Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe
-
Size
94KB
-
MD5
0036abd78b5af4b6a0a098a2d7a15a0b
-
SHA1
46d3f939be654b6f8b25b895488211be4af6d163
-
SHA256
7439c7685be9b079e1045f93c6c5b82141edb439369b5bb24a1cf8158afab965
-
SHA512
f9aa606eb5d590ec465d86590e5a17ff4cd97f0509fa1943ae13720ca017edba67fdb5ed2b2765e86878903d4c1d73cb2a14254ac44c230de912a6620d4b28c3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzNcI2gxprr4H8You:ymb3NkkiQ3mdBjF+3TYzvTbrr4H/
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1792-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 452 6220220.exe 4628 bnbtbt.exe 4552 1xxlfff.exe 2012 44000.exe 2552 hbhhbn.exe 1932 frlfxff.exe 2432 06604.exe 3664 lfrlllx.exe 1752 s4082.exe 4916 8422288.exe 2128 6602800.exe 2152 hnttbh.exe 3864 88044.exe 4784 fffffll.exe 2496 6422802.exe 4440 088482.exe 1348 xlffffx.exe 3820 66088.exe 2412 jpjdj.exe 4904 864400.exe 1316 266486.exe 1304 02642.exe 5100 pjjdd.exe 396 lrxrrrx.exe 2200 20664.exe 3104 46426.exe 1968 5lfxrrl.exe 384 bbbtbb.exe 3676 rrlfxfx.exe 4452 o886042.exe 1984 2222268.exe 1412 6008820.exe 3936 nhbbhn.exe 4892 m0826.exe 3844 088042.exe 4936 842824.exe 2832 vjjdv.exe 4340 000240.exe 3856 64046.exe 2792 668228.exe 2828 o622288.exe 4108 nnnnbb.exe 4736 68260.exe 3716 26026.exe 4684 26600.exe 2628 024840.exe 3608 864084.exe 3592 xrflfll.exe 552 8406284.exe 4256 nbbbtn.exe 2020 646886.exe 4992 288600.exe 896 2004888.exe 3036 bbhnhn.exe 2920 2686648.exe 392 80448.exe 3308 o626666.exe 1064 2486880.exe 2932 xrrlfff.exe 3244 s4600.exe 3820 httttb.exe 5116 46844.exe 4964 1nbttb.exe 1828 0482488.exe -
resource yara_rule behavioral2/memory/1792-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-67-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24080.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 660262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 452 1792 0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe 84 PID 1792 wrote to memory of 452 1792 0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe 84 PID 1792 wrote to memory of 452 1792 0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe 84 PID 452 wrote to memory of 4628 452 6220220.exe 635 PID 452 wrote to memory of 4628 452 6220220.exe 635 PID 452 wrote to memory of 4628 452 6220220.exe 635 PID 4628 wrote to memory of 4552 4628 bnbtbt.exe 86 PID 4628 wrote to memory of 4552 4628 bnbtbt.exe 86 PID 4628 wrote to memory of 4552 4628 bnbtbt.exe 86 PID 4552 wrote to memory of 2012 4552 1xxlfff.exe 87 PID 4552 wrote to memory of 2012 4552 1xxlfff.exe 87 PID 4552 wrote to memory of 2012 4552 1xxlfff.exe 87 PID 2012 wrote to memory of 2552 2012 44000.exe 324 PID 2012 wrote to memory of 2552 2012 44000.exe 324 PID 2012 wrote to memory of 2552 2012 44000.exe 324 PID 2552 wrote to memory of 1932 2552 hbhhbn.exe 89 PID 2552 wrote to memory of 1932 2552 hbhhbn.exe 89 PID 2552 wrote to memory of 1932 2552 hbhhbn.exe 89 PID 1932 wrote to memory of 2432 1932 frlfxff.exe 90 PID 1932 wrote to memory of 2432 1932 frlfxff.exe 90 PID 1932 wrote to memory of 2432 1932 frlfxff.exe 90 PID 2432 wrote to memory of 3664 2432 06604.exe 570 PID 2432 wrote to memory of 3664 2432 06604.exe 570 PID 2432 wrote to memory of 3664 2432 06604.exe 570 PID 3664 wrote to memory of 1752 3664 lfrlllx.exe 92 PID 3664 wrote to memory of 1752 3664 lfrlllx.exe 92 PID 3664 wrote to memory of 1752 3664 lfrlllx.exe 92 PID 1752 wrote to memory of 4916 1752 s4082.exe 93 PID 1752 wrote to memory of 4916 1752 s4082.exe 93 PID 1752 wrote to memory of 4916 1752 s4082.exe 93 PID 4916 wrote to memory of 2128 4916 8422288.exe 94 PID 4916 wrote to memory of 2128 4916 8422288.exe 94 PID 4916 wrote to memory of 2128 4916 8422288.exe 94 PID 2128 wrote to memory of 2152 2128 6602800.exe 96 PID 2128 wrote to memory of 2152 2128 6602800.exe 96 PID 2128 wrote to memory of 2152 2128 6602800.exe 96 PID 2152 wrote to memory of 3864 2152 hnttbh.exe 235 PID 2152 wrote to memory of 3864 2152 hnttbh.exe 235 PID 2152 wrote to memory of 3864 2152 hnttbh.exe 235 PID 3864 wrote to memory of 4784 3864 88044.exe 98 PID 3864 wrote to memory of 4784 3864 88044.exe 98 PID 3864 wrote to memory of 4784 3864 88044.exe 98 PID 4784 wrote to memory of 2496 4784 fffffll.exe 99 PID 4784 wrote to memory of 2496 4784 fffffll.exe 99 PID 4784 wrote to memory of 2496 4784 fffffll.exe 99 PID 2496 wrote to memory of 4440 2496 6422802.exe 100 PID 2496 wrote to memory of 4440 2496 6422802.exe 100 PID 2496 wrote to memory of 4440 2496 6422802.exe 100 PID 4440 wrote to memory of 1348 4440 088482.exe 327 PID 4440 wrote to memory of 1348 4440 088482.exe 327 PID 4440 wrote to memory of 1348 4440 088482.exe 327 PID 1348 wrote to memory of 3820 1348 xlffffx.exe 103 PID 1348 wrote to memory of 3820 1348 xlffffx.exe 103 PID 1348 wrote to memory of 3820 1348 xlffffx.exe 103 PID 3820 wrote to memory of 2412 3820 66088.exe 104 PID 3820 wrote to memory of 2412 3820 66088.exe 104 PID 3820 wrote to memory of 2412 3820 66088.exe 104 PID 2412 wrote to memory of 4904 2412 jpjdj.exe 105 PID 2412 wrote to memory of 4904 2412 jpjdj.exe 105 PID 2412 wrote to memory of 4904 2412 jpjdj.exe 105 PID 4904 wrote to memory of 1316 4904 864400.exe 106 PID 4904 wrote to memory of 1316 4904 864400.exe 106 PID 4904 wrote to memory of 1316 4904 864400.exe 106 PID 1316 wrote to memory of 1304 1316 266486.exe 543
Processes
-
C:\Users\Admin\AppData\Local\Temp\0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\6220220.exec:\6220220.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\bnbtbt.exec:\bnbtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\1xxlfff.exec:\1xxlfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\44000.exec:\44000.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\hbhhbn.exec:\hbhhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\frlfxff.exec:\frlfxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\06604.exec:\06604.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\lfrlllx.exec:\lfrlllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\s4082.exec:\s4082.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\8422288.exec:\8422288.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\6602800.exec:\6602800.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hnttbh.exec:\hnttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\88044.exec:\88044.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\fffffll.exec:\fffffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\6422802.exec:\6422802.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\088482.exec:\088482.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\xlffffx.exec:\xlffffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\66088.exec:\66088.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\jpjdj.exec:\jpjdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\864400.exec:\864400.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\266486.exec:\266486.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\02642.exec:\02642.exe23⤵
- Executes dropped EXE
PID:1304 -
\??\c:\pjjdd.exec:\pjjdd.exe24⤵
- Executes dropped EXE
PID:5100 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe25⤵
- Executes dropped EXE
PID:396 -
\??\c:\20664.exec:\20664.exe26⤵
- Executes dropped EXE
PID:2200 -
\??\c:\46426.exec:\46426.exe27⤵
- Executes dropped EXE
PID:3104 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe28⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bbbtbb.exec:\bbbtbb.exe29⤵
- Executes dropped EXE
PID:384 -
\??\c:\rrlfxfx.exec:\rrlfxfx.exe30⤵
- Executes dropped EXE
PID:3676 -
\??\c:\o886042.exec:\o886042.exe31⤵
- Executes dropped EXE
PID:4452 -
\??\c:\2222268.exec:\2222268.exe32⤵
- Executes dropped EXE
PID:1984 -
\??\c:\6008820.exec:\6008820.exe33⤵
- Executes dropped EXE
PID:1412 -
\??\c:\nhbbhn.exec:\nhbbhn.exe34⤵
- Executes dropped EXE
PID:3936 -
\??\c:\m0826.exec:\m0826.exe35⤵
- Executes dropped EXE
PID:4892 -
\??\c:\088042.exec:\088042.exe36⤵
- Executes dropped EXE
PID:3844 -
\??\c:\842824.exec:\842824.exe37⤵
- Executes dropped EXE
PID:4936 -
\??\c:\vjjdv.exec:\vjjdv.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\000240.exec:\000240.exe39⤵
- Executes dropped EXE
PID:4340 -
\??\c:\64046.exec:\64046.exe40⤵
- Executes dropped EXE
PID:3856 -
\??\c:\668228.exec:\668228.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\o622288.exec:\o622288.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nnnnbb.exec:\nnnnbb.exe43⤵
- Executes dropped EXE
PID:4108 -
\??\c:\68260.exec:\68260.exe44⤵
- Executes dropped EXE
PID:4736 -
\??\c:\26026.exec:\26026.exe45⤵
- Executes dropped EXE
PID:3716 -
\??\c:\26600.exec:\26600.exe46⤵
- Executes dropped EXE
PID:4684 -
\??\c:\024840.exec:\024840.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\864084.exec:\864084.exe48⤵
- Executes dropped EXE
PID:3608 -
\??\c:\xrflfll.exec:\xrflfll.exe49⤵
- Executes dropped EXE
PID:3592 -
\??\c:\8406284.exec:\8406284.exe50⤵
- Executes dropped EXE
PID:552 -
\??\c:\nbbbtn.exec:\nbbbtn.exe51⤵
- Executes dropped EXE
PID:4256 -
\??\c:\646886.exec:\646886.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\288600.exec:\288600.exe53⤵
- Executes dropped EXE
PID:4992 -
\??\c:\2004888.exec:\2004888.exe54⤵
- Executes dropped EXE
PID:896 -
\??\c:\bbhnhn.exec:\bbhnhn.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\2686648.exec:\2686648.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\80448.exec:\80448.exe57⤵
- Executes dropped EXE
PID:392 -
\??\c:\o626666.exec:\o626666.exe58⤵
- Executes dropped EXE
PID:3308 -
\??\c:\2486880.exec:\2486880.exe59⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xrrlfff.exec:\xrrlfff.exe60⤵
- Executes dropped EXE
PID:2932 -
\??\c:\s4600.exec:\s4600.exe61⤵
- Executes dropped EXE
PID:3244 -
\??\c:\httttb.exec:\httttb.exe62⤵
- Executes dropped EXE
PID:3820 -
\??\c:\46844.exec:\46844.exe63⤵
- Executes dropped EXE
PID:5116 -
\??\c:\1nbttb.exec:\1nbttb.exe64⤵
- Executes dropped EXE
PID:4964 -
\??\c:\0482488.exec:\0482488.exe65⤵
- Executes dropped EXE
PID:1828 -
\??\c:\828200.exec:\828200.exe66⤵PID:1784
-
\??\c:\flrrlff.exec:\flrrlff.exe67⤵
- System Location Discovery: System Language Discovery
PID:4536 -
\??\c:\s281f.exec:\s281f.exe68⤵PID:1304
-
\??\c:\6862428.exec:\6862428.exe69⤵PID:4624
-
\??\c:\62000.exec:\62000.exe70⤵PID:688
-
\??\c:\4446846.exec:\4446846.exe71⤵PID:1256
-
\??\c:\000486.exec:\000486.exe72⤵PID:5068
-
\??\c:\lflxrrr.exec:\lflxrrr.exe73⤵PID:2016
-
\??\c:\s2660.exec:\s2660.exe74⤵PID:5064
-
\??\c:\jvddj.exec:\jvddj.exe75⤵PID:4896
-
\??\c:\048284.exec:\048284.exe76⤵PID:4564
-
\??\c:\9pvvp.exec:\9pvvp.exe77⤵PID:228
-
\??\c:\680288.exec:\680288.exe78⤵PID:4768
-
\??\c:\frlxrxl.exec:\frlxrxl.exe79⤵PID:4856
-
\??\c:\bnhnnh.exec:\bnhnnh.exe80⤵PID:3712
-
\??\c:\680084.exec:\680084.exe81⤵PID:3264
-
\??\c:\5lxrxxl.exec:\5lxrxxl.exe82⤵PID:720
-
\??\c:\rflfxfx.exec:\rflfxfx.exe83⤵PID:4996
-
\??\c:\684820.exec:\684820.exe84⤵PID:2824
-
\??\c:\006082.exec:\006082.exe85⤵PID:4500
-
\??\c:\bhhhhn.exec:\bhhhhn.exe86⤵PID:3632
-
\??\c:\bhbtht.exec:\bhbtht.exe87⤵PID:1792
-
\??\c:\xxffflf.exec:\xxffflf.exe88⤵PID:4320
-
\??\c:\frllffx.exec:\frllffx.exe89⤵PID:2792
-
\??\c:\dpvvp.exec:\dpvvp.exe90⤵PID:2352
-
\??\c:\62808.exec:\62808.exe91⤵PID:4108
-
\??\c:\22442.exec:\22442.exe92⤵PID:4736
-
\??\c:\8428028.exec:\8428028.exe93⤵PID:3716
-
\??\c:\fffxrff.exec:\fffxrff.exe94⤵PID:4684
-
\??\c:\dvvpp.exec:\dvvpp.exe95⤵PID:2628
-
\??\c:\8424846.exec:\8424846.exe96⤵PID:2312
-
\??\c:\pdpdj.exec:\pdpdj.exe97⤵PID:5044
-
\??\c:\hhhhhn.exec:\hhhhhn.exe98⤵PID:552
-
\??\c:\nhbnbh.exec:\nhbnbh.exe99⤵PID:2308
-
\??\c:\dpdpd.exec:\dpdpd.exe100⤵PID:4540
-
\??\c:\lflllrf.exec:\lflllrf.exe101⤵PID:4140
-
\??\c:\9flfxrr.exec:\9flfxrr.exe102⤵PID:2180
-
\??\c:\ntnbhh.exec:\ntnbhh.exe103⤵PID:116
-
\??\c:\66262.exec:\66262.exe104⤵PID:184
-
\??\c:\fffrllr.exec:\fffrllr.exe105⤵PID:1232
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe106⤵PID:4848
-
\??\c:\2680202.exec:\2680202.exe107⤵PID:2004
-
\??\c:\402842.exec:\402842.exe108⤵PID:1584
-
\??\c:\jpdvp.exec:\jpdvp.exe109⤵PID:2916
-
\??\c:\w04404.exec:\w04404.exe110⤵PID:4172
-
\??\c:\thtnnh.exec:\thtnnh.exe111⤵PID:2668
-
\??\c:\268844.exec:\268844.exe112⤵PID:4904
-
\??\c:\006420.exec:\006420.exe113⤵PID:1316
-
\??\c:\xlrrxfl.exec:\xlrrxfl.exe114⤵PID:740
-
\??\c:\rxxxlrf.exec:\rxxxlrf.exe115⤵PID:4412
-
\??\c:\xrllfrl.exec:\xrllfrl.exe116⤵PID:2620
-
\??\c:\66284.exec:\66284.exe117⤵PID:396
-
\??\c:\422426.exec:\422426.exe118⤵PID:532
-
\??\c:\nbhntb.exec:\nbhntb.exe119⤵PID:2444
-
\??\c:\jdvpj.exec:\jdvpj.exe120⤵PID:824
-
\??\c:\888848.exec:\888848.exe121⤵PID:4372
-
\??\c:\9lfxrlx.exec:\9lfxrlx.exe122⤵PID:4940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-