Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 03:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe
-
Size
198KB
-
MD5
02571da8f25665e3ec754d43822aec1d
-
SHA1
b5d19fe45266625319e2e2f1293a8b1779b3c789
-
SHA256
5849f424983eda4a8e4f1ee10e0c77d0338397d77a9acb91bebf34706c3da882
-
SHA512
c4229cd0f1560ac06807d0c212f7498fed24c955a8584b4b38d33cd5584704ec3873468069738748142ce07abfce83deef3f00eaebd02543b0b112c02ce76317
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyV/TW:PhOm2sI93UufdC67cihV/TW
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1656-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-72-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2780-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-173-0x00000000002E0000-0x0000000000309000-memory.dmp family_blackmoon behavioral1/memory/2824-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-466-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-479-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-499-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-576-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-589-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-654-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-737-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-818-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-975-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-982-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-1065-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-1080-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 380 btbbbh.exe 2832 pddvp.exe 2460 rllxxrx.exe 2504 3hnbbn.exe 2540 tnttbh.exe 2672 vpjdd.exe 2400 jpvpj.exe 2384 bhhtnb.exe 2780 hbhhhb.exe 2324 pdpdj.exe 1228 3ffrrll.exe 2588 5tbhbb.exe 1728 tnttbt.exe 1216 7dddd.exe 2312 1rxrlff.exe 1740 nbhhhb.exe 2272 bntttt.exe 1152 jvjjp.exe 2824 pjpvj.exe 1848 frxrllf.exe 1904 thbtht.exe 268 5jvvv.exe 1416 7ppvp.exe 1772 9rfflrf.exe 1072 bnnhhh.exe 1880 pdjjv.exe 816 3hnhnh.exe 904 5bbbbt.exe 684 dvdjj.exe 1920 3frllll.exe 2840 xlffrxx.exe 1944 5thntn.exe 1996 pdvpv.exe 1664 frffllx.exe 2880 1fxlrll.exe 2552 nhntbb.exe 2196 jvjjp.exe 2500 fflxrll.exe 2716 frxfrlr.exe 2624 bthhbb.exe 2524 hnbnnh.exe 2260 5pvvd.exe 2488 rfffrrr.exe 2424 5bnntb.exe 3000 nbhhtb.exe 2780 jdpvd.exe 1224 pddvv.exe 2096 1lrlxrr.exe 1228 1nhnth.exe 2660 hbnnbh.exe 2128 jpdvv.exe 1708 jdjvj.exe 2124 xrxrllr.exe 2312 1nbttb.exe 2276 tnbhnh.exe 2040 pdddd.exe 1688 djjdd.exe 2828 rrfxlrx.exe 2692 lxfflll.exe 2020 nhhntb.exe 1964 nttntn.exe 1904 vpddd.exe 484 jdpdj.exe 812 9lflxxf.exe -
resource yara_rule behavioral1/memory/1656-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-479-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-480-0x0000000000230000-0x0000000000259000-memory.dmp upx behavioral1/memory/484-499-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-530-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-563-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-576-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-589-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-621-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-628-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-641-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-654-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-655-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-680-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/296-711-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-737-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-798-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-818-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-831-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-880-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-929-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-936-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-943-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 380 1656 02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe 28 PID 1656 wrote to memory of 380 1656 02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe 28 PID 1656 wrote to memory of 380 1656 02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe 28 PID 1656 wrote to memory of 380 1656 02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe 28 PID 380 wrote to memory of 2832 380 btbbbh.exe 29 PID 380 wrote to memory of 2832 380 btbbbh.exe 29 PID 380 wrote to memory of 2832 380 btbbbh.exe 29 PID 380 wrote to memory of 2832 380 btbbbh.exe 29 PID 2832 wrote to memory of 2460 2832 pddvp.exe 30 PID 2832 wrote to memory of 2460 2832 pddvp.exe 30 PID 2832 wrote to memory of 2460 2832 pddvp.exe 30 PID 2832 wrote to memory of 2460 2832 pddvp.exe 30 PID 2460 wrote to memory of 2504 2460 rllxxrx.exe 31 PID 2460 wrote to memory of 2504 2460 rllxxrx.exe 31 PID 2460 wrote to memory of 2504 2460 rllxxrx.exe 31 PID 2460 wrote to memory of 2504 2460 rllxxrx.exe 31 PID 2504 wrote to memory of 2540 2504 3hnbbn.exe 32 PID 2504 wrote to memory of 2540 2504 3hnbbn.exe 32 PID 2504 wrote to memory of 2540 2504 3hnbbn.exe 32 PID 2504 wrote to memory of 2540 2504 3hnbbn.exe 32 PID 2540 wrote to memory of 2672 2540 tnttbh.exe 33 PID 2540 wrote to memory of 2672 2540 tnttbh.exe 33 PID 2540 wrote to memory of 2672 2540 tnttbh.exe 33 PID 2540 wrote to memory of 2672 2540 tnttbh.exe 33 PID 2672 wrote to memory of 2400 2672 vpjdd.exe 34 PID 2672 wrote to memory of 2400 2672 vpjdd.exe 34 PID 2672 wrote to memory of 2400 2672 vpjdd.exe 34 PID 2672 wrote to memory of 2400 2672 vpjdd.exe 34 PID 2400 wrote to memory of 2384 2400 jpvpj.exe 35 PID 2400 wrote to memory of 2384 2400 jpvpj.exe 35 PID 2400 wrote to memory of 2384 2400 jpvpj.exe 35 PID 2400 wrote to memory of 2384 2400 jpvpj.exe 35 PID 2384 wrote to memory of 2780 2384 bhhtnb.exe 36 PID 2384 wrote to memory of 2780 2384 bhhtnb.exe 36 PID 2384 wrote to memory of 2780 2384 bhhtnb.exe 36 PID 2384 wrote to memory of 2780 2384 bhhtnb.exe 36 PID 2780 wrote to memory of 2324 2780 hbhhhb.exe 37 PID 2780 wrote to memory of 2324 2780 hbhhhb.exe 37 PID 2780 wrote to memory of 2324 2780 hbhhhb.exe 37 PID 2780 wrote to memory of 2324 2780 hbhhhb.exe 37 PID 2324 wrote to memory of 1228 2324 pdpdj.exe 38 PID 2324 wrote to memory of 1228 2324 pdpdj.exe 38 PID 2324 wrote to memory of 1228 2324 pdpdj.exe 38 PID 2324 wrote to memory of 1228 2324 pdpdj.exe 38 PID 1228 wrote to memory of 2588 1228 3ffrrll.exe 39 PID 1228 wrote to memory of 2588 1228 3ffrrll.exe 39 PID 1228 wrote to memory of 2588 1228 3ffrrll.exe 39 PID 1228 wrote to memory of 2588 1228 3ffrrll.exe 39 PID 2588 wrote to memory of 1728 2588 5tbhbb.exe 40 PID 2588 wrote to memory of 1728 2588 5tbhbb.exe 40 PID 2588 wrote to memory of 1728 2588 5tbhbb.exe 40 PID 2588 wrote to memory of 1728 2588 5tbhbb.exe 40 PID 1728 wrote to memory of 1216 1728 tnttbt.exe 41 PID 1728 wrote to memory of 1216 1728 tnttbt.exe 41 PID 1728 wrote to memory of 1216 1728 tnttbt.exe 41 PID 1728 wrote to memory of 1216 1728 tnttbt.exe 41 PID 1216 wrote to memory of 2312 1216 7dddd.exe 42 PID 1216 wrote to memory of 2312 1216 7dddd.exe 42 PID 1216 wrote to memory of 2312 1216 7dddd.exe 42 PID 1216 wrote to memory of 2312 1216 7dddd.exe 42 PID 2312 wrote to memory of 1740 2312 1rxrlff.exe 43 PID 2312 wrote to memory of 1740 2312 1rxrlff.exe 43 PID 2312 wrote to memory of 1740 2312 1rxrlff.exe 43 PID 2312 wrote to memory of 1740 2312 1rxrlff.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\btbbbh.exec:\btbbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\pddvp.exec:\pddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rllxxrx.exec:\rllxxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\3hnbbn.exec:\3hnbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\tnttbh.exec:\tnttbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vpjdd.exec:\vpjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\jpvpj.exec:\jpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\bhhtnb.exec:\bhhtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\hbhhhb.exec:\hbhhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\pdpdj.exec:\pdpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3ffrrll.exec:\3ffrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\5tbhbb.exec:\5tbhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tnttbt.exec:\tnttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\7dddd.exec:\7dddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\1rxrlff.exec:\1rxrlff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\nbhhhb.exec:\nbhhhb.exe17⤵
- Executes dropped EXE
PID:1740 -
\??\c:\bntttt.exec:\bntttt.exe18⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jvjjp.exec:\jvjjp.exe19⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pjpvj.exec:\pjpvj.exe20⤵
- Executes dropped EXE
PID:2824 -
\??\c:\frxrllf.exec:\frxrllf.exe21⤵
- Executes dropped EXE
PID:1848 -
\??\c:\thbtht.exec:\thbtht.exe22⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5jvvv.exec:\5jvvv.exe23⤵
- Executes dropped EXE
PID:268 -
\??\c:\7ppvp.exec:\7ppvp.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\9rfflrf.exec:\9rfflrf.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bnnhhh.exec:\bnnhhh.exe26⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pdjjv.exec:\pdjjv.exe27⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3hnhnh.exec:\3hnhnh.exe28⤵
- Executes dropped EXE
PID:816 -
\??\c:\5bbbbt.exec:\5bbbbt.exe29⤵
- Executes dropped EXE
PID:904 -
\??\c:\dvdjj.exec:\dvdjj.exe30⤵
- Executes dropped EXE
PID:684 -
\??\c:\3frllll.exec:\3frllll.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xlffrxx.exec:\xlffrxx.exe32⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5thntn.exec:\5thntn.exe33⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pdvpv.exec:\pdvpv.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\frffllx.exec:\frffllx.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1fxlrll.exec:\1fxlrll.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhntbb.exec:\nhntbb.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jvjjp.exec:\jvjjp.exe38⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fflxrll.exec:\fflxrll.exe39⤵
- Executes dropped EXE
PID:2500 -
\??\c:\frxfrlr.exec:\frxfrlr.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bthhbb.exec:\bthhbb.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hnbnnh.exec:\hnbnnh.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5pvvd.exec:\5pvvd.exe43⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rfffrrr.exec:\rfffrrr.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5bnntb.exec:\5bnntb.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nbhhtb.exec:\nbhhtb.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jdpvd.exec:\jdpvd.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pddvv.exec:\pddvv.exe48⤵
- Executes dropped EXE
PID:1224 -
\??\c:\1lrlxrr.exec:\1lrlxrr.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1nhnth.exec:\1nhnth.exe50⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hbnnbh.exec:\hbnnbh.exe51⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jpdvv.exec:\jpdvv.exe52⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdjvj.exec:\jdjvj.exe53⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xrxrllr.exec:\xrxrllr.exe54⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1nbttb.exec:\1nbttb.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tnbhnh.exec:\tnbhnh.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pdddd.exec:\pdddd.exe57⤵
- Executes dropped EXE
PID:2040 -
\??\c:\djjdd.exec:\djjdd.exe58⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rrfxlrx.exec:\rrfxlrx.exe59⤵
- Executes dropped EXE
PID:2828 -
\??\c:\lxfflll.exec:\lxfflll.exe60⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhhntb.exec:\nhhntb.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nttntn.exec:\nttntn.exe62⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vpddd.exec:\vpddd.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdpdj.exec:\jdpdj.exe64⤵
- Executes dropped EXE
PID:484 -
\??\c:\9lflxxf.exec:\9lflxxf.exe65⤵
- Executes dropped EXE
PID:812 -
\??\c:\thhhnh.exec:\thhhnh.exe66⤵PID:2668
-
\??\c:\9httbb.exec:\9httbb.exe67⤵PID:1772
-
\??\c:\dpddj.exec:\dpddj.exe68⤵PID:1616
-
\??\c:\9vppp.exec:\9vppp.exe69⤵PID:960
-
\??\c:\9rllrrf.exec:\9rllrrf.exe70⤵PID:1552
-
\??\c:\fxxllxx.exec:\fxxllxx.exe71⤵PID:604
-
\??\c:\httnnh.exec:\httnnh.exe72⤵PID:1704
-
\??\c:\1hbhtt.exec:\1hbhtt.exe73⤵PID:1572
-
\??\c:\5jdvp.exec:\5jdvp.exe74⤵PID:564
-
\??\c:\jvjjj.exec:\jvjjj.exe75⤵PID:1936
-
\??\c:\flrlrfl.exec:\flrlrfl.exe76⤵PID:1428
-
\??\c:\1hbhnn.exec:\1hbhnn.exe77⤵PID:2200
-
\??\c:\5hbhhh.exec:\5hbhhh.exe78⤵PID:2696
-
\??\c:\1vjdd.exec:\1vjdd.exe79⤵PID:380
-
\??\c:\dvddv.exec:\dvddv.exe80⤵PID:1648
-
\??\c:\3rllllr.exec:\3rllllr.exe81⤵PID:1532
-
\??\c:\tbhttt.exec:\tbhttt.exe82⤵PID:2552
-
\??\c:\nhbbhh.exec:\nhbbhh.exe83⤵PID:1924
-
\??\c:\3bnntt.exec:\3bnntt.exe84⤵PID:2500
-
\??\c:\dvvvv.exec:\dvvvv.exe85⤵PID:2716
-
\??\c:\1vpvj.exec:\1vpvj.exe86⤵PID:2624
-
\??\c:\9xrrxxr.exec:\9xrrxxr.exe87⤵PID:2524
-
\??\c:\7bhhhh.exec:\7bhhhh.exe88⤵PID:2260
-
\??\c:\tnhnnt.exec:\tnhnnt.exe89⤵PID:2488
-
\??\c:\vdppp.exec:\vdppp.exe90⤵PID:2424
-
\??\c:\pjvvd.exec:\pjvvd.exe91⤵PID:2144
-
\??\c:\rxffxxx.exec:\rxffxxx.exe92⤵PID:2780
-
\??\c:\rrxfllx.exec:\rrxfllx.exe93⤵PID:1224
-
\??\c:\htthhb.exec:\htthhb.exe94⤵PID:2096
-
\??\c:\tnbnbn.exec:\tnbnbn.exe95⤵PID:1504
-
\??\c:\dppjp.exec:\dppjp.exe96⤵PID:1036
-
\??\c:\djvvv.exec:\djvvv.exe97⤵PID:296
-
\??\c:\lffxrxr.exec:\lffxrxr.exe98⤵PID:2132
-
\??\c:\btnhtt.exec:\btnhtt.exe99⤵PID:1448
-
\??\c:\ntbhnh.exec:\ntbhnh.exe100⤵PID:1720
-
\??\c:\pjpvj.exec:\pjpvj.exe101⤵PID:2044
-
\??\c:\vjvdj.exec:\vjvdj.exe102⤵PID:2676
-
\??\c:\lrxrlxf.exec:\lrxrlxf.exe103⤵PID:2820
-
\??\c:\xrlrffl.exec:\xrlrffl.exe104⤵PID:2796
-
\??\c:\hthhnh.exec:\hthhnh.exe105⤵PID:1976
-
\??\c:\nhnttb.exec:\nhnttb.exe106⤵PID:1848
-
\??\c:\pjpjp.exec:\pjpjp.exe107⤵PID:680
-
\??\c:\pjddj.exec:\pjddj.exe108⤵PID:868
-
\??\c:\1rfxllr.exec:\1rfxllr.exe109⤵PID:1064
-
\??\c:\frrrxrr.exec:\frrrxrr.exe110⤵PID:804
-
\??\c:\7tnntt.exec:\7tnntt.exe111⤵PID:556
-
\??\c:\5hntnh.exec:\5hntnh.exe112⤵PID:352
-
\??\c:\1djpp.exec:\1djpp.exe113⤵PID:1072
-
\??\c:\7pddd.exec:\7pddd.exe114⤵PID:2756
-
\??\c:\1lfflxf.exec:\1lfflxf.exe115⤵PID:1684
-
\??\c:\1htbbh.exec:\1htbbh.exe116⤵PID:816
-
\??\c:\btbnbn.exec:\btbnbn.exe117⤵PID:2212
-
\??\c:\vjpvj.exec:\vjpvj.exe118⤵PID:1056
-
\??\c:\lxfxfrf.exec:\lxfxfrf.exe119⤵PID:2920
-
\??\c:\xrflrrf.exec:\xrflrrf.exe120⤵PID:2840
-
\??\c:\nnttbt.exec:\nnttbt.exe121⤵PID:832
-
\??\c:\7thbbt.exec:\7thbbt.exe122⤵PID:1040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-