Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe
-
Size
357KB
-
MD5
0474c86f142a45eefedda54e8a164168
-
SHA1
0d49c1e4c4352f6e3b3f089612f23e4adedcd46f
-
SHA256
45f84300e3ff955259341cf062d65fb18772cfd31c3406d9deabdc5221b7ece6
-
SHA512
2c4c67ba3c41b9b3ee4502bc8f0cf6d955390a9e5964278e0b576f5323205412318f4bf6a0e8b6e1a65be56448eb4c8fb0d78bc9a65a436d9b44ed521b0e2d60
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jFX8fkYtB6J6eUTV4aTHDaLq:Pcm7ImGddXtWrXD486jFX88Y/eUBnV
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1028-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1004-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-726-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-745-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-890-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2160-891-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2812-993-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-1168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-1206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-1291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjvvd.exerlflffl.exehbntbb.exe3jvvv.exejdpvv.exefxlfllr.exetntthn.exefxflrll.exehbtthn.exeppddp.exebtbnbb.exenhnnnt.exefrlrxfr.exe3nhhnt.exelfxflrx.exe3fllrrx.exedvppd.exeffxfllx.exeppjvj.exetnhnbb.exejpvpp.exe9fflrxx.exepdpvj.exe3lflrxl.exehhttbb.exejdvdj.exe3btntt.exedddpv.exehhttbh.exevvppd.exehbntbb.exevpjjv.exexrxxffl.exehtbbtb.exe9pjjv.exepjppv.exellxxxxf.exethttnt.exe7htnbt.exejdpdj.exe7lxrllr.exerlrfllr.exetnhhnt.exejdvvj.exelflflfl.exerlxfllr.exe1hnhbb.exejvjpv.exefllrrxr.exe7xrrflr.exennbhtt.exe7vjpv.exerfrxxfl.exellxxlfl.exebhthnt.exe1pdpd.exedvdjj.exelfxlrxl.exehhtbhh.exehhhttb.exepjvdj.exe5rlrrrl.exerrffrlr.exehbnhnh.exepid process 1028 jjvvd.exe 2752 rlflffl.exe 2676 hbntbb.exe 2820 3jvvv.exe 2540 jdpvv.exe 2568 fxlfllr.exe 2672 tntthn.exe 2544 fxflrll.exe 3032 hbtthn.exe 3036 ppddp.exe 2860 btbnbb.exe 2900 nhnnnt.exe 3016 frlrxfr.exe 3020 3nhhnt.exe 1828 lfxflrx.exe 1328 3fllrrx.exe 1648 dvppd.exe 844 ffxfllx.exe 2572 ppjvj.exe 2276 tnhnbb.exe 1948 jpvpp.exe 2472 9fflrxx.exe 2140 pdpvj.exe 540 3lflrxl.exe 2084 hhttbb.exe 356 jdvdj.exe 1004 3btntt.exe 808 dddpv.exe 2416 hhttbh.exe 1128 vvppd.exe 2428 hbntbb.exe 2432 vpjjv.exe 2992 xrxxffl.exe 1752 htbbtb.exe 2464 9pjjv.exe 1956 pjppv.exe 2736 llxxxxf.exe 2160 thttnt.exe 2820 7htnbt.exe 2740 jdpdj.exe 2772 7lxrllr.exe 2780 rlrfllr.exe 2832 tnhhnt.exe 2700 jdvvj.exe 2204 lflflfl.exe 2292 rlxfllr.exe 1872 1hnhbb.exe 2848 jvjpv.exe 2880 fllrrxr.exe 2932 7xrrflr.exe 1536 nnbhtt.exe 1944 7vjpv.exe 1204 rfrxxfl.exe 1828 llxxlfl.exe 2420 bhthnt.exe 2724 1pdpd.exe 900 dvdjj.exe 1320 lfxlrxl.exe 2060 hhtbhh.exe 2016 hhhttb.exe 2276 pjvdj.exe 2120 5rlrrrl.exe 2280 rrffrlr.exe 604 hbnhnh.exe -
Processes:
resource yara_rule behavioral1/memory/1752-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1004-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-550-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-563-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-576-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-583-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-604-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-617-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-630-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-643-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-661-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1544-701-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-726-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-745-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-752-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-783-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-796-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-809-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-846-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-865-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-898-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-917-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-942-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-961-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-974-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-993-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-1012-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-1056-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-1063-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-1100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-1125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-1168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-1199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0474c86f142a45eefedda54e8a164168_JaffaCakes118.exejjvvd.exerlflffl.exehbntbb.exe3jvvv.exejdpvv.exefxlfllr.exetntthn.exefxflrll.exehbtthn.exeppddp.exebtbnbb.exenhnnnt.exefrlrxfr.exe3nhhnt.exelfxflrx.exedescription pid process target process PID 1752 wrote to memory of 1028 1752 0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe jjvvd.exe PID 1752 wrote to memory of 1028 1752 0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe jjvvd.exe PID 1752 wrote to memory of 1028 1752 0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe jjvvd.exe PID 1752 wrote to memory of 1028 1752 0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe jjvvd.exe PID 1028 wrote to memory of 2752 1028 jjvvd.exe rlflffl.exe PID 1028 wrote to memory of 2752 1028 jjvvd.exe rlflffl.exe PID 1028 wrote to memory of 2752 1028 jjvvd.exe rlflffl.exe PID 1028 wrote to memory of 2752 1028 jjvvd.exe rlflffl.exe PID 2752 wrote to memory of 2676 2752 rlflffl.exe hbntbb.exe PID 2752 wrote to memory of 2676 2752 rlflffl.exe hbntbb.exe PID 2752 wrote to memory of 2676 2752 rlflffl.exe hbntbb.exe PID 2752 wrote to memory of 2676 2752 rlflffl.exe hbntbb.exe PID 2676 wrote to memory of 2820 2676 hbntbb.exe 3jvvv.exe PID 2676 wrote to memory of 2820 2676 hbntbb.exe 3jvvv.exe PID 2676 wrote to memory of 2820 2676 hbntbb.exe 3jvvv.exe PID 2676 wrote to memory of 2820 2676 hbntbb.exe 3jvvv.exe PID 2820 wrote to memory of 2540 2820 3jvvv.exe jdpvv.exe PID 2820 wrote to memory of 2540 2820 3jvvv.exe jdpvv.exe PID 2820 wrote to memory of 2540 2820 3jvvv.exe jdpvv.exe PID 2820 wrote to memory of 2540 2820 3jvvv.exe jdpvv.exe PID 2540 wrote to memory of 2568 2540 jdpvv.exe fxlfllr.exe PID 2540 wrote to memory of 2568 2540 jdpvv.exe fxlfllr.exe PID 2540 wrote to memory of 2568 2540 jdpvv.exe fxlfllr.exe PID 2540 wrote to memory of 2568 2540 jdpvv.exe fxlfllr.exe PID 2568 wrote to memory of 2672 2568 fxlfllr.exe tntthn.exe PID 2568 wrote to memory of 2672 2568 fxlfllr.exe tntthn.exe PID 2568 wrote to memory of 2672 2568 fxlfllr.exe tntthn.exe PID 2568 wrote to memory of 2672 2568 fxlfllr.exe tntthn.exe PID 2672 wrote to memory of 2544 2672 tntthn.exe fxflrll.exe PID 2672 wrote to memory of 2544 2672 tntthn.exe fxflrll.exe PID 2672 wrote to memory of 2544 2672 tntthn.exe fxflrll.exe PID 2672 wrote to memory of 2544 2672 tntthn.exe fxflrll.exe PID 2544 wrote to memory of 3032 2544 fxflrll.exe hbtthn.exe PID 2544 wrote to memory of 3032 2544 fxflrll.exe hbtthn.exe PID 2544 wrote to memory of 3032 2544 fxflrll.exe hbtthn.exe PID 2544 wrote to memory of 3032 2544 fxflrll.exe hbtthn.exe PID 3032 wrote to memory of 3036 3032 hbtthn.exe ppddp.exe PID 3032 wrote to memory of 3036 3032 hbtthn.exe ppddp.exe PID 3032 wrote to memory of 3036 3032 hbtthn.exe ppddp.exe PID 3032 wrote to memory of 3036 3032 hbtthn.exe ppddp.exe PID 3036 wrote to memory of 2860 3036 ppddp.exe btbnbb.exe PID 3036 wrote to memory of 2860 3036 ppddp.exe btbnbb.exe PID 3036 wrote to memory of 2860 3036 ppddp.exe btbnbb.exe PID 3036 wrote to memory of 2860 3036 ppddp.exe btbnbb.exe PID 2860 wrote to memory of 2900 2860 btbnbb.exe nhnnnt.exe PID 2860 wrote to memory of 2900 2860 btbnbb.exe nhnnnt.exe PID 2860 wrote to memory of 2900 2860 btbnbb.exe nhnnnt.exe PID 2860 wrote to memory of 2900 2860 btbnbb.exe nhnnnt.exe PID 2900 wrote to memory of 3016 2900 nhnnnt.exe frlrxfr.exe PID 2900 wrote to memory of 3016 2900 nhnnnt.exe frlrxfr.exe PID 2900 wrote to memory of 3016 2900 nhnnnt.exe frlrxfr.exe PID 2900 wrote to memory of 3016 2900 nhnnnt.exe frlrxfr.exe PID 3016 wrote to memory of 3020 3016 frlrxfr.exe 3nhhnt.exe PID 3016 wrote to memory of 3020 3016 frlrxfr.exe 3nhhnt.exe PID 3016 wrote to memory of 3020 3016 frlrxfr.exe 3nhhnt.exe PID 3016 wrote to memory of 3020 3016 frlrxfr.exe 3nhhnt.exe PID 3020 wrote to memory of 1828 3020 3nhhnt.exe lfxflrx.exe PID 3020 wrote to memory of 1828 3020 3nhhnt.exe lfxflrx.exe PID 3020 wrote to memory of 1828 3020 3nhhnt.exe lfxflrx.exe PID 3020 wrote to memory of 1828 3020 3nhhnt.exe lfxflrx.exe PID 1828 wrote to memory of 1328 1828 lfxflrx.exe 3fllrrx.exe PID 1828 wrote to memory of 1328 1828 lfxflrx.exe 3fllrrx.exe PID 1828 wrote to memory of 1328 1828 lfxflrx.exe 3fllrrx.exe PID 1828 wrote to memory of 1328 1828 lfxflrx.exe 3fllrrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0474c86f142a45eefedda54e8a164168_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvvd.exec:\jjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlflffl.exec:\rlflffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbntbb.exec:\hbntbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jvvv.exec:\3jvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpvv.exec:\jdpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlfllr.exec:\fxlfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntthn.exec:\tntthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxflrll.exec:\fxflrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtthn.exec:\hbtthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppddp.exec:\ppddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbnbb.exec:\btbnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnnnt.exec:\nhnnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlrxfr.exec:\frlrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nhhnt.exec:\3nhhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxflrx.exec:\lfxflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3fllrrx.exec:\3fllrrx.exe17⤵
- Executes dropped EXE
-
\??\c:\dvppd.exec:\dvppd.exe18⤵
- Executes dropped EXE
-
\??\c:\ffxfllx.exec:\ffxfllx.exe19⤵
- Executes dropped EXE
-
\??\c:\ppjvj.exec:\ppjvj.exe20⤵
- Executes dropped EXE
-
\??\c:\tnhnbb.exec:\tnhnbb.exe21⤵
- Executes dropped EXE
-
\??\c:\jpvpp.exec:\jpvpp.exe22⤵
- Executes dropped EXE
-
\??\c:\9fflrxx.exec:\9fflrxx.exe23⤵
- Executes dropped EXE
-
\??\c:\pdpvj.exec:\pdpvj.exe24⤵
- Executes dropped EXE
-
\??\c:\3lflrxl.exec:\3lflrxl.exe25⤵
- Executes dropped EXE
-
\??\c:\hhttbb.exec:\hhttbb.exe26⤵
- Executes dropped EXE
-
\??\c:\jdvdj.exec:\jdvdj.exe27⤵
- Executes dropped EXE
-
\??\c:\3btntt.exec:\3btntt.exe28⤵
- Executes dropped EXE
-
\??\c:\dddpv.exec:\dddpv.exe29⤵
- Executes dropped EXE
-
\??\c:\hhttbh.exec:\hhttbh.exe30⤵
- Executes dropped EXE
-
\??\c:\vvppd.exec:\vvppd.exe31⤵
- Executes dropped EXE
-
\??\c:\hbntbb.exec:\hbntbb.exe32⤵
- Executes dropped EXE
-
\??\c:\vpjjv.exec:\vpjjv.exe33⤵
- Executes dropped EXE
-
\??\c:\xrxxffl.exec:\xrxxffl.exe34⤵
- Executes dropped EXE
-
\??\c:\htbbtb.exec:\htbbtb.exe35⤵
- Executes dropped EXE
-
\??\c:\9pjjv.exec:\9pjjv.exe36⤵
- Executes dropped EXE
-
\??\c:\pjppv.exec:\pjppv.exe37⤵
- Executes dropped EXE
-
\??\c:\llxxxxf.exec:\llxxxxf.exe38⤵
- Executes dropped EXE
-
\??\c:\thttnt.exec:\thttnt.exe39⤵
- Executes dropped EXE
-
\??\c:\7htnbt.exec:\7htnbt.exe40⤵
- Executes dropped EXE
-
\??\c:\jdpdj.exec:\jdpdj.exe41⤵
- Executes dropped EXE
-
\??\c:\7lxrllr.exec:\7lxrllr.exe42⤵
- Executes dropped EXE
-
\??\c:\rlrfllr.exec:\rlrfllr.exe43⤵
- Executes dropped EXE
-
\??\c:\tnhhnt.exec:\tnhhnt.exe44⤵
- Executes dropped EXE
-
\??\c:\jdvvj.exec:\jdvvj.exe45⤵
- Executes dropped EXE
-
\??\c:\lflflfl.exec:\lflflfl.exe46⤵
- Executes dropped EXE
-
\??\c:\rlxfllr.exec:\rlxfllr.exe47⤵
- Executes dropped EXE
-
\??\c:\1hnhbb.exec:\1hnhbb.exe48⤵
- Executes dropped EXE
-
\??\c:\jvjpv.exec:\jvjpv.exe49⤵
- Executes dropped EXE
-
\??\c:\fllrrxr.exec:\fllrrxr.exe50⤵
- Executes dropped EXE
-
\??\c:\7xrrflr.exec:\7xrrflr.exe51⤵
- Executes dropped EXE
-
\??\c:\nnbhtt.exec:\nnbhtt.exe52⤵
- Executes dropped EXE
-
\??\c:\7vjpv.exec:\7vjpv.exe53⤵
- Executes dropped EXE
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe54⤵
- Executes dropped EXE
-
\??\c:\llxxlfl.exec:\llxxlfl.exe55⤵
- Executes dropped EXE
-
\??\c:\bhthnt.exec:\bhthnt.exe56⤵
- Executes dropped EXE
-
\??\c:\1pdpd.exec:\1pdpd.exe57⤵
- Executes dropped EXE
-
\??\c:\dvdjj.exec:\dvdjj.exe58⤵
- Executes dropped EXE
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe59⤵
- Executes dropped EXE
-
\??\c:\hhtbhh.exec:\hhtbhh.exe60⤵
- Executes dropped EXE
-
\??\c:\hhhttb.exec:\hhhttb.exe61⤵
- Executes dropped EXE
-
\??\c:\pjvdj.exec:\pjvdj.exe62⤵
- Executes dropped EXE
-
\??\c:\5rlrrrl.exec:\5rlrrrl.exe63⤵
- Executes dropped EXE
-
\??\c:\rrffrlr.exec:\rrffrlr.exe64⤵
- Executes dropped EXE
-
\??\c:\hbnhnh.exec:\hbnhnh.exe65⤵
- Executes dropped EXE
-
\??\c:\9dvjv.exec:\9dvjv.exe66⤵
-
\??\c:\xlrlrrf.exec:\xlrlrrf.exe67⤵
-
\??\c:\1lrrlll.exec:\1lrrlll.exe68⤵
-
\??\c:\bbnthn.exec:\bbnthn.exe69⤵
-
\??\c:\jdvvp.exec:\jdvvp.exe70⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe71⤵
-
\??\c:\xlflxfr.exec:\xlflxfr.exe72⤵
-
\??\c:\bthbhb.exec:\bthbhb.exe73⤵
-
\??\c:\tnttbt.exec:\tnttbt.exe74⤵
-
\??\c:\9vjpp.exec:\9vjpp.exe75⤵
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe76⤵
-
\??\c:\5htbhn.exec:\5htbhn.exe77⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe78⤵
-
\??\c:\fxfrrrl.exec:\fxfrrrl.exe79⤵
-
\??\c:\rlffllx.exec:\rlffllx.exe80⤵
-
\??\c:\bnnhnn.exec:\bnnhnn.exe81⤵
-
\??\c:\5vpdj.exec:\5vpdj.exe82⤵
-
\??\c:\frxflfr.exec:\frxflfr.exe83⤵
-
\??\c:\nhtbhn.exec:\nhtbhn.exe84⤵
-
\??\c:\dvddj.exec:\dvddj.exe85⤵
-
\??\c:\lfxfxrf.exec:\lfxfxrf.exe86⤵
-
\??\c:\frxlrrx.exec:\frxlrrx.exe87⤵
-
\??\c:\3htnnt.exec:\3htnnt.exe88⤵
-
\??\c:\7bnntt.exec:\7bnntt.exe89⤵
-
\??\c:\9vjjj.exec:\9vjjj.exe90⤵
-
\??\c:\fxflffl.exec:\fxflffl.exe91⤵
-
\??\c:\lfrrfff.exec:\lfrrfff.exe92⤵
-
\??\c:\7nbhhb.exec:\7nbhhb.exe93⤵
-
\??\c:\1vppv.exec:\1vppv.exe94⤵
-
\??\c:\7dpvv.exec:\7dpvv.exe95⤵
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe96⤵
-
\??\c:\xxrfllf.exec:\xxrfllf.exe97⤵
-
\??\c:\9nbbhb.exec:\9nbbhb.exe98⤵
-
\??\c:\9pjjp.exec:\9pjjp.exe99⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe100⤵
-
\??\c:\xrflrrf.exec:\xrflrrf.exe101⤵
-
\??\c:\xllxrrr.exec:\xllxrrr.exe102⤵
-
\??\c:\7hnnnt.exec:\7hnnnt.exe103⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe104⤵
-
\??\c:\jjddd.exec:\jjddd.exe105⤵
-
\??\c:\rlxrffr.exec:\rlxrffr.exe106⤵
-
\??\c:\hbhntn.exec:\hbhntn.exe107⤵
-
\??\c:\nhbhtb.exec:\nhbhtb.exe108⤵
-
\??\c:\dvjpj.exec:\dvjpj.exe109⤵
-
\??\c:\rfllllr.exec:\rfllllr.exe110⤵
-
\??\c:\lfllxxx.exec:\lfllxxx.exe111⤵
-
\??\c:\btnhnt.exec:\btnhnt.exe112⤵
-
\??\c:\vjpjp.exec:\vjpjp.exe113⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe114⤵
-
\??\c:\xxlrffl.exec:\xxlrffl.exe115⤵
-
\??\c:\9hnhnt.exec:\9hnhnt.exe116⤵
-
\??\c:\1nhbnn.exec:\1nhbnn.exe117⤵
-
\??\c:\3djpv.exec:\3djpv.exe118⤵
-
\??\c:\rlrxfxf.exec:\rlrxfxf.exe119⤵
-
\??\c:\lfllrlx.exec:\lfllrlx.exe120⤵
-
\??\c:\nnbhtt.exec:\nnbhtt.exe121⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe122⤵
-
\??\c:\pjppd.exec:\pjppd.exe123⤵
-
\??\c:\rlrrffl.exec:\rlrrffl.exe124⤵
-
\??\c:\rrflrxx.exec:\rrflrxx.exe125⤵
-
\??\c:\bntbhn.exec:\bntbhn.exe126⤵
-
\??\c:\vdjjp.exec:\vdjjp.exe127⤵
-
\??\c:\ffrrxfr.exec:\ffrrxfr.exe128⤵
-
\??\c:\nhbhnt.exec:\nhbhnt.exe129⤵
-
\??\c:\3thbhh.exec:\3thbhh.exe130⤵
-
\??\c:\jdppd.exec:\jdppd.exe131⤵
-
\??\c:\fxxflrf.exec:\fxxflrf.exe132⤵
-
\??\c:\bthnnn.exec:\bthnnn.exe133⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe134⤵
-
\??\c:\1vddv.exec:\1vddv.exe135⤵
-
\??\c:\7rfllll.exec:\7rfllll.exe136⤵
-
\??\c:\tthntb.exec:\tthntb.exe137⤵
-
\??\c:\bbntbh.exec:\bbntbh.exe138⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe139⤵
-
\??\c:\lflrxfr.exec:\lflrxfr.exe140⤵
-
\??\c:\3lxfllr.exec:\3lxfllr.exe141⤵
-
\??\c:\7nbbnt.exec:\7nbbnt.exe142⤵
-
\??\c:\7pjpd.exec:\7pjpd.exe143⤵
-
\??\c:\7jdjv.exec:\7jdjv.exe144⤵
-
\??\c:\7frxllr.exec:\7frxllr.exe145⤵
-
\??\c:\3hbhtn.exec:\3hbhtn.exe146⤵
-
\??\c:\thttbh.exec:\thttbh.exe147⤵
-
\??\c:\5dvvv.exec:\5dvvv.exe148⤵
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe149⤵
-
\??\c:\xrrrxlr.exec:\xrrrxlr.exe150⤵
-
\??\c:\9ntttb.exec:\9ntttb.exe151⤵
-
\??\c:\ppjjj.exec:\ppjjj.exe152⤵
-
\??\c:\xrllxfl.exec:\xrllxfl.exe153⤵
-
\??\c:\frfxlfl.exec:\frfxlfl.exe154⤵
-
\??\c:\nnbhnt.exec:\nnbhnt.exe155⤵
-
\??\c:\tnbbhh.exec:\tnbbhh.exe156⤵
-
\??\c:\3pvvd.exec:\3pvvd.exe157⤵
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe158⤵
-
\??\c:\fxffllr.exec:\fxffllr.exe159⤵
-
\??\c:\hbhbnt.exec:\hbhbnt.exe160⤵
-
\??\c:\hbtnnt.exec:\hbtnnt.exe161⤵
-
\??\c:\9pjpv.exec:\9pjpv.exe162⤵
-
\??\c:\7lfxxff.exec:\7lfxxff.exe163⤵
-
\??\c:\xlrrxfl.exec:\xlrrxfl.exe164⤵
-
\??\c:\tnttbh.exec:\tnttbh.exe165⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe166⤵
-
\??\c:\3fllrrr.exec:\3fllrrr.exe167⤵
-
\??\c:\xflxlrx.exec:\xflxlrx.exe168⤵
-
\??\c:\1bttbh.exec:\1bttbh.exe169⤵
-
\??\c:\tnhthh.exec:\tnhthh.exe170⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe171⤵
-
\??\c:\9lllxxf.exec:\9lllxxf.exe172⤵
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe173⤵
-
\??\c:\3httbh.exec:\3httbh.exe174⤵
-
\??\c:\bthhtt.exec:\bthhtt.exe175⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe176⤵
-
\??\c:\llxrfff.exec:\llxrfff.exe177⤵
-
\??\c:\rfrrxrx.exec:\rfrrxrx.exe178⤵
-
\??\c:\nhhhnn.exec:\nhhhnn.exe179⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe180⤵
-
\??\c:\1dvvd.exec:\1dvvd.exe181⤵
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe182⤵
-
\??\c:\hthhtt.exec:\hthhtt.exe183⤵
-
\??\c:\bbntbh.exec:\bbntbh.exe184⤵
-
\??\c:\ppdjp.exec:\ppdjp.exe185⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe186⤵
-
\??\c:\9xrxllr.exec:\9xrxllr.exe187⤵
-
\??\c:\3tbhhn.exec:\3tbhhn.exe188⤵
-
\??\c:\vvpdj.exec:\vvpdj.exe189⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe190⤵
-
\??\c:\rfrlrxf.exec:\rfrlrxf.exe191⤵
-
\??\c:\7tbhnn.exec:\7tbhnn.exe192⤵
-
\??\c:\nbttbb.exec:\nbttbb.exe193⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe194⤵
-
\??\c:\dpddd.exec:\dpddd.exe195⤵
-
\??\c:\3xrxlfl.exec:\3xrxlfl.exe196⤵
-
\??\c:\rfxffxl.exec:\rfxffxl.exe197⤵
-
\??\c:\7bnntb.exec:\7bnntb.exe198⤵
-
\??\c:\7jvdp.exec:\7jvdp.exe199⤵
-
\??\c:\vppvj.exec:\vppvj.exe200⤵
-
\??\c:\xrxxfff.exec:\xrxxfff.exe201⤵
-
\??\c:\5bntbh.exec:\5bntbh.exe202⤵
-
\??\c:\htnhbb.exec:\htnhbb.exe203⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe204⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe205⤵
-
\??\c:\3xllxxl.exec:\3xllxxl.exe206⤵
-
\??\c:\btnttb.exec:\btnttb.exe207⤵
-
\??\c:\pjdjp.exec:\pjdjp.exe208⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe209⤵
-
\??\c:\3frxlrx.exec:\3frxlrx.exe210⤵
-
\??\c:\9lflrrx.exec:\9lflrrx.exe211⤵
-
\??\c:\tnhnbt.exec:\tnhnbt.exe212⤵
-
\??\c:\9jvvj.exec:\9jvvj.exe213⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe214⤵
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe215⤵
-
\??\c:\xxlxllr.exec:\xxlxllr.exe216⤵
-
\??\c:\nbhnbt.exec:\nbhnbt.exe217⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe218⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe219⤵
-
\??\c:\3xffllx.exec:\3xffllx.exe220⤵
-
\??\c:\1rxflll.exec:\1rxflll.exe221⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe222⤵
-
\??\c:\7vjdd.exec:\7vjdd.exe223⤵
-
\??\c:\dppvj.exec:\dppvj.exe224⤵
-
\??\c:\lflrlfl.exec:\lflrlfl.exe225⤵
-
\??\c:\rlxfllx.exec:\rlxfllx.exe226⤵
-
\??\c:\htnnnt.exec:\htnnnt.exe227⤵
-
\??\c:\pvjpd.exec:\pvjpd.exe228⤵
-
\??\c:\5ddvd.exec:\5ddvd.exe229⤵
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe230⤵
-
\??\c:\9fxxlll.exec:\9fxxlll.exe231⤵
-
\??\c:\5tbntt.exec:\5tbntt.exe232⤵
-
\??\c:\3djpp.exec:\3djpp.exe233⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe234⤵
-
\??\c:\lfllrrf.exec:\lfllrrf.exe235⤵
-
\??\c:\htbbnn.exec:\htbbnn.exe236⤵
-
\??\c:\nhbbhh.exec:\nhbbhh.exe237⤵
-
\??\c:\dvppv.exec:\dvppv.exe238⤵
-
\??\c:\7pddj.exec:\7pddj.exe239⤵
-
\??\c:\rlrxlll.exec:\rlrxlll.exe240⤵
-
\??\c:\xrfrxrr.exec:\xrfrxrr.exe241⤵