Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9125b71d52991210dc862711780a8977_JaffaCakes118.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
9125b71d52991210dc862711780a8977_JaffaCakes118.exe
-
Size
91KB
-
MD5
9125b71d52991210dc862711780a8977
-
SHA1
7d71e7d26468b55d77a8481f059747024c89d302
-
SHA256
ddb01e0102c74582d816bba45a2ad8bc9b7556535d7f6a4f5535c85cdf0a0477
-
SHA512
5eda14585174deef761b0b6e31f85fe612e57fc6bac8aea04a79055b60e60adc8027d3341ac5b9af413d76b2c3ea85894f27284720671817733a84ccf330f82b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIRwnoh2UzSNuNR85/jn:ymb3NkkiQ3mdBjFo7LAIRUohT2Ny85/L
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/672-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-291-0x0000000076F70000-0x000000007706A000-memory.dmp family_blackmoon behavioral1/memory/2340-290-0x0000000077070000-0x000000007718F000-memory.dmp family_blackmoon behavioral1/memory/2340-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2504 nbhhbt.exe 2312 ddvjj.exe 2468 xrflxfr.exe 2684 5jvjp.exe 3000 1jjjj.exe 2992 nnttbn.exe 2716 bbbnhn.exe 2592 ffxfrfl.exe 2132 rrrrxfr.exe 2620 tnthtb.exe 1380 dvjjp.exe 1344 fxrrfxx.exe 1356 9flxlfl.exe 2008 nnhhtt.exe 2760 hhtbhh.exe 2680 7ddjp.exe 2952 ddpjj.exe 3064 flrxxrl.exe 672 ffrffrr.exe 2260 tbbnnb.exe 2080 jdvjj.exe 2556 lrfffff.exe 1752 9rfxllr.exe 3068 9nntbt.exe 2064 pvvvj.exe 792 djpjj.exe 1476 xrrfrrx.exe 2236 rxrrrxf.exe 1484 hnbhnh.exe 2340 vpvjd.exe 1264 rxlfrfr.exe 2144 jjpvp.exe 1892 9xlflxl.exe 1684 5xfrxrr.exe 2868 5ntbnt.exe 2996 9bttbh.exe 2840 jvvdv.exe 2316 1jvjj.exe 2884 3xfflxf.exe 864 hntbhh.exe 2648 bbhntb.exe 2572 dpvpp.exe 1872 3xllxxl.exe 2804 xllflfr.exe 1776 tnhtbn.exe 2792 1vjpd.exe 2784 jdvpj.exe 2636 rflrlll.exe 1808 lffrlrf.exe 2004 nbnhhb.exe 2796 nhbnnb.exe 1440 vppjv.exe 2224 xrllrrl.exe 2512 lxllrxl.exe 2396 nhhnbh.exe 916 1htbnh.exe 1732 dddvv.exe 3024 jjjvp.exe 1300 3rlllrf.exe 696 lxfrfxx.exe 3068 thnthh.exe 2156 nhtttn.exe 1348 jjpdd.exe 2428 jvdjp.exe -
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/672-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2504 2104 9125b71d52991210dc862711780a8977_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2504 2104 9125b71d52991210dc862711780a8977_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2504 2104 9125b71d52991210dc862711780a8977_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2504 2104 9125b71d52991210dc862711780a8977_JaffaCakes118.exe 30 PID 2504 wrote to memory of 2312 2504 nbhhbt.exe 31 PID 2504 wrote to memory of 2312 2504 nbhhbt.exe 31 PID 2504 wrote to memory of 2312 2504 nbhhbt.exe 31 PID 2504 wrote to memory of 2312 2504 nbhhbt.exe 31 PID 2312 wrote to memory of 2468 2312 ddvjj.exe 32 PID 2312 wrote to memory of 2468 2312 ddvjj.exe 32 PID 2312 wrote to memory of 2468 2312 ddvjj.exe 32 PID 2312 wrote to memory of 2468 2312 ddvjj.exe 32 PID 2468 wrote to memory of 2684 2468 xrflxfr.exe 33 PID 2468 wrote to memory of 2684 2468 xrflxfr.exe 33 PID 2468 wrote to memory of 2684 2468 xrflxfr.exe 33 PID 2468 wrote to memory of 2684 2468 xrflxfr.exe 33 PID 2684 wrote to memory of 3000 2684 5jvjp.exe 34 PID 2684 wrote to memory of 3000 2684 5jvjp.exe 34 PID 2684 wrote to memory of 3000 2684 5jvjp.exe 34 PID 2684 wrote to memory of 3000 2684 5jvjp.exe 34 PID 3000 wrote to memory of 2992 3000 1jjjj.exe 35 PID 3000 wrote to memory of 2992 3000 1jjjj.exe 35 PID 3000 wrote to memory of 2992 3000 1jjjj.exe 35 PID 3000 wrote to memory of 2992 3000 1jjjj.exe 35 PID 2992 wrote to memory of 2716 2992 nnttbn.exe 36 PID 2992 wrote to memory of 2716 2992 nnttbn.exe 36 PID 2992 wrote to memory of 2716 2992 nnttbn.exe 36 PID 2992 wrote to memory of 2716 2992 nnttbn.exe 36 PID 2716 wrote to memory of 2592 2716 bbbnhn.exe 37 PID 2716 wrote to memory of 2592 2716 bbbnhn.exe 37 PID 2716 wrote to memory of 2592 2716 bbbnhn.exe 37 PID 2716 wrote to memory of 2592 2716 bbbnhn.exe 37 PID 2592 wrote to memory of 2132 2592 ffxfrfl.exe 38 PID 2592 wrote to memory of 2132 2592 ffxfrfl.exe 38 PID 2592 wrote to memory of 2132 2592 ffxfrfl.exe 38 PID 2592 wrote to memory of 2132 2592 ffxfrfl.exe 38 PID 2132 wrote to memory of 2620 2132 rrrrxfr.exe 39 PID 2132 wrote to memory of 2620 2132 rrrrxfr.exe 39 PID 2132 wrote to memory of 2620 2132 rrrrxfr.exe 39 PID 2132 wrote to memory of 2620 2132 rrrrxfr.exe 39 PID 2620 wrote to memory of 1380 2620 tnthtb.exe 40 PID 2620 wrote to memory of 1380 2620 tnthtb.exe 40 PID 2620 wrote to memory of 1380 2620 tnthtb.exe 40 PID 2620 wrote to memory of 1380 2620 tnthtb.exe 40 PID 1380 wrote to memory of 1344 1380 dvjjp.exe 41 PID 1380 wrote to memory of 1344 1380 dvjjp.exe 41 PID 1380 wrote to memory of 1344 1380 dvjjp.exe 41 PID 1380 wrote to memory of 1344 1380 dvjjp.exe 41 PID 1344 wrote to memory of 1356 1344 fxrrfxx.exe 42 PID 1344 wrote to memory of 1356 1344 fxrrfxx.exe 42 PID 1344 wrote to memory of 1356 1344 fxrrfxx.exe 42 PID 1344 wrote to memory of 1356 1344 fxrrfxx.exe 42 PID 1356 wrote to memory of 2008 1356 9flxlfl.exe 43 PID 1356 wrote to memory of 2008 1356 9flxlfl.exe 43 PID 1356 wrote to memory of 2008 1356 9flxlfl.exe 43 PID 1356 wrote to memory of 2008 1356 9flxlfl.exe 43 PID 2008 wrote to memory of 2760 2008 nnhhtt.exe 44 PID 2008 wrote to memory of 2760 2008 nnhhtt.exe 44 PID 2008 wrote to memory of 2760 2008 nnhhtt.exe 44 PID 2008 wrote to memory of 2760 2008 nnhhtt.exe 44 PID 2760 wrote to memory of 2680 2760 hhtbhh.exe 45 PID 2760 wrote to memory of 2680 2760 hhtbhh.exe 45 PID 2760 wrote to memory of 2680 2760 hhtbhh.exe 45 PID 2760 wrote to memory of 2680 2760 hhtbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9125b71d52991210dc862711780a8977_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9125b71d52991210dc862711780a8977_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\nbhhbt.exec:\nbhhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\ddvjj.exec:\ddvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xrflxfr.exec:\xrflxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\5jvjp.exec:\5jvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\1jjjj.exec:\1jjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nnttbn.exec:\nnttbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\bbbnhn.exec:\bbbnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ffxfrfl.exec:\ffxfrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\tnthtb.exec:\tnthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvjjp.exec:\dvjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\fxrrfxx.exec:\fxrrfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\9flxlfl.exec:\9flxlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\nnhhtt.exec:\nnhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\hhtbhh.exec:\hhtbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7ddjp.exec:\7ddjp.exe17⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ddpjj.exec:\ddpjj.exe18⤵
- Executes dropped EXE
PID:2952 -
\??\c:\flrxxrl.exec:\flrxxrl.exe19⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ffrffrr.exec:\ffrffrr.exe20⤵
- Executes dropped EXE
PID:672 -
\??\c:\tbbnnb.exec:\tbbnnb.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jdvjj.exec:\jdvjj.exe22⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lrfffff.exec:\lrfffff.exe23⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9rfxllr.exec:\9rfxllr.exe24⤵
- Executes dropped EXE
PID:1752 -
\??\c:\9nntbt.exec:\9nntbt.exe25⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvvvj.exec:\pvvvj.exe26⤵
- Executes dropped EXE
PID:2064 -
\??\c:\djpjj.exec:\djpjj.exe27⤵
- Executes dropped EXE
PID:792 -
\??\c:\xrrfrrx.exec:\xrrfrrx.exe28⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rxrrrxf.exec:\rxrrrxf.exe29⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hnbhnh.exec:\hnbhnh.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vpvjd.exec:\vpvjd.exe31⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7ddjv.exec:\7ddjv.exe32⤵PID:2364
-
\??\c:\rxlfrfr.exec:\rxlfrfr.exe33⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jjpvp.exec:\jjpvp.exe34⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9xlflxl.exec:\9xlflxl.exe35⤵
- Executes dropped EXE
PID:1892 -
\??\c:\5xfrxrr.exec:\5xfrxrr.exe36⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5ntbnt.exec:\5ntbnt.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9bttbh.exec:\9bttbh.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jvvdv.exec:\jvvdv.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1jvjj.exec:\1jvjj.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3xfflxf.exec:\3xfflxf.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hntbhh.exec:\hntbhh.exe42⤵
- Executes dropped EXE
PID:864 -
\??\c:\bbhntb.exec:\bbhntb.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dpvpp.exec:\dpvpp.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3xllxxl.exec:\3xllxxl.exe45⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xllflfr.exec:\xllflfr.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tnhtbn.exec:\tnhtbn.exe47⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1vjpd.exec:\1vjpd.exe48⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jdvpj.exec:\jdvpj.exe49⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rflrlll.exec:\rflrlll.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lffrlrf.exec:\lffrlrf.exe51⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nbnhhb.exec:\nbnhhb.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nhbnnb.exec:\nhbnnb.exe53⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vppjv.exec:\vppjv.exe54⤵
- Executes dropped EXE
PID:1440 -
\??\c:\xrllrrl.exec:\xrllrrl.exe55⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lxllrxl.exec:\lxllrxl.exe56⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhhnbh.exec:\nhhnbh.exe57⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1htbnh.exec:\1htbnh.exe58⤵
- Executes dropped EXE
PID:916 -
\??\c:\dddvv.exec:\dddvv.exe59⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jjjvp.exec:\jjjvp.exe60⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3rlllrf.exec:\3rlllrf.exe61⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lxfrfxx.exec:\lxfrfxx.exe62⤵
- Executes dropped EXE
PID:696 -
\??\c:\thnthh.exec:\thnthh.exe63⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nhtttn.exec:\nhtttn.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjpdd.exec:\jjpdd.exe65⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jvdjp.exec:\jvdjp.exe66⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlllffx.exec:\rlllffx.exe67⤵PID:1548
-
\??\c:\rfrxlrf.exec:\rfrxlrf.exe68⤵PID:3004
-
\??\c:\nhnnth.exec:\nhnnth.exe69⤵PID:2460
-
\??\c:\5bbhtt.exec:\5bbhtt.exe70⤵PID:1900
-
\??\c:\pdjjd.exec:\pdjjd.exe71⤵PID:1700
-
\??\c:\xfllflf.exec:\xfllflf.exe72⤵PID:2508
-
\??\c:\lxrlxxl.exec:\lxrlxxl.exe73⤵PID:1592
-
\??\c:\btbhhh.exec:\btbhhh.exe74⤵PID:2116
-
\??\c:\9nttbh.exec:\9nttbh.exe75⤵PID:2736
-
\??\c:\dvjdp.exec:\dvjdp.exe76⤵PID:2724
-
\??\c:\3dvvj.exec:\3dvvj.exe77⤵PID:2720
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe78⤵PID:3000
-
\??\c:\5nbhbb.exec:\5nbhbb.exe79⤵PID:2856
-
\??\c:\hbhhnn.exec:\hbhhnn.exe80⤵PID:2836
-
\??\c:\djvvd.exec:\djvvd.exe81⤵PID:2884
-
\??\c:\vpjjj.exec:\vpjjj.exe82⤵PID:2748
-
\??\c:\frxfllx.exec:\frxfllx.exe83⤵PID:2700
-
\??\c:\fxflxxf.exec:\fxflxxf.exe84⤵PID:2252
-
\??\c:\btntbh.exec:\btntbh.exe85⤵PID:2800
-
\??\c:\dvjjd.exec:\dvjjd.exe86⤵PID:1936
-
\??\c:\jpvvj.exec:\jpvvj.exe87⤵
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\9lxfllf.exec:\9lxfllf.exe88⤵PID:400
-
\??\c:\9fflxlx.exec:\9fflxlx.exe89⤵PID:1660
-
\??\c:\9tnbnt.exec:\9tnbnt.exe90⤵PID:2416
-
\??\c:\ddjvv.exec:\ddjvv.exe91⤵PID:1644
-
\??\c:\vddvd.exec:\vddvd.exe92⤵PID:1740
-
\??\c:\xxxlflx.exec:\xxxlflx.exe93⤵PID:1828
-
\??\c:\lxllflf.exec:\lxllflf.exe94⤵PID:1860
-
\??\c:\tnbhtb.exec:\tnbhtb.exe95⤵PID:3064
-
\??\c:\9vppd.exec:\9vppd.exe96⤵PID:1032
-
\??\c:\3dvpv.exec:\3dvpv.exe97⤵PID:1812
-
\??\c:\5frxfll.exec:\5frxfll.exe98⤵PID:3020
-
\??\c:\3xrllll.exec:\3xrllll.exe99⤵PID:3008
-
\??\c:\9tnbbh.exec:\9tnbbh.exe100⤵PID:308
-
\??\c:\jjvjp.exec:\jjvjp.exe101⤵PID:1604
-
\??\c:\3vvvj.exec:\3vvvj.exe102⤵PID:1788
-
\??\c:\fxlxlrr.exec:\fxlxlrr.exe103⤵PID:736
-
\??\c:\3rllrrl.exec:\3rllrrl.exe104⤵PID:2204
-
\??\c:\bhbbbh.exec:\bhbbbh.exe105⤵PID:988
-
\??\c:\9jpdp.exec:\9jpdp.exe106⤵PID:2236
-
\??\c:\vpvdp.exec:\vpvdp.exe107⤵PID:2124
-
\??\c:\fflrrfr.exec:\fflrrfr.exe108⤵PID:1908
-
\??\c:\9bhttn.exec:\9bhttn.exe109⤵PID:2488
-
\??\c:\ntbthb.exec:\ntbthb.exe110⤵PID:2376
-
\??\c:\ppddp.exec:\ppddp.exe111⤵PID:2352
-
\??\c:\pppdj.exec:\pppdj.exe112⤵PID:3056
-
\??\c:\flfrfrl.exec:\flfrfrl.exe113⤵PID:2144
-
\??\c:\hnbtbn.exec:\hnbtbn.exe114⤵PID:1892
-
\??\c:\5httnh.exec:\5httnh.exe115⤵PID:2876
-
\??\c:\hbntht.exec:\hbntht.exe116⤵PID:2704
-
\??\c:\dddvj.exec:\dddvj.exe117⤵PID:2696
-
\??\c:\jpppp.exec:\jpppp.exe118⤵PID:2888
-
\??\c:\lxrlxrx.exec:\lxrlxrx.exe119⤵PID:2992
-
\??\c:\llrrllx.exec:\llrrllx.exe120⤵PID:2632
-
\??\c:\pppdv.exec:\pppdv.exe121⤵PID:2592
-
\??\c:\xrflrrr.exec:\xrflrrr.exe122⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-