Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
045eea365a3fd5461d643f657712103a_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
045eea365a3fd5461d643f657712103a_JaffaCakes118.exe
-
Size
83KB
-
MD5
045eea365a3fd5461d643f657712103a
-
SHA1
dbd313d2b568df26d1795223d658a35e7c3b850d
-
SHA256
b11abd1c0576861b8de04a23c06e770aff496dc3054579e3759f4c0f312bfee4
-
SHA512
d9628176e95a87e53e2c6660159a690a8aa6af5fe6749c06d67caad998c7070e268c2a7d8042ad76431ba5aee025dfdd154eef9aae80c4136704e89aca1ea279
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZa8:ymb3NkkiQ3mdBjFIVLd2hWZGre8
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/2520-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-55-0x0000000000470000-0x00000000004B0000-memory.dmp family_blackmoon behavioral2/memory/5064-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-71-0x0000000000470000-0x00000000004B0000-memory.dmp family_blackmoon behavioral2/memory/2340-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlfxrrf.exelfxxffl.exentbbbb.exebnhbbb.exefxrrllf.exe9bnhhb.exe5nnbbt.exedppjp.exe5ddpd.exefrfflfx.exexllfrlf.exenbntnh.exejddvp.exe9llfrlf.exe3hhbtn.exettttnt.exe1djjd.exelxrxxlr.exe7llxxrl.exenhttnh.exejjvpv.exepjdpj.exe3lrrxrf.exehtnbnh.exetbbtnt.exejvpdp.exedjjdp.exexlfrrfr.exetnhhtt.exetbbthh.exeppvpj.exedddpv.exellllxlx.exelxxlfxl.exebhnhbt.exetnnnbb.exevdvpj.exe9jjvj.exe9jdpj.exexfrflfl.exexlxxllf.exe1hhbnn.exethhtht.exevdvpv.exedpvpd.exefrfxfxr.exexrxlxrl.exefrfxlfx.exe3ttnhh.exennnbtb.exedjvvp.exevddvd.exerfxlxrl.exerfxrlfr.exelfrfrlf.exe1ntnbt.exehttntn.exedjpjp.exevpdvj.exevddpd.exe7lfrfxl.exelrlrlfx.exe5hhthb.exethbnhn.exepid process 5008 rlfxrrf.exe 1392 lfxxffl.exe 2520 ntbbbb.exe 1744 bnhbbb.exe 3764 fxrrllf.exe 720 9bnhhb.exe 3612 5nnbbt.exe 2340 dppjp.exe 1808 5ddpd.exe 5064 frfflfx.exe 4688 xllfrlf.exe 3276 nbntnh.exe 2220 jddvp.exe 3976 9llfrlf.exe 4552 3hhbtn.exe 2748 ttttnt.exe 844 1djjd.exe 4800 lxrxxlr.exe 3908 7llxxrl.exe 2944 nhttnh.exe 4420 jjvpv.exe 2348 pjdpj.exe 1676 3lrrxrf.exe 3584 htnbnh.exe 436 tbbtnt.exe 2844 jvpdp.exe 3008 djjdp.exe 4900 xlfrrfr.exe 1900 tnhhtt.exe 4792 tbbthh.exe 2544 ppvpj.exe 4216 dddpv.exe 4560 llllxlx.exe 3688 lxxlfxl.exe 2092 bhnhbt.exe 4536 tnnnbb.exe 4440 vdvpj.exe 4380 9jjvj.exe 2128 9jdpj.exe 2920 xfrflfl.exe 4976 xlxxllf.exe 932 1hhbnn.exe 4012 thhtht.exe 888 vdvpv.exe 1124 dpvpd.exe 3348 frfxfxr.exe 3912 xrxlxrl.exe 632 frfxlfx.exe 1836 3ttnhh.exe 1604 nnnbtb.exe 3368 djvvp.exe 5040 vddvd.exe 1112 rfxlxrl.exe 3040 rfxrlfr.exe 3048 lfrfrlf.exe 1812 1ntnbt.exe 5016 httntn.exe 3976 djpjp.exe 4552 vpdvj.exe 4132 vddpd.exe 4768 7lfrfxl.exe 4696 lrlrlfx.exe 2276 5hhthb.exe 2252 thbnhn.exe -
Processes:
resource yara_rule behavioral2/memory/4668-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
045eea365a3fd5461d643f657712103a_JaffaCakes118.exerlfxrrf.exelfxxffl.exentbbbb.exebnhbbb.exefxrrllf.exe9bnhhb.exe5nnbbt.exedppjp.exe5ddpd.exefrfflfx.exexllfrlf.exenbntnh.exejddvp.exe9llfrlf.exe3hhbtn.exettttnt.exe1djjd.exelxrxxlr.exe7llxxrl.exenhttnh.exejjvpv.exedescription pid process target process PID 4668 wrote to memory of 5008 4668 045eea365a3fd5461d643f657712103a_JaffaCakes118.exe rlfxrrf.exe PID 4668 wrote to memory of 5008 4668 045eea365a3fd5461d643f657712103a_JaffaCakes118.exe rlfxrrf.exe PID 4668 wrote to memory of 5008 4668 045eea365a3fd5461d643f657712103a_JaffaCakes118.exe rlfxrrf.exe PID 5008 wrote to memory of 1392 5008 rlfxrrf.exe lfxxffl.exe PID 5008 wrote to memory of 1392 5008 rlfxrrf.exe lfxxffl.exe PID 5008 wrote to memory of 1392 5008 rlfxrrf.exe lfxxffl.exe PID 1392 wrote to memory of 2520 1392 lfxxffl.exe ntbbbb.exe PID 1392 wrote to memory of 2520 1392 lfxxffl.exe ntbbbb.exe PID 1392 wrote to memory of 2520 1392 lfxxffl.exe ntbbbb.exe PID 2520 wrote to memory of 1744 2520 ntbbbb.exe bnhbbb.exe PID 2520 wrote to memory of 1744 2520 ntbbbb.exe bnhbbb.exe PID 2520 wrote to memory of 1744 2520 ntbbbb.exe bnhbbb.exe PID 1744 wrote to memory of 3764 1744 bnhbbb.exe fxrrllf.exe PID 1744 wrote to memory of 3764 1744 bnhbbb.exe fxrrllf.exe PID 1744 wrote to memory of 3764 1744 bnhbbb.exe fxrrllf.exe PID 3764 wrote to memory of 720 3764 fxrrllf.exe 9bnhhb.exe PID 3764 wrote to memory of 720 3764 fxrrllf.exe 9bnhhb.exe PID 3764 wrote to memory of 720 3764 fxrrllf.exe 9bnhhb.exe PID 720 wrote to memory of 3612 720 9bnhhb.exe 5nnbbt.exe PID 720 wrote to memory of 3612 720 9bnhhb.exe 5nnbbt.exe PID 720 wrote to memory of 3612 720 9bnhhb.exe 5nnbbt.exe PID 3612 wrote to memory of 2340 3612 5nnbbt.exe dppjp.exe PID 3612 wrote to memory of 2340 3612 5nnbbt.exe dppjp.exe PID 3612 wrote to memory of 2340 3612 5nnbbt.exe dppjp.exe PID 2340 wrote to memory of 1808 2340 dppjp.exe 5ddpd.exe PID 2340 wrote to memory of 1808 2340 dppjp.exe 5ddpd.exe PID 2340 wrote to memory of 1808 2340 dppjp.exe 5ddpd.exe PID 1808 wrote to memory of 5064 1808 5ddpd.exe frfflfx.exe PID 1808 wrote to memory of 5064 1808 5ddpd.exe frfflfx.exe PID 1808 wrote to memory of 5064 1808 5ddpd.exe frfflfx.exe PID 5064 wrote to memory of 4688 5064 frfflfx.exe xllfrlf.exe PID 5064 wrote to memory of 4688 5064 frfflfx.exe xllfrlf.exe PID 5064 wrote to memory of 4688 5064 frfflfx.exe xllfrlf.exe PID 4688 wrote to memory of 3276 4688 xllfrlf.exe nbntnh.exe PID 4688 wrote to memory of 3276 4688 xllfrlf.exe nbntnh.exe PID 4688 wrote to memory of 3276 4688 xllfrlf.exe nbntnh.exe PID 3276 wrote to memory of 2220 3276 nbntnh.exe jddvp.exe PID 3276 wrote to memory of 2220 3276 nbntnh.exe jddvp.exe PID 3276 wrote to memory of 2220 3276 nbntnh.exe jddvp.exe PID 2220 wrote to memory of 3976 2220 jddvp.exe 9llfrlf.exe PID 2220 wrote to memory of 3976 2220 jddvp.exe 9llfrlf.exe PID 2220 wrote to memory of 3976 2220 jddvp.exe 9llfrlf.exe PID 3976 wrote to memory of 4552 3976 9llfrlf.exe 3hhbtn.exe PID 3976 wrote to memory of 4552 3976 9llfrlf.exe 3hhbtn.exe PID 3976 wrote to memory of 4552 3976 9llfrlf.exe 3hhbtn.exe PID 4552 wrote to memory of 2748 4552 3hhbtn.exe ttttnt.exe PID 4552 wrote to memory of 2748 4552 3hhbtn.exe ttttnt.exe PID 4552 wrote to memory of 2748 4552 3hhbtn.exe ttttnt.exe PID 2748 wrote to memory of 844 2748 ttttnt.exe 1djjd.exe PID 2748 wrote to memory of 844 2748 ttttnt.exe 1djjd.exe PID 2748 wrote to memory of 844 2748 ttttnt.exe 1djjd.exe PID 844 wrote to memory of 4800 844 1djjd.exe lxrxxlr.exe PID 844 wrote to memory of 4800 844 1djjd.exe lxrxxlr.exe PID 844 wrote to memory of 4800 844 1djjd.exe lxrxxlr.exe PID 4800 wrote to memory of 3908 4800 lxrxxlr.exe 7llxxrl.exe PID 4800 wrote to memory of 3908 4800 lxrxxlr.exe 7llxxrl.exe PID 4800 wrote to memory of 3908 4800 lxrxxlr.exe 7llxxrl.exe PID 3908 wrote to memory of 2944 3908 7llxxrl.exe nhttnh.exe PID 3908 wrote to memory of 2944 3908 7llxxrl.exe nhttnh.exe PID 3908 wrote to memory of 2944 3908 7llxxrl.exe nhttnh.exe PID 2944 wrote to memory of 4420 2944 nhttnh.exe jjvpv.exe PID 2944 wrote to memory of 4420 2944 nhttnh.exe jjvpv.exe PID 2944 wrote to memory of 4420 2944 nhttnh.exe jjvpv.exe PID 4420 wrote to memory of 2348 4420 jjvpv.exe pjdpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\045eea365a3fd5461d643f657712103a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045eea365a3fd5461d643f657712103a_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxffl.exec:\lfxxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbbbb.exec:\ntbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhbbb.exec:\bnhbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrrllf.exec:\fxrrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9bnhhb.exec:\9bnhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nnbbt.exec:\5nnbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppjp.exec:\dppjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ddpd.exec:\5ddpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfflfx.exec:\frfflfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllfrlf.exec:\xllfrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbntnh.exec:\nbntnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvp.exec:\jddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9llfrlf.exec:\9llfrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hhbtn.exec:\3hhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttttnt.exec:\ttttnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1djjd.exec:\1djjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrxxlr.exec:\lxrxxlr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7llxxrl.exec:\7llxxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhttnh.exec:\nhttnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvpv.exec:\jjvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdpj.exec:\pjdpj.exe23⤵
- Executes dropped EXE
-
\??\c:\3lrrxrf.exec:\3lrrxrf.exe24⤵
- Executes dropped EXE
-
\??\c:\htnbnh.exec:\htnbnh.exe25⤵
- Executes dropped EXE
-
\??\c:\tbbtnt.exec:\tbbtnt.exe26⤵
- Executes dropped EXE
-
\??\c:\jvpdp.exec:\jvpdp.exe27⤵
- Executes dropped EXE
-
\??\c:\djjdp.exec:\djjdp.exe28⤵
- Executes dropped EXE
-
\??\c:\xlfrrfr.exec:\xlfrrfr.exe29⤵
- Executes dropped EXE
-
\??\c:\tnhhtt.exec:\tnhhtt.exe30⤵
- Executes dropped EXE
-
\??\c:\tbbthh.exec:\tbbthh.exe31⤵
- Executes dropped EXE
-
\??\c:\ppvpj.exec:\ppvpj.exe32⤵
- Executes dropped EXE
-
\??\c:\dddpv.exec:\dddpv.exe33⤵
- Executes dropped EXE
-
\??\c:\llllxlx.exec:\llllxlx.exe34⤵
- Executes dropped EXE
-
\??\c:\lxxlfxl.exec:\lxxlfxl.exe35⤵
- Executes dropped EXE
-
\??\c:\bhnhbt.exec:\bhnhbt.exe36⤵
- Executes dropped EXE
-
\??\c:\tnnnbb.exec:\tnnnbb.exe37⤵
- Executes dropped EXE
-
\??\c:\vdvpj.exec:\vdvpj.exe38⤵
- Executes dropped EXE
-
\??\c:\9jjvj.exec:\9jjvj.exe39⤵
- Executes dropped EXE
-
\??\c:\9jdpj.exec:\9jdpj.exe40⤵
- Executes dropped EXE
-
\??\c:\xfrflfl.exec:\xfrflfl.exe41⤵
- Executes dropped EXE
-
\??\c:\xlxxllf.exec:\xlxxllf.exe42⤵
- Executes dropped EXE
-
\??\c:\1hhbnn.exec:\1hhbnn.exe43⤵
- Executes dropped EXE
-
\??\c:\thhtht.exec:\thhtht.exe44⤵
- Executes dropped EXE
-
\??\c:\vdvpv.exec:\vdvpv.exe45⤵
- Executes dropped EXE
-
\??\c:\dpvpd.exec:\dpvpd.exe46⤵
- Executes dropped EXE
-
\??\c:\frfxfxr.exec:\frfxfxr.exe47⤵
- Executes dropped EXE
-
\??\c:\xrxlxrl.exec:\xrxlxrl.exe48⤵
- Executes dropped EXE
-
\??\c:\frfxlfx.exec:\frfxlfx.exe49⤵
- Executes dropped EXE
-
\??\c:\3ttnhh.exec:\3ttnhh.exe50⤵
- Executes dropped EXE
-
\??\c:\nnnbtb.exec:\nnnbtb.exe51⤵
- Executes dropped EXE
-
\??\c:\djvvp.exec:\djvvp.exe52⤵
- Executes dropped EXE
-
\??\c:\vddvd.exec:\vddvd.exe53⤵
- Executes dropped EXE
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe54⤵
- Executes dropped EXE
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe55⤵
- Executes dropped EXE
-
\??\c:\lfrfrlf.exec:\lfrfrlf.exe56⤵
- Executes dropped EXE
-
\??\c:\1ntnbt.exec:\1ntnbt.exe57⤵
- Executes dropped EXE
-
\??\c:\httntn.exec:\httntn.exe58⤵
- Executes dropped EXE
-
\??\c:\djpjp.exec:\djpjp.exe59⤵
- Executes dropped EXE
-
\??\c:\vpdvj.exec:\vpdvj.exe60⤵
- Executes dropped EXE
-
\??\c:\vddpd.exec:\vddpd.exe61⤵
- Executes dropped EXE
-
\??\c:\7lfrfxl.exec:\7lfrfxl.exe62⤵
- Executes dropped EXE
-
\??\c:\lrlrlfx.exec:\lrlrlfx.exe63⤵
- Executes dropped EXE
-
\??\c:\5hhthb.exec:\5hhthb.exe64⤵
- Executes dropped EXE
-
\??\c:\thbnhn.exec:\thbnhn.exe65⤵
- Executes dropped EXE
-
\??\c:\3dvjv.exec:\3dvjv.exe66⤵
-
\??\c:\jppdp.exec:\jppdp.exe67⤵
-
\??\c:\7ffrlfr.exec:\7ffrlfr.exe68⤵
-
\??\c:\flfxrrf.exec:\flfxrrf.exe69⤵
-
\??\c:\tntnnh.exec:\tntnnh.exe70⤵
-
\??\c:\bthbtt.exec:\bthbtt.exe71⤵
-
\??\c:\5pjvp.exec:\5pjvp.exe72⤵
-
\??\c:\frfxlxx.exec:\frfxlxx.exe73⤵
-
\??\c:\lxllxrr.exec:\lxllxrr.exe74⤵
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe75⤵
-
\??\c:\9nbnnh.exec:\9nbnnh.exe76⤵
-
\??\c:\vppvp.exec:\vppvp.exe77⤵
-
\??\c:\5fxlxrr.exec:\5fxlxrr.exe78⤵
-
\??\c:\ffffxrl.exec:\ffffxrl.exe79⤵
-
\??\c:\1tttnn.exec:\1tttnn.exe80⤵
-
\??\c:\5hhhtn.exec:\5hhhtn.exe81⤵
-
\??\c:\djddj.exec:\djddj.exe82⤵
-
\??\c:\9pvjd.exec:\9pvjd.exe83⤵
-
\??\c:\5llxxrr.exec:\5llxxrr.exe84⤵
-
\??\c:\ffflrfr.exec:\ffflrfr.exe85⤵
-
\??\c:\btnhbt.exec:\btnhbt.exe86⤵
-
\??\c:\ntnhtb.exec:\ntnhtb.exe87⤵
-
\??\c:\jpvjp.exec:\jpvjp.exe88⤵
-
\??\c:\5vvdp.exec:\5vvdp.exe89⤵
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe90⤵
-
\??\c:\xfxrffr.exec:\xfxrffr.exe91⤵
-
\??\c:\1hthtn.exec:\1hthtn.exe92⤵
-
\??\c:\5hhtbn.exec:\5hhtbn.exe93⤵
-
\??\c:\dvppj.exec:\dvppj.exe94⤵
-
\??\c:\1pjdp.exec:\1pjdp.exe95⤵
-
\??\c:\3rxlrlx.exec:\3rxlrlx.exe96⤵
-
\??\c:\ttthtb.exec:\ttthtb.exe97⤵
-
\??\c:\thbhbb.exec:\thbhbb.exe98⤵
-
\??\c:\5pdvv.exec:\5pdvv.exe99⤵
-
\??\c:\xrfxfxr.exec:\xrfxfxr.exe100⤵
-
\??\c:\hbhhtn.exec:\hbhhtn.exe101⤵
-
\??\c:\5bthtn.exec:\5bthtn.exe102⤵
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe103⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe104⤵
-
\??\c:\tnnbnh.exec:\tnnbnh.exe105⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe106⤵
-
\??\c:\7djdd.exec:\7djdd.exe107⤵
-
\??\c:\3rfrfxl.exec:\3rfrfxl.exe108⤵
-
\??\c:\hthbnb.exec:\hthbnb.exe109⤵
-
\??\c:\jpvdp.exec:\jpvdp.exe110⤵
-
\??\c:\dpjdp.exec:\dpjdp.exe111⤵
-
\??\c:\jvpdp.exec:\jvpdp.exe112⤵
-
\??\c:\7rrfrlx.exec:\7rrfrlx.exe113⤵
-
\??\c:\hbtnbt.exec:\hbtnbt.exe114⤵
-
\??\c:\9hnnbt.exec:\9hnnbt.exe115⤵
-
\??\c:\pvpdv.exec:\pvpdv.exe116⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe117⤵
-
\??\c:\7rfrxrx.exec:\7rfrxrx.exe118⤵
-
\??\c:\xrrffxl.exec:\xrrffxl.exe119⤵
-
\??\c:\hbtnhb.exec:\hbtnhb.exe120⤵
-
\??\c:\7bbnnh.exec:\7bbnnh.exe121⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe122⤵
-
\??\c:\jpdpd.exec:\jpdpd.exe123⤵
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe124⤵
-
\??\c:\ffxlxrf.exec:\ffxlxrf.exe125⤵
-
\??\c:\btbhbb.exec:\btbhbb.exe126⤵
-
\??\c:\htbtnt.exec:\htbtnt.exe127⤵
-
\??\c:\pjpdj.exec:\pjpdj.exe128⤵
-
\??\c:\jvvjd.exec:\jvvjd.exe129⤵
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe130⤵
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe131⤵
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe132⤵
-
\??\c:\bnhbnh.exec:\bnhbnh.exe133⤵
-
\??\c:\hthnbn.exec:\hthnbn.exe134⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe135⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe136⤵
-
\??\c:\vvdpj.exec:\vvdpj.exe137⤵
-
\??\c:\lflxlfr.exec:\lflxlfr.exe138⤵
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe139⤵
-
\??\c:\xflfrlr.exec:\xflfrlr.exe140⤵
-
\??\c:\9hbtnh.exec:\9hbtnh.exe141⤵
-
\??\c:\9bbbbt.exec:\9bbbbt.exe142⤵
-
\??\c:\hnnhbb.exec:\hnnhbb.exe143⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe144⤵
-
\??\c:\vjdpd.exec:\vjdpd.exe145⤵
-
\??\c:\djpjv.exec:\djpjv.exe146⤵
-
\??\c:\rllxlfx.exec:\rllxlfx.exe147⤵
-
\??\c:\ffllfll.exec:\ffllfll.exe148⤵
-
\??\c:\7bthtn.exec:\7bthtn.exe149⤵
-
\??\c:\bnthbt.exec:\bnthbt.exe150⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe151⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe152⤵
-
\??\c:\rlflxlf.exec:\rlflxlf.exe153⤵
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe154⤵
-
\??\c:\fffxrlx.exec:\fffxrlx.exe155⤵
-
\??\c:\3bhbnn.exec:\3bhbnn.exe156⤵
-
\??\c:\htnhnh.exec:\htnhnh.exe157⤵
-
\??\c:\jddvp.exec:\jddvp.exe158⤵
-
\??\c:\rxxxfff.exec:\rxxxfff.exe159⤵
-
\??\c:\3rxlxrl.exec:\3rxlxrl.exe160⤵
-
\??\c:\tnhtnn.exec:\tnhtnn.exe161⤵
-
\??\c:\nbbnbn.exec:\nbbnbn.exe162⤵
-
\??\c:\vdvjd.exec:\vdvjd.exe163⤵
-
\??\c:\nhhthh.exec:\nhhthh.exe164⤵
-
\??\c:\7hthbt.exec:\7hthbt.exe165⤵
-
\??\c:\jppjv.exec:\jppjv.exe166⤵
-
\??\c:\flxlxfr.exec:\flxlxfr.exe167⤵
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe168⤵
-
\??\c:\xffxrlf.exec:\xffxrlf.exe169⤵
-
\??\c:\hnhbnh.exec:\hnhbnh.exe170⤵
-
\??\c:\pppjd.exec:\pppjd.exe171⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe172⤵
-
\??\c:\ppddd.exec:\ppddd.exe173⤵
-
\??\c:\xxxffxf.exec:\xxxffxf.exe174⤵
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe175⤵
-
\??\c:\3hbnbt.exec:\3hbnbt.exe176⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe177⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe178⤵
-
\??\c:\rlrrllf.exec:\rlrrllf.exe179⤵
-
\??\c:\rllxrfx.exec:\rllxrfx.exe180⤵
-
\??\c:\thtnnn.exec:\thtnnn.exe181⤵
-
\??\c:\tnnbtn.exec:\tnnbtn.exe182⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe183⤵
-
\??\c:\xflllll.exec:\xflllll.exe184⤵
-
\??\c:\fffrfxr.exec:\fffrfxr.exe185⤵
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe186⤵
-
\??\c:\5hnhbb.exec:\5hnhbb.exe187⤵
-
\??\c:\nhhbnn.exec:\nhhbnn.exe188⤵
-
\??\c:\vppjj.exec:\vppjj.exe189⤵
-
\??\c:\lxllrrx.exec:\lxllrrx.exe190⤵
-
\??\c:\lflxrrr.exec:\lflxrrr.exe191⤵
-
\??\c:\bhttnn.exec:\bhttnn.exe192⤵
-
\??\c:\hthhtn.exec:\hthhtn.exe193⤵
-
\??\c:\1pvpj.exec:\1pvpj.exe194⤵
-
\??\c:\lffxlrl.exec:\lffxlrl.exe195⤵
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe196⤵
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe197⤵
-
\??\c:\1hhhbb.exec:\1hhhbb.exe198⤵
-
\??\c:\1nbbbh.exec:\1nbbbh.exe199⤵
-
\??\c:\vjddp.exec:\vjddp.exe200⤵
-
\??\c:\5vjdd.exec:\5vjdd.exe201⤵
-
\??\c:\5rfrxxf.exec:\5rfrxxf.exe202⤵
-
\??\c:\ffxffff.exec:\ffxffff.exe203⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe204⤵
-
\??\c:\5bhbtt.exec:\5bhbtt.exe205⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe206⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe207⤵
-
\??\c:\dvddv.exec:\dvddv.exe208⤵
-
\??\c:\xxxlxlr.exec:\xxxlxlr.exe209⤵
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe210⤵
-
\??\c:\tttnhh.exec:\tttnhh.exe211⤵
-
\??\c:\nnbtbh.exec:\nnbtbh.exe212⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe213⤵
-
\??\c:\xfrlffr.exec:\xfrlffr.exe214⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe215⤵
-
\??\c:\ttbtnn.exec:\ttbtnn.exe216⤵
-
\??\c:\3ntbnt.exec:\3ntbnt.exe217⤵
-
\??\c:\ddjjv.exec:\ddjjv.exe218⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe219⤵
-
\??\c:\lfrrflf.exec:\lfrrflf.exe220⤵
-
\??\c:\xlllffx.exec:\xlllffx.exe221⤵
-
\??\c:\nhtbnn.exec:\nhtbnn.exe222⤵
-
\??\c:\tbhnnt.exec:\tbhnnt.exe223⤵
-
\??\c:\btnttt.exec:\btnttt.exe224⤵
-
\??\c:\jjpdd.exec:\jjpdd.exe225⤵
-
\??\c:\vjppd.exec:\vjppd.exe226⤵
-
\??\c:\1ffxllf.exec:\1ffxllf.exe227⤵
-
\??\c:\9lxxrrx.exec:\9lxxrrx.exe228⤵
-
\??\c:\xlrxffx.exec:\xlrxffx.exe229⤵
-
\??\c:\tthhnn.exec:\tthhnn.exe230⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe231⤵
-
\??\c:\djddv.exec:\djddv.exe232⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe233⤵
-
\??\c:\vdpjv.exec:\vdpjv.exe234⤵
-
\??\c:\5rlfxfl.exec:\5rlfxfl.exe235⤵
-
\??\c:\3xxxxxr.exec:\3xxxxxr.exe236⤵
-
\??\c:\hnbnnt.exec:\hnbnnt.exe237⤵
-
\??\c:\bbbtnt.exec:\bbbtnt.exe238⤵
-
\??\c:\vddvp.exec:\vddvp.exe239⤵
-
\??\c:\vpjdj.exec:\vpjdj.exe240⤵
-
\??\c:\jddpj.exec:\jddpj.exe241⤵