Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a503833f959fdf7467c753f8a1fc813_JaffaCakes118.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
2a503833f959fdf7467c753f8a1fc813_JaffaCakes118.exe
-
Size
469KB
-
MD5
2a503833f959fdf7467c753f8a1fc813
-
SHA1
d527b4c2039ff5d25fbacd2ff3a8e9ef96b1980f
-
SHA256
c8096ca2a0207811a215f57636a016bd6516b3defa9f1f309cef84c7b5421ccf
-
SHA512
4847429f840afc4a5741ab8b9fc319ae51daf839d46f4ee458e0ba60916fbd5cede1cff8da2412375044da608b202ad702540973c7aebc4e9d1abfc99e2e4b80
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sY0AJq4mZW:n3C9yMo+S0L9xRnoq7H9pm+
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/100-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4584 rlxrrlf.exe 1764 5nhbnh.exe 4588 nbnbbt.exe 4944 hhnhtt.exe 4012 rfxrllf.exe 2744 tbbbtn.exe 3144 lffxlxr.exe 676 rffxxfr.exe 5000 7hhbnn.exe 3108 1vppv.exe 4576 vddvp.exe 1608 flrllff.exe 3636 dpjdv.exe 3696 frxlxrl.exe 4332 nhbtbb.exe 392 flxfxxr.exe 2556 fxfxflx.exe 1612 fxrlfll.exe 4560 nthtnh.exe 116 rxrrrrf.exe 4820 tnnnnn.exe 4364 dvvpj.exe 1104 pjvpv.exe 1576 ppvpj.exe 4336 rlfxxxx.exe 3888 3bthnn.exe 4380 bnhtnh.exe 2392 rlxxxlr.exe 3408 5tbtbb.exe 3340 rffxrlf.exe 2540 9ppjd.exe 1968 tthhth.exe 4756 xllfxlf.exe 1032 3lrrlrl.exe 4672 nbbbbb.exe 3612 pjpjj.exe 5008 rlfllrr.exe 1020 hbbtnh.exe 3552 xrlllrr.exe 3444 lxrrlll.exe 3680 bbhhtn.exe 4120 9jpdv.exe 1436 rxrfxlx.exe 2964 bnnnhn.exe 2484 dvddj.exe 4280 xrlflxr.exe 1980 hbbtnn.exe 3132 9djjj.exe 3268 llrllff.exe 3828 lllxxrr.exe 868 hbbtbb.exe 4880 pjddv.exe 3384 nnbttn.exe 548 rrlfxxx.exe 5044 tbtntn.exe 3964 pjvpj.exe 3708 lrlllrr.exe 456 tbhbnh.exe 3696 pppvv.exe 3624 fxfxrlf.exe 2104 btnhth.exe 3772 hththh.exe 5056 vvpdv.exe 2016 xflfffx.exe -
resource yara_rule behavioral2/memory/100-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 100 wrote to memory of 4584 100 2a503833f959fdf7467c753f8a1fc813_JaffaCakes118.exe 84 PID 100 wrote to memory of 4584 100 2a503833f959fdf7467c753f8a1fc813_JaffaCakes118.exe 84 PID 100 wrote to memory of 4584 100 2a503833f959fdf7467c753f8a1fc813_JaffaCakes118.exe 84 PID 4584 wrote to memory of 1764 4584 rlxrrlf.exe 85 PID 4584 wrote to memory of 1764 4584 rlxrrlf.exe 85 PID 4584 wrote to memory of 1764 4584 rlxrrlf.exe 85 PID 1764 wrote to memory of 4588 1764 5nhbnh.exe 86 PID 1764 wrote to memory of 4588 1764 5nhbnh.exe 86 PID 1764 wrote to memory of 4588 1764 5nhbnh.exe 86 PID 4588 wrote to memory of 4944 4588 nbnbbt.exe 88 PID 4588 wrote to memory of 4944 4588 nbnbbt.exe 88 PID 4588 wrote to memory of 4944 4588 nbnbbt.exe 88 PID 4944 wrote to memory of 4012 4944 hhnhtt.exe 89 PID 4944 wrote to memory of 4012 4944 hhnhtt.exe 89 PID 4944 wrote to memory of 4012 4944 hhnhtt.exe 89 PID 4012 wrote to memory of 2744 4012 rfxrllf.exe 90 PID 4012 wrote to memory of 2744 4012 rfxrllf.exe 90 PID 4012 wrote to memory of 2744 4012 rfxrllf.exe 90 PID 2744 wrote to memory of 3144 2744 tbbbtn.exe 92 PID 2744 wrote to memory of 3144 2744 tbbbtn.exe 92 PID 2744 wrote to memory of 3144 2744 tbbbtn.exe 92 PID 3144 wrote to memory of 676 3144 lffxlxr.exe 93 PID 3144 wrote to memory of 676 3144 lffxlxr.exe 93 PID 3144 wrote to memory of 676 3144 lffxlxr.exe 93 PID 676 wrote to memory of 5000 676 rffxxfr.exe 94 PID 676 wrote to memory of 5000 676 rffxxfr.exe 94 PID 676 wrote to memory of 5000 676 rffxxfr.exe 94 PID 5000 wrote to memory of 3108 5000 7hhbnn.exe 95 PID 5000 wrote to memory of 3108 5000 7hhbnn.exe 95 PID 5000 wrote to memory of 3108 5000 7hhbnn.exe 95 PID 3108 wrote to memory of 4576 3108 1vppv.exe 96 PID 3108 wrote to memory of 4576 3108 1vppv.exe 96 PID 3108 wrote to memory of 4576 3108 1vppv.exe 96 PID 4576 wrote to memory of 1608 4576 vddvp.exe 97 PID 4576 wrote to memory of 1608 4576 vddvp.exe 97 PID 4576 wrote to memory of 1608 4576 vddvp.exe 97 PID 1608 wrote to memory of 3636 1608 flrllff.exe 98 PID 1608 wrote to memory of 3636 1608 flrllff.exe 98 PID 1608 wrote to memory of 3636 1608 flrllff.exe 98 PID 3636 wrote to memory of 3696 3636 dpjdv.exe 99 PID 3636 wrote to memory of 3696 3636 dpjdv.exe 99 PID 3636 wrote to memory of 3696 3636 dpjdv.exe 99 PID 3696 wrote to memory of 4332 3696 frxlxrl.exe 100 PID 3696 wrote to memory of 4332 3696 frxlxrl.exe 100 PID 3696 wrote to memory of 4332 3696 frxlxrl.exe 100 PID 4332 wrote to memory of 392 4332 nhbtbb.exe 101 PID 4332 wrote to memory of 392 4332 nhbtbb.exe 101 PID 4332 wrote to memory of 392 4332 nhbtbb.exe 101 PID 392 wrote to memory of 2556 392 flxfxxr.exe 102 PID 392 wrote to memory of 2556 392 flxfxxr.exe 102 PID 392 wrote to memory of 2556 392 flxfxxr.exe 102 PID 2556 wrote to memory of 1612 2556 fxfxflx.exe 103 PID 2556 wrote to memory of 1612 2556 fxfxflx.exe 103 PID 2556 wrote to memory of 1612 2556 fxfxflx.exe 103 PID 1612 wrote to memory of 4560 1612 fxrlfll.exe 104 PID 1612 wrote to memory of 4560 1612 fxrlfll.exe 104 PID 1612 wrote to memory of 4560 1612 fxrlfll.exe 104 PID 4560 wrote to memory of 116 4560 nthtnh.exe 105 PID 4560 wrote to memory of 116 4560 nthtnh.exe 105 PID 4560 wrote to memory of 116 4560 nthtnh.exe 105 PID 116 wrote to memory of 4820 116 rxrrrrf.exe 106 PID 116 wrote to memory of 4820 116 rxrrrrf.exe 106 PID 116 wrote to memory of 4820 116 rxrrrrf.exe 106 PID 4820 wrote to memory of 4364 4820 tnnnnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a503833f959fdf7467c753f8a1fc813_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2a503833f959fdf7467c753f8a1fc813_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\rlxrrlf.exec:\rlxrrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\5nhbnh.exec:\5nhbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\nbnbbt.exec:\nbnbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\hhnhtt.exec:\hhnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\rfxrllf.exec:\rfxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\tbbbtn.exec:\tbbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lffxlxr.exec:\lffxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\rffxxfr.exec:\rffxxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\7hhbnn.exec:\7hhbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\1vppv.exec:\1vppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\vddvp.exec:\vddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\flrllff.exec:\flrllff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\dpjdv.exec:\dpjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\frxlxrl.exec:\frxlxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\nhbtbb.exec:\nhbtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\flxfxxr.exec:\flxfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\fxfxflx.exec:\fxfxflx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\fxrlfll.exec:\fxrlfll.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nthtnh.exec:\nthtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\rxrrrrf.exec:\rxrrrrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\tnnnnn.exec:\tnnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\dvvpj.exec:\dvvpj.exe23⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pjvpv.exec:\pjvpv.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ppvpj.exec:\ppvpj.exe25⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlfxxxx.exec:\rlfxxxx.exe26⤵
- Executes dropped EXE
PID:4336 -
\??\c:\3bthnn.exec:\3bthnn.exe27⤵
- Executes dropped EXE
PID:3888 -
\??\c:\bnhtnh.exec:\bnhtnh.exe28⤵
- Executes dropped EXE
PID:4380 -
\??\c:\rlxxxlr.exec:\rlxxxlr.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\5tbtbb.exec:\5tbtbb.exe30⤵
- Executes dropped EXE
PID:3408 -
\??\c:\rffxrlf.exec:\rffxrlf.exe31⤵
- Executes dropped EXE
PID:3340 -
\??\c:\9ppjd.exec:\9ppjd.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tthhth.exec:\tthhth.exe33⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xllfxlf.exec:\xllfxlf.exe34⤵
- Executes dropped EXE
PID:4756 -
\??\c:\3lrrlrl.exec:\3lrrlrl.exe35⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nbbbbb.exec:\nbbbbb.exe36⤵
- Executes dropped EXE
PID:4672 -
\??\c:\pjpjj.exec:\pjpjj.exe37⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rlfllrr.exec:\rlfllrr.exe38⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hbbtnh.exec:\hbbtnh.exe39⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xrlllrr.exec:\xrlllrr.exe40⤵
- Executes dropped EXE
PID:3552 -
\??\c:\lxrrlll.exec:\lxrrlll.exe41⤵
- Executes dropped EXE
PID:3444 -
\??\c:\bbhhtn.exec:\bbhhtn.exe42⤵
- Executes dropped EXE
PID:3680 -
\??\c:\9jpdv.exec:\9jpdv.exe43⤵
- Executes dropped EXE
PID:4120 -
\??\c:\rxrfxlx.exec:\rxrfxlx.exe44⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bnnnhn.exec:\bnnnhn.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\dvddj.exec:\dvddj.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrlflxr.exec:\xrlflxr.exe47⤵
- Executes dropped EXE
PID:4280 -
\??\c:\hbbtnn.exec:\hbbtnn.exe48⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9djjj.exec:\9djjj.exe49⤵
- Executes dropped EXE
PID:3132 -
\??\c:\llrllff.exec:\llrllff.exe50⤵
- Executes dropped EXE
PID:3268 -
\??\c:\lllxxrr.exec:\lllxxrr.exe51⤵
- Executes dropped EXE
PID:3828 -
\??\c:\hbbtbb.exec:\hbbtbb.exe52⤵
- Executes dropped EXE
PID:868 -
\??\c:\pjddv.exec:\pjddv.exe53⤵
- Executes dropped EXE
PID:4880 -
\??\c:\nnbttn.exec:\nnbttn.exe54⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe55⤵
- Executes dropped EXE
PID:548 -
\??\c:\tbtntn.exec:\tbtntn.exe56⤵
- Executes dropped EXE
PID:5044 -
\??\c:\pjvpj.exec:\pjvpj.exe57⤵
- Executes dropped EXE
PID:3964 -
\??\c:\lrlllrr.exec:\lrlllrr.exe58⤵
- Executes dropped EXE
PID:3708 -
\??\c:\tbhbnh.exec:\tbhbnh.exe59⤵
- Executes dropped EXE
PID:456 -
\??\c:\pppvv.exec:\pppvv.exe60⤵
- Executes dropped EXE
PID:3696 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe61⤵
- Executes dropped EXE
PID:3624 -
\??\c:\btnhth.exec:\btnhth.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hththh.exec:\hththh.exe63⤵
- Executes dropped EXE
PID:3772 -
\??\c:\vvpdv.exec:\vvpdv.exe64⤵
- Executes dropped EXE
PID:5056 -
\??\c:\xflfffx.exec:\xflfffx.exe65⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hbtnnh.exec:\hbtnnh.exe66⤵PID:816
-
\??\c:\jjpdp.exec:\jjpdp.exe67⤵PID:116
-
\??\c:\rrrrrll.exec:\rrrrrll.exe68⤵PID:2200
-
\??\c:\tbhnhb.exec:\tbhnhb.exe69⤵PID:468
-
\??\c:\3vdvp.exec:\3vdvp.exe70⤵PID:4984
-
\??\c:\9dvdv.exec:\9dvdv.exe71⤵PID:400
-
\??\c:\llfrlrf.exec:\llfrlrf.exe72⤵PID:2280
-
\??\c:\tntnhn.exec:\tntnhn.exe73⤵PID:3788
-
\??\c:\ppvjd.exec:\ppvjd.exe74⤵PID:1788
-
\??\c:\rrxlrrx.exec:\rrxlrrx.exe75⤵PID:3888
-
\??\c:\nhthnh.exec:\nhthnh.exe76⤵PID:2948
-
\??\c:\1jddd.exec:\1jddd.exe77⤵PID:4976
-
\??\c:\dddjd.exec:\dddjd.exe78⤵PID:4788
-
\??\c:\ffxrxxr.exec:\ffxrxxr.exe79⤵PID:4796
-
\??\c:\nnnnhh.exec:\nnnnhh.exe80⤵PID:3528
-
\??\c:\jpjdj.exec:\jpjdj.exe81⤵PID:2324
-
\??\c:\rffxlfx.exec:\rffxlfx.exe82⤵PID:4368
-
\??\c:\9hhbnn.exec:\9hhbnn.exe83⤵PID:2196
-
\??\c:\bttnbb.exec:\bttnbb.exe84⤵PID:3248
-
\??\c:\pjjdv.exec:\pjjdv.exe85⤵PID:2600
-
\??\c:\rflfxrf.exec:\rflfxrf.exe86⤵PID:4288
-
\??\c:\hbhbbb.exec:\hbhbbb.exe87⤵PID:2328
-
\??\c:\vjpjp.exec:\vjpjp.exe88⤵PID:3948
-
\??\c:\rflfxxr.exec:\rflfxxr.exe89⤵PID:2388
-
\??\c:\9lrrlll.exec:\9lrrlll.exe90⤵PID:3336
-
\??\c:\httnht.exec:\httnht.exe91⤵PID:4496
-
\??\c:\ppvvj.exec:\ppvvj.exe92⤵PID:3244
-
\??\c:\llxllfx.exec:\llxllfx.exe93⤵PID:4256
-
\??\c:\frfxxrr.exec:\frfxxrr.exe94⤵PID:4500
-
\??\c:\7hnhbb.exec:\7hnhbb.exe95⤵PID:2152
-
\??\c:\dppjd.exec:\dppjd.exe96⤵PID:4012
-
\??\c:\rxfxfff.exec:\rxfxfff.exe97⤵PID:4076
-
\??\c:\nbbtnn.exec:\nbbtnn.exe98⤵PID:1060
-
\??\c:\dpppd.exec:\dpppd.exe99⤵PID:4996
-
\??\c:\7ppdv.exec:\7ppdv.exe100⤵PID:2144
-
\??\c:\5xrlxxx.exec:\5xrlxxx.exe101⤵PID:5108
-
\??\c:\tbbhbh.exec:\tbbhbh.exe102⤵PID:2008
-
\??\c:\7vppd.exec:\7vppd.exe103⤵PID:812
-
\??\c:\frrlxrl.exec:\frrlxrl.exe104⤵PID:2424
-
\??\c:\bhtnbb.exec:\bhtnbb.exe105⤵PID:1376
-
\??\c:\ttbttt.exec:\ttbttt.exe106⤵PID:3192
-
\??\c:\pjvpp.exec:\pjvpp.exe107⤵PID:4456
-
\??\c:\rflxrfr.exec:\rflxrfr.exe108⤵PID:1592
-
\??\c:\tnhtnh.exec:\tnhtnh.exe109⤵PID:3872
-
\??\c:\ppjdd.exec:\ppjdd.exe110⤵PID:940
-
\??\c:\dvjdp.exec:\dvjdp.exe111⤵PID:3572
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe112⤵PID:2556
-
\??\c:\thnnhh.exec:\thnnhh.exe113⤵PID:1612
-
\??\c:\pdjdd.exec:\pdjdd.exe114⤵PID:4008
-
\??\c:\fffxlfx.exec:\fffxlfx.exe115⤵PID:2028
-
\??\c:\nnhbbt.exec:\nnhbbt.exe116⤵PID:4812
-
\??\c:\5ddvp.exec:\5ddvp.exe117⤵PID:4072
-
\??\c:\1pjdv.exec:\1pjdv.exe118⤵PID:1428
-
\??\c:\5lxrlrr.exec:\5lxrlrr.exe119⤵PID:1620
-
\??\c:\bbhbbt.exec:\bbhbbt.exe120⤵PID:3716
-
\??\c:\5dvpd.exec:\5dvpd.exe121⤵PID:1744
-
\??\c:\xrlffxx.exec:\xrlffxx.exe122⤵
- System Location Discovery: System Language Discovery
PID:1080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-