thhtb.exe98⤵PID:1276
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe99⤵PID:1784
-
\??\c:\9tnnhn.exec:\9tnnhn.exe100⤵PID:940
-
\??\c:\jdvvd.exec:\jdvvd.exe101⤵PID:1732
-
\??\c:\rflflfx.exec:\rflflfx.exe102⤵PID:1608
-
\??\c:\tbbbnb.exec:\tbbbnb.exe103⤵PID:2252
-
\??\c:\hbnntb.exec:\hbnntb.exe104⤵PID:1604
-
\??\c:\dvpvd.exec:\dvpvd.exe105⤵PID:2664
-
\??\c:\xfxfrxf.exec:\xfxfrxf.exe106⤵PID:2428
-
\??\c:\hthnth.exec:\hthnth.exe107⤵PID:316
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe108⤵PID:2132
-
\??\c:\ttnbtn.exec:\ttnbtn.exe109⤵PID:2384
-
\??\c:\vpdpd.exec:\vpdpd.exe110⤵PID:3060
-
\??\c:\ppjjd.exec:\ppjjd.exe111⤵PID:1492
-
\??\c:\3lrrflx.exec:\3lrrflx.exe112⤵PID:1488
-
\??\c:\llffxlx.exec:\llffxlx.exe113⤵PID:2588
-
\??\c:\nhnhnn.exec:\nhnhnn.exe114⤵PID:1596
-
\??\c:\1bhtbn.exec:\1bhtbn.exe115⤵PID:2288
-
\??\c:\pjddp.exec:\pjddp.exe116⤵PID:2692
-
\??\c:\jjdpp.exec:\jjdpp.exe117⤵PID:2596
-
\??\c:\3lfrrxr.exec:\3lfrrxr.exe118⤵PID:2260
-
\??\c:\rxrfxxr.exec:\rxrfxxr.exe119⤵PID:2280
-
\??\c:\5nhnht.exec:\5nhnht.exe120⤵PID:2416
-
\??\c:\pdvdv.exec:\pdvdv.exe121⤵PID:2324
-
\??\c:\dvpvj.exec:\dvpvj.exe122⤵PID:748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-