Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 10:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe
-
Size
68KB
-
MD5
9404d70062e3e25fb6f1201b65cb0404
-
SHA1
7a87dde66bde49d296e10d8e2088a898d61e3fa5
-
SHA256
7f0815208ed42232932fdafccf6ddce999b7e4e669e5f206144f2dd7b369f3ec
-
SHA512
f0befac56464d4d4f6ad9c6a27f2441689cc8ae435faffd88e558eefa8159cab9249038d3552c26bb6f2a58c013fb95bf9c045d45cd73d4a5f724036612fe9a8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qmPz:ymb3NkkiQ3mdBjFIj+qmr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/1520-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 thhntn.exe 2232 llrfxfl.exe 2980 flrlxxl.exe 2952 tnbnhn.exe 2992 ppppd.exe 2864 ffxfrxl.exe 2728 nnttth.exe 2988 ppvvj.exe 2492 lflrlxx.exe 1340 xxllffx.exe 2676 hnbhhn.exe 568 ddpvd.exe 1456 pppvj.exe 448 lrffxxf.exe 2084 llrrxxf.exe 1564 bbhtbh.exe 608 ddddp.exe 1620 ppjdp.exe 1972 lfllllr.exe 2480 xfxxlrl.exe 272 bthhtb.exe 628 ppvvv.exe 1000 jjjpp.exe 2108 xrflxxf.exe 1088 3xrfrff.exe 1724 7tbthn.exe 2664 5vjvj.exe 264 jdpvp.exe 2392 1lfrfxl.exe 1708 5nbhnt.exe 2880 9hntbh.exe 2932 9vjpd.exe 2852 5jppj.exe 3068 rrxflrf.exe 1568 llrrxff.exe 2956 tntbnn.exe 2896 bbhthn.exe 2832 3vpdj.exe 2860 1pjpp.exe 2816 7rflxfr.exe 2424 llxfflr.exe 1852 hhnhnn.exe 1896 hbbnbh.exe 924 3vppv.exe 1968 3vvdp.exe 3000 7lrxlrx.exe 3036 5xffrxf.exe 2412 bbhthn.exe 2684 5nhnhn.exe 652 jjjpv.exe 2468 vjvvp.exe 1144 fxflllr.exe 2180 lxlrffl.exe 2396 tbbhtb.exe 2972 bhbhtn.exe 2248 ddjjv.exe 2316 djvvj.exe 2208 rlrfxfl.exe 2164 rlrxrfl.exe 1552 nhhbhb.exe 944 hhttbb.exe 1768 bbnntt.exe 2284 5vvjp.exe 1592 dvjjv.exe -
resource yara_rule behavioral1/memory/1520-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthttt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 3052 1520 9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe 30 PID 1520 wrote to memory of 3052 1520 9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe 30 PID 1520 wrote to memory of 3052 1520 9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe 30 PID 1520 wrote to memory of 3052 1520 9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe 30 PID 3052 wrote to memory of 2232 3052 thhntn.exe 31 PID 3052 wrote to memory of 2232 3052 thhntn.exe 31 PID 3052 wrote to memory of 2232 3052 thhntn.exe 31 PID 3052 wrote to memory of 2232 3052 thhntn.exe 31 PID 2232 wrote to memory of 2980 2232 llrfxfl.exe 32 PID 2232 wrote to memory of 2980 2232 llrfxfl.exe 32 PID 2232 wrote to memory of 2980 2232 llrfxfl.exe 32 PID 2232 wrote to memory of 2980 2232 llrfxfl.exe 32 PID 2980 wrote to memory of 2952 2980 flrlxxl.exe 33 PID 2980 wrote to memory of 2952 2980 flrlxxl.exe 33 PID 2980 wrote to memory of 2952 2980 flrlxxl.exe 33 PID 2980 wrote to memory of 2952 2980 flrlxxl.exe 33 PID 2952 wrote to memory of 2992 2952 tnbnhn.exe 34 PID 2952 wrote to memory of 2992 2952 tnbnhn.exe 34 PID 2952 wrote to memory of 2992 2952 tnbnhn.exe 34 PID 2952 wrote to memory of 2992 2952 tnbnhn.exe 34 PID 2992 wrote to memory of 2864 2992 ppppd.exe 35 PID 2992 wrote to memory of 2864 2992 ppppd.exe 35 PID 2992 wrote to memory of 2864 2992 ppppd.exe 35 PID 2992 wrote to memory of 2864 2992 ppppd.exe 35 PID 2864 wrote to memory of 2728 2864 ffxfrxl.exe 36 PID 2864 wrote to memory of 2728 2864 ffxfrxl.exe 36 PID 2864 wrote to memory of 2728 2864 ffxfrxl.exe 36 PID 2864 wrote to memory of 2728 2864 ffxfrxl.exe 36 PID 2728 wrote to memory of 2988 2728 nnttth.exe 37 PID 2728 wrote to memory of 2988 2728 nnttth.exe 37 PID 2728 wrote to memory of 2988 2728 nnttth.exe 37 PID 2728 wrote to memory of 2988 2728 nnttth.exe 37 PID 2988 wrote to memory of 2492 2988 ppvvj.exe 38 PID 2988 wrote to memory of 2492 2988 ppvvj.exe 38 PID 2988 wrote to memory of 2492 2988 ppvvj.exe 38 PID 2988 wrote to memory of 2492 2988 ppvvj.exe 38 PID 2492 wrote to memory of 1340 2492 lflrlxx.exe 39 PID 2492 wrote to memory of 1340 2492 lflrlxx.exe 39 PID 2492 wrote to memory of 1340 2492 lflrlxx.exe 39 PID 2492 wrote to memory of 1340 2492 lflrlxx.exe 39 PID 1340 wrote to memory of 2676 1340 xxllffx.exe 40 PID 1340 wrote to memory of 2676 1340 xxllffx.exe 40 PID 1340 wrote to memory of 2676 1340 xxllffx.exe 40 PID 1340 wrote to memory of 2676 1340 xxllffx.exe 40 PID 2676 wrote to memory of 568 2676 hnbhhn.exe 41 PID 2676 wrote to memory of 568 2676 hnbhhn.exe 41 PID 2676 wrote to memory of 568 2676 hnbhhn.exe 41 PID 2676 wrote to memory of 568 2676 hnbhhn.exe 41 PID 568 wrote to memory of 1456 568 ddpvd.exe 42 PID 568 wrote to memory of 1456 568 ddpvd.exe 42 PID 568 wrote to memory of 1456 568 ddpvd.exe 42 PID 568 wrote to memory of 1456 568 ddpvd.exe 42 PID 1456 wrote to memory of 448 1456 pppvj.exe 43 PID 1456 wrote to memory of 448 1456 pppvj.exe 43 PID 1456 wrote to memory of 448 1456 pppvj.exe 43 PID 1456 wrote to memory of 448 1456 pppvj.exe 43 PID 448 wrote to memory of 2084 448 lrffxxf.exe 44 PID 448 wrote to memory of 2084 448 lrffxxf.exe 44 PID 448 wrote to memory of 2084 448 lrffxxf.exe 44 PID 448 wrote to memory of 2084 448 lrffxxf.exe 44 PID 2084 wrote to memory of 1564 2084 llrrxxf.exe 45 PID 2084 wrote to memory of 1564 2084 llrrxxf.exe 45 PID 2084 wrote to memory of 1564 2084 llrrxxf.exe 45 PID 2084 wrote to memory of 1564 2084 llrrxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9404d70062e3e25fb6f1201b65cb0404_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\thhntn.exec:\thhntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\llrfxfl.exec:\llrfxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\flrlxxl.exec:\flrlxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\tnbnhn.exec:\tnbnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ppppd.exec:\ppppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nnttth.exec:\nnttth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ppvvj.exec:\ppvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\lflrlxx.exec:\lflrlxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xxllffx.exec:\xxllffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\hnbhhn.exec:\hnbhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ddpvd.exec:\ddpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\pppvj.exec:\pppvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\lrffxxf.exec:\lrffxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\llrrxxf.exec:\llrrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\bbhtbh.exec:\bbhtbh.exe17⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ddddp.exec:\ddddp.exe18⤵
- Executes dropped EXE
PID:608 -
\??\c:\ppjdp.exec:\ppjdp.exe19⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lfllllr.exec:\lfllllr.exe20⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xfxxlrl.exec:\xfxxlrl.exe21⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bthhtb.exec:\bthhtb.exe22⤵
- Executes dropped EXE
PID:272 -
\??\c:\ppvvv.exec:\ppvvv.exe23⤵
- Executes dropped EXE
PID:628 -
\??\c:\jjjpp.exec:\jjjpp.exe24⤵
- Executes dropped EXE
PID:1000 -
\??\c:\xrflxxf.exec:\xrflxxf.exe25⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3xrfrff.exec:\3xrfrff.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7tbthn.exec:\7tbthn.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5vjvj.exec:\5vjvj.exe28⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdpvp.exec:\jdpvp.exe29⤵
- Executes dropped EXE
PID:264 -
\??\c:\1lfrfxl.exec:\1lfrfxl.exe30⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5nbhnt.exec:\5nbhnt.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9hntbh.exec:\9hntbh.exe32⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9vjpd.exec:\9vjpd.exe33⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5jppj.exec:\5jppj.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrxflrf.exec:\rrxflrf.exe35⤵
- Executes dropped EXE
PID:3068 -
\??\c:\llrrxff.exec:\llrrxff.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tntbnn.exec:\tntbnn.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bbhthn.exec:\bbhthn.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3vpdj.exec:\3vpdj.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1pjpp.exec:\1pjpp.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7rflxfr.exec:\7rflxfr.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\llxfflr.exec:\llxfflr.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hhnhnn.exec:\hhnhnn.exe43⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hbbnbh.exec:\hbbnbh.exe44⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3vppv.exec:\3vppv.exe45⤵
- Executes dropped EXE
PID:924 -
\??\c:\3vvdp.exec:\3vvdp.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7lrxlrx.exec:\7lrxlrx.exe47⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5xffrxf.exec:\5xffrxf.exe48⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bbhthn.exec:\bbhthn.exe49⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5nhnhn.exec:\5nhnhn.exe50⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjjpv.exec:\jjjpv.exe51⤵
- Executes dropped EXE
PID:652 -
\??\c:\vjvvp.exec:\vjvvp.exe52⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fxflllr.exec:\fxflllr.exe53⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lxlrffl.exec:\lxlrffl.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tbbhtb.exec:\tbbhtb.exe55⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bhbhtn.exec:\bhbhtn.exe56⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ddjjv.exec:\ddjjv.exe57⤵
- Executes dropped EXE
PID:2248 -
\??\c:\djvvj.exec:\djvvj.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rlrfxfl.exec:\rlrfxfl.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rlrxrfl.exec:\rlrxrfl.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhhbhb.exec:\nhhbhb.exe61⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hhttbb.exec:\hhttbb.exe62⤵
- Executes dropped EXE
PID:944 -
\??\c:\bbnntt.exec:\bbnntt.exe63⤵
- Executes dropped EXE
PID:1768 -
\??\c:\5vvjp.exec:\5vvjp.exe64⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dvjjv.exec:\dvjjv.exe65⤵
- Executes dropped EXE
PID:1592 -
\??\c:\btthtb.exec:\btthtb.exe66⤵PID:2196
-
\??\c:\ttbbnn.exec:\ttbbnn.exe67⤵PID:2664
-
\??\c:\9jppv.exec:\9jppv.exe68⤵PID:1588
-
\??\c:\xxlrrxx.exec:\xxlrrxx.exe69⤵PID:1520
-
\??\c:\7ffflll.exec:\7ffflll.exe70⤵PID:3004
-
\??\c:\5xrfrxf.exec:\5xrfrxf.exe71⤵PID:3052
-
\??\c:\5hbhhn.exec:\5hbhhn.exe72⤵PID:2836
-
\??\c:\nhhhtb.exec:\nhhhtb.exe73⤵PID:2928
-
\??\c:\vvpvp.exec:\vvpvp.exe74⤵PID:1952
-
\??\c:\7jpvj.exec:\7jpvj.exe75⤵PID:2132
-
\??\c:\ffrrflf.exec:\ffrrflf.exe76⤵PID:2856
-
\??\c:\rrrrfrf.exec:\rrrrfrf.exe77⤵PID:2952
-
\??\c:\bhttbh.exec:\bhttbh.exe78⤵PID:1636
-
\??\c:\hbntbb.exec:\hbntbb.exe79⤵PID:2716
-
\??\c:\vpppv.exec:\vpppv.exe80⤵PID:2476
-
\??\c:\vvdpd.exec:\vvdpd.exe81⤵PID:2712
-
\??\c:\rrffffr.exec:\rrffffr.exe82⤵PID:2224
-
\??\c:\frlxffx.exec:\frlxffx.exe83⤵PID:3028
-
\??\c:\hbbbht.exec:\hbbbht.exe84⤵PID:2492
-
\??\c:\9nnbhh.exec:\9nnbhh.exe85⤵PID:2360
-
\??\c:\3jvvv.exec:\3jvvv.exe86⤵PID:2128
-
\??\c:\3jppv.exec:\3jppv.exe87⤵PID:3048
-
\??\c:\1rfflrr.exec:\1rfflrr.exe88⤵PID:2456
-
\??\c:\xrxlxxf.exec:\xrxlxxf.exe89⤵PID:2460
-
\??\c:\nntthh.exec:\nntthh.exe90⤵PID:2756
-
\??\c:\tthhbh.exec:\tthhbh.exe91⤵PID:1224
-
\??\c:\1vpvd.exec:\1vpvd.exe92⤵PID:1132
-
\??\c:\vpdvj.exec:\vpdvj.exe93⤵PID:1260
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe94⤵PID:2388
-
\??\c:\rlrflrf.exec:\rlrflrf.exe95⤵PID:2216
-
\??\c:\hbnthn.exec:\hbnthn.exe96⤵PID:1972
-
\??\c:\nhhthh.exec:\nhhthh.exe97⤵PID:2240
-
\??\c:\pjjvj.exec:\pjjvj.exe98⤵PID:1496
-
\??\c:\7jddd.exec:\7jddd.exe99⤵PID:2104
-
\??\c:\xxffrrx.exec:\xxffrrx.exe100⤵PID:828
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe101⤵PID:716
-
\??\c:\rrfflxl.exec:\rrfflxl.exe102⤵PID:2108
-
\??\c:\bbhhnn.exec:\bbhhnn.exe103⤵PID:2668
-
\??\c:\pjvpd.exec:\pjvpd.exe104⤵PID:1724
-
\??\c:\3djvj.exec:\3djvj.exe105⤵PID:1012
-
\??\c:\1lxfrfl.exec:\1lxfrfl.exe106⤵PID:340
-
\??\c:\3fxlrfr.exec:\3fxlrfr.exe107⤵PID:1668
-
\??\c:\rrxlxxl.exec:\rrxlxxl.exe108⤵PID:2404
-
\??\c:\hnbhbn.exec:\hnbhbn.exe109⤵PID:2332
-
\??\c:\9ntthn.exec:\9ntthn.exe110⤵PID:2824
-
\??\c:\3jjdp.exec:\3jjdp.exe111⤵PID:2840
-
\??\c:\dpjdp.exec:\dpjdp.exe112⤵PID:2804
-
\??\c:\rrxfffl.exec:\rrxfffl.exe113⤵PID:2828
-
\??\c:\9xffxxl.exec:\9xffxxl.exe114⤵PID:3008
-
\??\c:\lrllrxf.exec:\lrllrxf.exe115⤵PID:3068
-
\??\c:\bbbbnn.exec:\bbbbnn.exe116⤵PID:3032
-
\??\c:\3hntbb.exec:\3hntbb.exe117⤵PID:2956
-
\??\c:\vppjd.exec:\vppjd.exe118⤵PID:2832
-
\??\c:\vdjvj.exec:\vdjvj.exe119⤵PID:2740
-
\??\c:\llxllrx.exec:\llxllrx.exe120⤵PID:2728
-
\??\c:\rrfxllr.exec:\rrfxllr.exe121⤵PID:2816
-
\??\c:\bhhthh.exec:\bhhthh.exe122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-