Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
046fc26f2169be366197014c68ff6467_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
046fc26f2169be366197014c68ff6467_JaffaCakes118.exe
-
Size
324KB
-
MD5
046fc26f2169be366197014c68ff6467
-
SHA1
d895b366f0148e7b759666b1d39940dd267858a0
-
SHA256
095b73623df5fc795b1976d4d304b24fd03c6f973cf736f437fec75ca87021db
-
SHA512
5d787e6e100c89d484b6174abea03b6e97735456dba2a2240d1574c776e97bd40606098f7b2cf50bf2d0088e6e414aaf693745ac301fad03a453bd7b26e22fbf
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jL:Pcm7ImGddXtWrXD486jL
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2904-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/312-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-395-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-402-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-428-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-495-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-508-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-529-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/912-542-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-814-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1668-846-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3040-874-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-973-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjjpd.exexrfxflr.exetnbntb.exe7pddj.exe7lxxrrf.exe5nhhnn.exe1jjjj.exexlxflfl.exe3ttbhn.exe3vddp.exerlrrffl.exe5tbntt.exevjppv.exe7xfxrlr.exehbhnbb.exe7pdjj.exelxlllrx.exe5bbthh.exe5vpjp.exexrrllfl.exebnttbb.exe1dppp.exerlfrxlr.exe1nbbhh.exejdppv.exexlxfflr.exe9nbbhh.exevjdjp.exexlllrlr.exe3hbntt.exe3jvvv.exelxlfrrx.exe9bntbh.exevpvvj.exelfxxffr.exexlxrrrr.exebthhbb.exedvvdv.exe9pddj.exelxllxrx.exebthnbb.exejdvvj.exevjdvd.exe5rrlllr.exetnbbbt.exe7djdj.exe7jvvd.exexllrxxf.exehthhtt.exenhtbhh.exepdjvd.exe3fxrxxf.exehnbhtb.exedpdjv.exejvddv.exexxllrrx.exebtbntn.exetnthtb.exe3pdvv.exe3rlrffr.exe7bbnht.exe1djvv.exe1jppp.exefrllllr.exepid process 2980 jjjpd.exe 2780 xrfxflr.exe 2604 tnbntb.exe 2800 7pddj.exe 2696 7lxxrrf.exe 2644 5nhhnn.exe 2400 1jjjj.exe 2508 xlxflfl.exe 2516 3ttbhn.exe 2236 3vddp.exe 1700 rlrrffl.exe 1648 5tbntt.exe 1360 vjppv.exe 312 7xfxrlr.exe 2416 hbhnbb.exe 800 7pdjj.exe 1824 lxlllrx.exe 1532 5bbthh.exe 840 5vpjp.exe 884 xrrllfl.exe 2820 bnttbb.exe 1760 1dppp.exe 2276 rlfrxlr.exe 1000 1nbbhh.exe 3020 jdppv.exe 1572 xlxfflr.exe 1420 9nbbhh.exe 1076 vjdjp.exe 1668 xlllrlr.exe 2012 3hbntt.exe 1752 3jvvv.exe 816 lxlfrrx.exe 2204 9bntbh.exe 2148 vpvvj.exe 2972 lfxxffr.exe 3048 xlxrrrr.exe 3024 bthhbb.exe 2992 dvvdv.exe 2680 9pddj.exe 2608 lxllxrx.exe 1352 bthnbb.exe 2728 jdvvj.exe 2600 vjdvd.exe 2636 5rrlllr.exe 2540 tnbbbt.exe 2872 7djdj.exe 1672 7jvvd.exe 1704 xllrxxf.exe 1660 hthhtt.exe 2532 nhtbhh.exe 1652 pdjvd.exe 1860 3fxrxxf.exe 1740 hnbhtb.exe 2388 dpdjv.exe 2224 jvddv.exe 1808 xxllrrx.exe 2364 btbntn.exe 1548 tnthtb.exe 2968 3pdvv.exe 840 3rlrffr.exe 2560 7bbnht.exe 2640 1djvv.exe 2068 1jppp.exe 2284 frllllr.exe -
Processes:
resource yara_rule behavioral1/memory/2904-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-395-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-435-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-487-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-490-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/2284-495-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-508-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-542-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-652-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-659-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-666-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-705-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-708-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1740-713-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-746-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/2968-751-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-766-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1664-790-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-796-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/3020-806-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-859-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-874-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-911-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-926-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-945-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-952-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-966-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
046fc26f2169be366197014c68ff6467_JaffaCakes118.exejjjpd.exexrfxflr.exetnbntb.exe7pddj.exe7lxxrrf.exe5nhhnn.exe1jjjj.exexlxflfl.exe3ttbhn.exe3vddp.exerlrrffl.exe5tbntt.exevjppv.exe7xfxrlr.exehbhnbb.exedescription pid process target process PID 2904 wrote to memory of 2980 2904 046fc26f2169be366197014c68ff6467_JaffaCakes118.exe jjjpd.exe PID 2904 wrote to memory of 2980 2904 046fc26f2169be366197014c68ff6467_JaffaCakes118.exe jjjpd.exe PID 2904 wrote to memory of 2980 2904 046fc26f2169be366197014c68ff6467_JaffaCakes118.exe jjjpd.exe PID 2904 wrote to memory of 2980 2904 046fc26f2169be366197014c68ff6467_JaffaCakes118.exe jjjpd.exe PID 2980 wrote to memory of 2780 2980 jjjpd.exe xrfxflr.exe PID 2980 wrote to memory of 2780 2980 jjjpd.exe xrfxflr.exe PID 2980 wrote to memory of 2780 2980 jjjpd.exe xrfxflr.exe PID 2980 wrote to memory of 2780 2980 jjjpd.exe xrfxflr.exe PID 2780 wrote to memory of 2604 2780 xrfxflr.exe tnbntb.exe PID 2780 wrote to memory of 2604 2780 xrfxflr.exe tnbntb.exe PID 2780 wrote to memory of 2604 2780 xrfxflr.exe tnbntb.exe PID 2780 wrote to memory of 2604 2780 xrfxflr.exe tnbntb.exe PID 2604 wrote to memory of 2800 2604 tnbntb.exe 7pddj.exe PID 2604 wrote to memory of 2800 2604 tnbntb.exe 7pddj.exe PID 2604 wrote to memory of 2800 2604 tnbntb.exe 7pddj.exe PID 2604 wrote to memory of 2800 2604 tnbntb.exe 7pddj.exe PID 2800 wrote to memory of 2696 2800 7pddj.exe 7lxxrrf.exe PID 2800 wrote to memory of 2696 2800 7pddj.exe 7lxxrrf.exe PID 2800 wrote to memory of 2696 2800 7pddj.exe 7lxxrrf.exe PID 2800 wrote to memory of 2696 2800 7pddj.exe 7lxxrrf.exe PID 2696 wrote to memory of 2644 2696 7lxxrrf.exe 5nhhnn.exe PID 2696 wrote to memory of 2644 2696 7lxxrrf.exe 5nhhnn.exe PID 2696 wrote to memory of 2644 2696 7lxxrrf.exe 5nhhnn.exe PID 2696 wrote to memory of 2644 2696 7lxxrrf.exe 5nhhnn.exe PID 2644 wrote to memory of 2400 2644 5nhhnn.exe 1jjjj.exe PID 2644 wrote to memory of 2400 2644 5nhhnn.exe 1jjjj.exe PID 2644 wrote to memory of 2400 2644 5nhhnn.exe 1jjjj.exe PID 2644 wrote to memory of 2400 2644 5nhhnn.exe 1jjjj.exe PID 2400 wrote to memory of 2508 2400 1jjjj.exe xlxflfl.exe PID 2400 wrote to memory of 2508 2400 1jjjj.exe xlxflfl.exe PID 2400 wrote to memory of 2508 2400 1jjjj.exe xlxflfl.exe PID 2400 wrote to memory of 2508 2400 1jjjj.exe xlxflfl.exe PID 2508 wrote to memory of 2516 2508 xlxflfl.exe 3ttbhn.exe PID 2508 wrote to memory of 2516 2508 xlxflfl.exe 3ttbhn.exe PID 2508 wrote to memory of 2516 2508 xlxflfl.exe 3ttbhn.exe PID 2508 wrote to memory of 2516 2508 xlxflfl.exe 3ttbhn.exe PID 2516 wrote to memory of 2236 2516 3ttbhn.exe 3vddp.exe PID 2516 wrote to memory of 2236 2516 3ttbhn.exe 3vddp.exe PID 2516 wrote to memory of 2236 2516 3ttbhn.exe 3vddp.exe PID 2516 wrote to memory of 2236 2516 3ttbhn.exe 3vddp.exe PID 2236 wrote to memory of 1700 2236 3vddp.exe rlrrffl.exe PID 2236 wrote to memory of 1700 2236 3vddp.exe rlrrffl.exe PID 2236 wrote to memory of 1700 2236 3vddp.exe rlrrffl.exe PID 2236 wrote to memory of 1700 2236 3vddp.exe rlrrffl.exe PID 1700 wrote to memory of 1648 1700 rlrrffl.exe 5tbntt.exe PID 1700 wrote to memory of 1648 1700 rlrrffl.exe 5tbntt.exe PID 1700 wrote to memory of 1648 1700 rlrrffl.exe 5tbntt.exe PID 1700 wrote to memory of 1648 1700 rlrrffl.exe 5tbntt.exe PID 1648 wrote to memory of 1360 1648 5tbntt.exe vjppv.exe PID 1648 wrote to memory of 1360 1648 5tbntt.exe vjppv.exe PID 1648 wrote to memory of 1360 1648 5tbntt.exe vjppv.exe PID 1648 wrote to memory of 1360 1648 5tbntt.exe vjppv.exe PID 1360 wrote to memory of 312 1360 vjppv.exe 7xfxrlr.exe PID 1360 wrote to memory of 312 1360 vjppv.exe 7xfxrlr.exe PID 1360 wrote to memory of 312 1360 vjppv.exe 7xfxrlr.exe PID 1360 wrote to memory of 312 1360 vjppv.exe 7xfxrlr.exe PID 312 wrote to memory of 2416 312 7xfxrlr.exe hbhnbb.exe PID 312 wrote to memory of 2416 312 7xfxrlr.exe hbhnbb.exe PID 312 wrote to memory of 2416 312 7xfxrlr.exe hbhnbb.exe PID 312 wrote to memory of 2416 312 7xfxrlr.exe hbhnbb.exe PID 2416 wrote to memory of 800 2416 hbhnbb.exe 7pdjj.exe PID 2416 wrote to memory of 800 2416 hbhnbb.exe 7pdjj.exe PID 2416 wrote to memory of 800 2416 hbhnbb.exe 7pdjj.exe PID 2416 wrote to memory of 800 2416 hbhnbb.exe 7pdjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\046fc26f2169be366197014c68ff6467_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\046fc26f2169be366197014c68ff6467_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjpd.exec:\jjjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrfxflr.exec:\xrfxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbntb.exec:\tnbntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7pddj.exec:\7pddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lxxrrf.exec:\7lxxrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nhhnn.exec:\5nhhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jjjj.exec:\1jjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlxflfl.exec:\xlxflfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ttbhn.exec:\3ttbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3vddp.exec:\3vddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrrffl.exec:\rlrrffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5tbntt.exec:\5tbntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjppv.exec:\vjppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xfxrlr.exec:\7xfxrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhnbb.exec:\hbhnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7pdjj.exec:\7pdjj.exe17⤵
- Executes dropped EXE
-
\??\c:\lxlllrx.exec:\lxlllrx.exe18⤵
- Executes dropped EXE
-
\??\c:\5bbthh.exec:\5bbthh.exe19⤵
- Executes dropped EXE
-
\??\c:\5vpjp.exec:\5vpjp.exe20⤵
- Executes dropped EXE
-
\??\c:\xrrllfl.exec:\xrrllfl.exe21⤵
- Executes dropped EXE
-
\??\c:\bnttbb.exec:\bnttbb.exe22⤵
- Executes dropped EXE
-
\??\c:\1dppp.exec:\1dppp.exe23⤵
- Executes dropped EXE
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe24⤵
- Executes dropped EXE
-
\??\c:\1nbbhh.exec:\1nbbhh.exe25⤵
- Executes dropped EXE
-
\??\c:\jdppv.exec:\jdppv.exe26⤵
- Executes dropped EXE
-
\??\c:\xlxfflr.exec:\xlxfflr.exe27⤵
- Executes dropped EXE
-
\??\c:\9nbbhh.exec:\9nbbhh.exe28⤵
- Executes dropped EXE
-
\??\c:\vjdjp.exec:\vjdjp.exe29⤵
- Executes dropped EXE
-
\??\c:\xlllrlr.exec:\xlllrlr.exe30⤵
- Executes dropped EXE
-
\??\c:\3hbntt.exec:\3hbntt.exe31⤵
- Executes dropped EXE
-
\??\c:\3jvvv.exec:\3jvvv.exe32⤵
- Executes dropped EXE
-
\??\c:\lxlfrrx.exec:\lxlfrrx.exe33⤵
- Executes dropped EXE
-
\??\c:\9bntbh.exec:\9bntbh.exe34⤵
- Executes dropped EXE
-
\??\c:\vpvvj.exec:\vpvvj.exe35⤵
- Executes dropped EXE
-
\??\c:\lfxxffr.exec:\lfxxffr.exe36⤵
- Executes dropped EXE
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe37⤵
- Executes dropped EXE
-
\??\c:\bthhbb.exec:\bthhbb.exe38⤵
- Executes dropped EXE
-
\??\c:\dvvdv.exec:\dvvdv.exe39⤵
- Executes dropped EXE
-
\??\c:\9pddj.exec:\9pddj.exe40⤵
- Executes dropped EXE
-
\??\c:\lxllxrx.exec:\lxllxrx.exe41⤵
- Executes dropped EXE
-
\??\c:\bthnbb.exec:\bthnbb.exe42⤵
- Executes dropped EXE
-
\??\c:\jdvvj.exec:\jdvvj.exe43⤵
- Executes dropped EXE
-
\??\c:\vjdvd.exec:\vjdvd.exe44⤵
- Executes dropped EXE
-
\??\c:\5rrlllr.exec:\5rrlllr.exe45⤵
- Executes dropped EXE
-
\??\c:\tnbbbt.exec:\tnbbbt.exe46⤵
- Executes dropped EXE
-
\??\c:\7djdj.exec:\7djdj.exe47⤵
- Executes dropped EXE
-
\??\c:\7jvvd.exec:\7jvvd.exe48⤵
- Executes dropped EXE
-
\??\c:\xllrxxf.exec:\xllrxxf.exe49⤵
- Executes dropped EXE
-
\??\c:\hthhtt.exec:\hthhtt.exe50⤵
- Executes dropped EXE
-
\??\c:\nhtbhh.exec:\nhtbhh.exe51⤵
- Executes dropped EXE
-
\??\c:\pdjvd.exec:\pdjvd.exe52⤵
- Executes dropped EXE
-
\??\c:\3fxrxxf.exec:\3fxrxxf.exe53⤵
- Executes dropped EXE
-
\??\c:\hnbhtb.exec:\hnbhtb.exe54⤵
- Executes dropped EXE
-
\??\c:\dpdjv.exec:\dpdjv.exe55⤵
- Executes dropped EXE
-
\??\c:\jvddv.exec:\jvddv.exe56⤵
- Executes dropped EXE
-
\??\c:\xxllrrx.exec:\xxllrrx.exe57⤵
- Executes dropped EXE
-
\??\c:\btbntn.exec:\btbntn.exe58⤵
- Executes dropped EXE
-
\??\c:\tnthtb.exec:\tnthtb.exe59⤵
- Executes dropped EXE
-
\??\c:\3pdvv.exec:\3pdvv.exe60⤵
- Executes dropped EXE
-
\??\c:\3rlrffr.exec:\3rlrffr.exe61⤵
- Executes dropped EXE
-
\??\c:\7bbnht.exec:\7bbnht.exe62⤵
- Executes dropped EXE
-
\??\c:\1djvv.exec:\1djvv.exe63⤵
- Executes dropped EXE
-
\??\c:\1jppp.exec:\1jppp.exe64⤵
- Executes dropped EXE
-
\??\c:\frllllr.exec:\frllllr.exe65⤵
- Executes dropped EXE
-
\??\c:\nbnbhb.exec:\nbnbhb.exe66⤵
-
\??\c:\3thnhh.exec:\3thnhh.exe67⤵
-
\??\c:\5vvvp.exec:\5vvvp.exe68⤵
-
\??\c:\xrfxllr.exec:\xrfxllr.exe69⤵
-
\??\c:\hthhnb.exec:\hthhnb.exe70⤵
-
\??\c:\tthhtn.exec:\tthhtn.exe71⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe72⤵
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe73⤵
-
\??\c:\bnbtbt.exec:\bnbtbt.exe74⤵
-
\??\c:\1thbbb.exec:\1thbbb.exe75⤵
-
\??\c:\dpjdd.exec:\dpjdd.exe76⤵
-
\??\c:\1rflxrr.exec:\1rflxrr.exe77⤵
-
\??\c:\fxxxxrx.exec:\fxxxxrx.exe78⤵
-
\??\c:\tnhttb.exec:\tnhttb.exe79⤵
-
\??\c:\vpvdd.exec:\vpvdd.exe80⤵
-
\??\c:\lxffllr.exec:\lxffllr.exe81⤵
-
\??\c:\lxlfffl.exec:\lxlfffl.exe82⤵
-
\??\c:\thtnbh.exec:\thtnbh.exe83⤵
-
\??\c:\jpddj.exec:\jpddj.exe84⤵
-
\??\c:\pdppv.exec:\pdppv.exe85⤵
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe86⤵
-
\??\c:\htbbhn.exec:\htbbhn.exe87⤵
-
\??\c:\hhthhh.exec:\hhthhh.exe88⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe89⤵
-
\??\c:\xlrllfr.exec:\xlrllfr.exe90⤵
-
\??\c:\1flrrrx.exec:\1flrrrx.exe91⤵
-
\??\c:\7nbttt.exec:\7nbttt.exe92⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe93⤵
-
\??\c:\xflxrll.exec:\xflxrll.exe94⤵
-
\??\c:\5fxxfxx.exec:\5fxxfxx.exe95⤵
-
\??\c:\tnhtbb.exec:\tnhtbb.exe96⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe97⤵
-
\??\c:\xrxlffx.exec:\xrxlffx.exe98⤵
-
\??\c:\xxxxllf.exec:\xxxxllf.exe99⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe100⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe101⤵
-
\??\c:\lfllrrr.exec:\lfllrrr.exe102⤵
-
\??\c:\nbhhnh.exec:\nbhhnh.exe103⤵
-
\??\c:\tnhbnt.exec:\tnhbnt.exe104⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe105⤵
-
\??\c:\1lxlfxx.exec:\1lxlfxx.exe106⤵
-
\??\c:\7nbtbb.exec:\7nbtbb.exe107⤵
-
\??\c:\nbbthb.exec:\nbbthb.exe108⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe109⤵
-
\??\c:\rflxrll.exec:\rflxrll.exe110⤵
-
\??\c:\3lxfrlr.exec:\3lxfrlr.exe111⤵
-
\??\c:\httnhb.exec:\httnhb.exe112⤵
-
\??\c:\3pvvd.exec:\3pvvd.exe113⤵
-
\??\c:\frllffl.exec:\frllffl.exe114⤵
-
\??\c:\5rffrrx.exec:\5rffrrx.exe115⤵
-
\??\c:\tnhhth.exec:\tnhhth.exe116⤵
-
\??\c:\3hbtbh.exec:\3hbtbh.exe117⤵
-
\??\c:\3dpjd.exec:\3dpjd.exe118⤵
-
\??\c:\frffllr.exec:\frffllr.exe119⤵
-
\??\c:\nbhntt.exec:\nbhntt.exe120⤵
-
\??\c:\nhtttn.exec:\nhtttn.exe121⤵
-
\??\c:\1vvvp.exec:\1vvvp.exe122⤵
-
\??\c:\9jvdv.exec:\9jvdv.exe123⤵
-
\??\c:\7llfxxx.exec:\7llfxxx.exe124⤵
-
\??\c:\9hbbtn.exec:\9hbbtn.exe125⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe126⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe127⤵
-
\??\c:\xrfflxf.exec:\xrfflxf.exe128⤵
-
\??\c:\frlrfxl.exec:\frlrfxl.exe129⤵
-
\??\c:\hthbbt.exec:\hthbbt.exe130⤵
-
\??\c:\7jdjj.exec:\7jdjj.exe131⤵
-
\??\c:\9dvpp.exec:\9dvpp.exe132⤵
-
\??\c:\9xllrrx.exec:\9xllrrx.exe133⤵
-
\??\c:\7llfxrr.exec:\7llfxrr.exe134⤵
-
\??\c:\hthbhh.exec:\hthbhh.exe135⤵
-
\??\c:\vjvdd.exec:\vjvdd.exe136⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe137⤵
-
\??\c:\9lxxrrx.exec:\9lxxrrx.exe138⤵
-
\??\c:\1thhnh.exec:\1thhnh.exe139⤵
-
\??\c:\hthbnh.exec:\hthbnh.exe140⤵
-
\??\c:\pvpdp.exec:\pvpdp.exe141⤵
-
\??\c:\frxlllr.exec:\frxlllr.exe142⤵
-
\??\c:\httnhh.exec:\httnhh.exe143⤵
-
\??\c:\7vdjv.exec:\7vdjv.exe144⤵
-
\??\c:\xrrxflr.exec:\xrrxflr.exe145⤵
-
\??\c:\ththhn.exec:\ththhn.exe146⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe147⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe148⤵
-
\??\c:\rxxxlff.exec:\rxxxlff.exe149⤵
-
\??\c:\htbbbt.exec:\htbbbt.exe150⤵
-
\??\c:\htttbt.exec:\htttbt.exe151⤵
-
\??\c:\5vjdv.exec:\5vjdv.exe152⤵
-
\??\c:\9dppd.exec:\9dppd.exe153⤵
-
\??\c:\rflrlff.exec:\rflrlff.exe154⤵
-
\??\c:\3xffrrl.exec:\3xffrrl.exe155⤵
-
\??\c:\5nnnnh.exec:\5nnnnh.exe156⤵
-
\??\c:\pvddv.exec:\pvddv.exe157⤵
-
\??\c:\dpppv.exec:\dpppv.exe158⤵
-
\??\c:\rffrlxx.exec:\rffrlxx.exe159⤵
-
\??\c:\nttnnn.exec:\nttnnn.exe160⤵
-
\??\c:\7tbbbn.exec:\7tbbbn.exe161⤵
-
\??\c:\djvvp.exec:\djvvp.exe162⤵
-
\??\c:\5jpdd.exec:\5jpdd.exe163⤵
-
\??\c:\frflrlr.exec:\frflrlr.exe164⤵
-
\??\c:\9nhbhh.exec:\9nhbhh.exe165⤵
-
\??\c:\5hnnnt.exec:\5hnnnt.exe166⤵
-
\??\c:\7jvdd.exec:\7jvdd.exe167⤵
-
\??\c:\5frrrll.exec:\5frrrll.exe168⤵
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe169⤵
-
\??\c:\nhtbnh.exec:\nhtbnh.exe170⤵
-
\??\c:\5htntn.exec:\5htntn.exe171⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe172⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe173⤵
-
\??\c:\xrllrrx.exec:\xrllrrx.exe174⤵
-
\??\c:\btntbb.exec:\btntbb.exe175⤵
-
\??\c:\hbnbbh.exec:\hbnbbh.exe176⤵
-
\??\c:\9pddj.exec:\9pddj.exe177⤵
-
\??\c:\dpddj.exec:\dpddj.exe178⤵
-
\??\c:\xrlxxfl.exec:\xrlxxfl.exe179⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe180⤵
-
\??\c:\bttbhh.exec:\bttbhh.exe181⤵
-
\??\c:\dvppv.exec:\dvppv.exe182⤵
-
\??\c:\pjvjv.exec:\pjvjv.exe183⤵
-
\??\c:\1flffff.exec:\1flffff.exe184⤵
-
\??\c:\rlllrrx.exec:\rlllrrx.exe185⤵
-
\??\c:\hthhnn.exec:\hthhnn.exe186⤵
-
\??\c:\hbhtbb.exec:\hbhtbb.exe187⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe188⤵
-
\??\c:\rllrrxf.exec:\rllrrxf.exe189⤵
-
\??\c:\rlxxffl.exec:\rlxxffl.exe190⤵
-
\??\c:\3thbhb.exec:\3thbhb.exe191⤵
-
\??\c:\5htbnn.exec:\5htbnn.exe192⤵
-
\??\c:\jjvjj.exec:\jjvjj.exe193⤵
-
\??\c:\pjjpv.exec:\pjjpv.exe194⤵
-
\??\c:\3llfffl.exec:\3llfffl.exe195⤵
-
\??\c:\5bnnnn.exec:\5bnnnn.exe196⤵
-
\??\c:\nbnhnt.exec:\nbnhnt.exe197⤵
-
\??\c:\bhtbbh.exec:\bhtbbh.exe198⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe199⤵
-
\??\c:\vvppp.exec:\vvppp.exe200⤵
-
\??\c:\fxlrffr.exec:\fxlrffr.exe201⤵
-
\??\c:\htbthh.exec:\htbthh.exe202⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe203⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe204⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe205⤵
-
\??\c:\xrxlrlr.exec:\xrxlrlr.exe206⤵
-
\??\c:\3nbtbh.exec:\3nbtbh.exe207⤵
-
\??\c:\nnthhh.exec:\nnthhh.exe208⤵
-
\??\c:\5pjjj.exec:\5pjjj.exe209⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe210⤵
-
\??\c:\rfllrrf.exec:\rfllrrf.exe211⤵
-
\??\c:\lxflrrr.exec:\lxflrrr.exe212⤵
-
\??\c:\5btbnn.exec:\5btbnn.exe213⤵
-
\??\c:\9vjdd.exec:\9vjdd.exe214⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe215⤵
-
\??\c:\9frrflr.exec:\9frrflr.exe216⤵
-
\??\c:\1xlllll.exec:\1xlllll.exe217⤵
-
\??\c:\3bbhhh.exec:\3bbhhh.exe218⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe219⤵
-
\??\c:\pjddj.exec:\pjddj.exe220⤵
-
\??\c:\rfrrxfr.exec:\rfrrxfr.exe221⤵
-
\??\c:\xrrxffl.exec:\xrrxffl.exe222⤵
-
\??\c:\thnntn.exec:\thnntn.exe223⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe224⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe225⤵
-
\??\c:\xlllflf.exec:\xlllflf.exe226⤵
-
\??\c:\1lxlrxx.exec:\1lxlrxx.exe227⤵
-
\??\c:\tntnnh.exec:\tntnnh.exe228⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe229⤵
-
\??\c:\vpvdp.exec:\vpvdp.exe230⤵
-
\??\c:\3fxfxxx.exec:\3fxfxxx.exe231⤵
-
\??\c:\rffxfff.exec:\rffxfff.exe232⤵
-
\??\c:\htbtbt.exec:\htbtbt.exe233⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe234⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe235⤵
-
\??\c:\5xfrlfr.exec:\5xfrlfr.exe236⤵
-
\??\c:\9lxxxxx.exec:\9lxxxxx.exe237⤵
-
\??\c:\bbthhh.exec:\bbthhh.exe238⤵
-
\??\c:\bnhhhb.exec:\bnhhhb.exe239⤵
-
\??\c:\pddvp.exec:\pddvp.exe240⤵
-
\??\c:\lrllfxf.exec:\lrllfxf.exe241⤵