Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 10:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe
-
Size
188KB
-
MD5
0767f9d87034325e62e6fa9e967c650e
-
SHA1
1eee318debcf15d0583fb4c282115d72b431c732
-
SHA256
a423ffeb394d1f6c833bcb0d7f21dfb4abc92b19db0c83255719d2846762c938
-
SHA512
6a18065daff329169ab68caebf4139670fa7d7894e7d7eb7c870834aa74e99266ba69cd691bf58fb3a9c5907f839ca917235e0573915b573c16fde3bd0fee501
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVMc:PhOm2sI93UufdC67ciJTU2HVB
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-448-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1300-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-825-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-640-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-517-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/320-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-403-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-310-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/852-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-1333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 frllxxf.exe 2176 htbbtn.exe 2200 ttbbbn.exe 2588 vpdjj.exe 2544 3vddd.exe 2228 lxxxxrr.exe 2408 9ffxffl.exe 2288 1nbttt.exe 2436 3hhhbt.exe 2428 pddvv.exe 1028 1vdjp.exe 2680 lxfxlfl.exe 2704 bnnnnh.exe 1244 hthtnn.exe 1648 jvdjj.exe 1720 pjdvd.exe 2116 xrxffll.exe 1664 xlrfffx.exe 1328 3hbttn.exe 1392 nbbnnb.exe 2960 pvddv.exe 1936 5dvvv.exe 2788 flrlrff.exe 2792 1rxxrrl.exe 584 1tttbn.exe 3048 thnhhb.exe 1756 jpvvv.exe 1368 1djpv.exe 1804 xlrlfxx.exe 852 bnntnh.exe 2004 nhnntt.exe 576 3djpp.exe 1304 3jpjj.exe 2012 jddjv.exe 1264 3lxfxll.exe 1320 bntbbn.exe 1996 1ntbnh.exe 2844 3dppp.exe 1692 vvjjp.exe 2620 3lxlrrl.exe 2392 frfxlff.exe 2772 9rxxxxr.exe 2624 hhnthb.exe 2396 pjvdj.exe 2580 vvddp.exe 3052 btbbhn.exe 2504 hbbbbb.exe 2552 3pvvd.exe 2484 9pjpv.exe 2720 xxflxxl.exe 2268 5rfllll.exe 1236 nbbbhh.exe 2272 5bthhb.exe 2404 7vvvj.exe 2316 5pjjp.exe 2296 flrllll.exe 628 7rrrlfl.exe 2220 nhtbnh.exe 1392 hhthtb.exe 1300 tbhntt.exe 2216 vddvv.exe 568 dpvjj.exe 2792 xlrrxrr.exe 320 fxxxfxf.exe -
resource yara_rule behavioral1/memory/2008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1300-474-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-524-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-538-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-875-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-914-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-977-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-927-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-825-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-800-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-768-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-667-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-640-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-509-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-502-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-501-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-481-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1300-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-403-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-1003-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-1028-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-1077-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-1115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-1217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-1266-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2008 2192 0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe 28 PID 2192 wrote to memory of 2008 2192 0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe 28 PID 2192 wrote to memory of 2008 2192 0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe 28 PID 2192 wrote to memory of 2008 2192 0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe 28 PID 2008 wrote to memory of 2176 2008 frllxxf.exe 106 PID 2008 wrote to memory of 2176 2008 frllxxf.exe 106 PID 2008 wrote to memory of 2176 2008 frllxxf.exe 106 PID 2008 wrote to memory of 2176 2008 frllxxf.exe 106 PID 2176 wrote to memory of 2200 2176 htbbtn.exe 30 PID 2176 wrote to memory of 2200 2176 htbbtn.exe 30 PID 2176 wrote to memory of 2200 2176 htbbtn.exe 30 PID 2176 wrote to memory of 2200 2176 htbbtn.exe 30 PID 2200 wrote to memory of 2588 2200 ttbbbn.exe 31 PID 2200 wrote to memory of 2588 2200 ttbbbn.exe 31 PID 2200 wrote to memory of 2588 2200 ttbbbn.exe 31 PID 2200 wrote to memory of 2588 2200 ttbbbn.exe 31 PID 2588 wrote to memory of 2544 2588 vpdjj.exe 158 PID 2588 wrote to memory of 2544 2588 vpdjj.exe 158 PID 2588 wrote to memory of 2544 2588 vpdjj.exe 158 PID 2588 wrote to memory of 2544 2588 vpdjj.exe 158 PID 2544 wrote to memory of 2228 2544 3vddd.exe 33 PID 2544 wrote to memory of 2228 2544 3vddd.exe 33 PID 2544 wrote to memory of 2228 2544 3vddd.exe 33 PID 2544 wrote to memory of 2228 2544 3vddd.exe 33 PID 2228 wrote to memory of 2408 2228 lxxxxrr.exe 34 PID 2228 wrote to memory of 2408 2228 lxxxxrr.exe 34 PID 2228 wrote to memory of 2408 2228 lxxxxrr.exe 34 PID 2228 wrote to memory of 2408 2228 lxxxxrr.exe 34 PID 2408 wrote to memory of 2288 2408 9ffxffl.exe 35 PID 2408 wrote to memory of 2288 2408 9ffxffl.exe 35 PID 2408 wrote to memory of 2288 2408 9ffxffl.exe 35 PID 2408 wrote to memory of 2288 2408 9ffxffl.exe 35 PID 2288 wrote to memory of 2436 2288 1nbttt.exe 36 PID 2288 wrote to memory of 2436 2288 1nbttt.exe 36 PID 2288 wrote to memory of 2436 2288 1nbttt.exe 36 PID 2288 wrote to memory of 2436 2288 1nbttt.exe 36 PID 2436 wrote to memory of 2428 2436 3hhhbt.exe 37 PID 2436 wrote to memory of 2428 2436 3hhhbt.exe 37 PID 2436 wrote to memory of 2428 2436 3hhhbt.exe 37 PID 2436 wrote to memory of 2428 2436 3hhhbt.exe 37 PID 2428 wrote to memory of 1028 2428 pddvv.exe 38 PID 2428 wrote to memory of 1028 2428 pddvv.exe 38 PID 2428 wrote to memory of 1028 2428 pddvv.exe 38 PID 2428 wrote to memory of 1028 2428 pddvv.exe 38 PID 1028 wrote to memory of 2680 1028 1vdjp.exe 39 PID 1028 wrote to memory of 2680 1028 1vdjp.exe 39 PID 1028 wrote to memory of 2680 1028 1vdjp.exe 39 PID 1028 wrote to memory of 2680 1028 1vdjp.exe 39 PID 2680 wrote to memory of 2704 2680 lxfxlfl.exe 40 PID 2680 wrote to memory of 2704 2680 lxfxlfl.exe 40 PID 2680 wrote to memory of 2704 2680 lxfxlfl.exe 40 PID 2680 wrote to memory of 2704 2680 lxfxlfl.exe 40 PID 2704 wrote to memory of 1244 2704 bnnnnh.exe 41 PID 2704 wrote to memory of 1244 2704 bnnnnh.exe 41 PID 2704 wrote to memory of 1244 2704 bnnnnh.exe 41 PID 2704 wrote to memory of 1244 2704 bnnnnh.exe 41 PID 1244 wrote to memory of 1648 1244 hthtnn.exe 42 PID 1244 wrote to memory of 1648 1244 hthtnn.exe 42 PID 1244 wrote to memory of 1648 1244 hthtnn.exe 42 PID 1244 wrote to memory of 1648 1244 hthtnn.exe 42 PID 1648 wrote to memory of 1720 1648 jvdjj.exe 43 PID 1648 wrote to memory of 1720 1648 jvdjj.exe 43 PID 1648 wrote to memory of 1720 1648 jvdjj.exe 43 PID 1648 wrote to memory of 1720 1648 jvdjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\frllxxf.exec:\frllxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\htbbtn.exec:\htbbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\ttbbbn.exec:\ttbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vpdjj.exec:\vpdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\3vddd.exec:\3vddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\9ffxffl.exec:\9ffxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\1nbttt.exec:\1nbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\3hhhbt.exec:\3hhhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\pddvv.exec:\pddvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\1vdjp.exec:\1vdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\lxfxlfl.exec:\lxfxlfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bnnnnh.exec:\bnnnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hthtnn.exec:\hthtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\jvdjj.exec:\jvdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\pjdvd.exec:\pjdvd.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xrxffll.exec:\xrxffll.exe18⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xlrfffx.exec:\xlrfffx.exe19⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3hbttn.exec:\3hbttn.exe20⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nbbnnb.exec:\nbbnnb.exe21⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pvddv.exec:\pvddv.exe22⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5dvvv.exec:\5dvvv.exe23⤵
- Executes dropped EXE
PID:1936 -
\??\c:\flrlrff.exec:\flrlrff.exe24⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1rxxrrl.exec:\1rxxrrl.exe25⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1tttbn.exec:\1tttbn.exe26⤵
- Executes dropped EXE
PID:584 -
\??\c:\thnhhb.exec:\thnhhb.exe27⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jpvvv.exec:\jpvvv.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1djpv.exec:\1djpv.exe29⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe30⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bnntnh.exec:\bnntnh.exe31⤵
- Executes dropped EXE
PID:852 -
\??\c:\nhnntt.exec:\nhnntt.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3djpp.exec:\3djpp.exe33⤵
- Executes dropped EXE
PID:576 -
\??\c:\3jpjj.exec:\3jpjj.exe34⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jddjv.exec:\jddjv.exe35⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3lxfxll.exec:\3lxfxll.exe36⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bntbbn.exec:\bntbbn.exe37⤵
- Executes dropped EXE
PID:1320 -
\??\c:\1ntbnh.exec:\1ntbnh.exe38⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3dppp.exec:\3dppp.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vvjjp.exec:\vvjjp.exe40⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3lxlrrl.exec:\3lxlrrl.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\frfxlff.exec:\frfxlff.exe42⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9rxxxxr.exec:\9rxxxxr.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hhnthb.exec:\hhnthb.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjvdj.exec:\pjvdj.exe45⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvddp.exec:\vvddp.exe46⤵
- Executes dropped EXE
PID:2580 -
\??\c:\btbbhn.exec:\btbbhn.exe47⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hbbbbb.exec:\hbbbbb.exe48⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3pvvd.exec:\3pvvd.exe49⤵
- Executes dropped EXE
PID:2552 -
\??\c:\9pjpv.exec:\9pjpv.exe50⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xxflxxl.exec:\xxflxxl.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5rfllll.exec:\5rfllll.exe52⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nbbbhh.exec:\nbbbhh.exe53⤵
- Executes dropped EXE
PID:1236 -
\??\c:\5bthhb.exec:\5bthhb.exe54⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7vvvj.exec:\7vvvj.exe55⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5pjjp.exec:\5pjjp.exe56⤵
- Executes dropped EXE
PID:2316 -
\??\c:\flrllll.exec:\flrllll.exe57⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7rrrlfl.exec:\7rrrlfl.exe58⤵
- Executes dropped EXE
PID:628 -
\??\c:\nhtbnh.exec:\nhtbnh.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhthtb.exec:\hhthtb.exe60⤵
- Executes dropped EXE
PID:1392 -
\??\c:\tbhntt.exec:\tbhntt.exe61⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vddvv.exec:\vddvv.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dpvjj.exec:\dpvjj.exe63⤵
- Executes dropped EXE
PID:568 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe64⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fxxxfxf.exec:\fxxxfxf.exe65⤵
- Executes dropped EXE
PID:320 -
\??\c:\hthhnn.exec:\hthhnn.exe66⤵PID:912
-
\??\c:\thhbtn.exec:\thhbtn.exe67⤵PID:1080
-
\??\c:\vjvvd.exec:\vjvvd.exe68⤵PID:2628
-
\??\c:\7vdvd.exec:\7vdvd.exe69⤵PID:1032
-
\??\c:\5rffffx.exec:\5rffffx.exe70⤵PID:672
-
\??\c:\rxxrrlr.exec:\rxxrrlr.exe71⤵PID:852
-
\??\c:\1htnnh.exec:\1htnnh.exe72⤵PID:1376
-
\??\c:\htnnhb.exec:\htnnhb.exe73⤵PID:1572
-
\??\c:\pjvvj.exec:\pjvvj.exe74⤵PID:2832
-
\??\c:\vpdpp.exec:\vpdpp.exe75⤵PID:1728
-
\??\c:\dvjpv.exec:\dvjpv.exe76⤵PID:1496
-
\??\c:\9lxxlrr.exec:\9lxxlrr.exe77⤵PID:2192
-
\??\c:\xrxlxxr.exec:\xrxlxxr.exe78⤵PID:1568
-
\??\c:\5tnnbh.exec:\5tnnbh.exe79⤵PID:1320
-
\??\c:\5hntbh.exec:\5hntbh.exe80⤵PID:2176
-
\??\c:\thnhnh.exec:\thnhnh.exe81⤵PID:2920
-
\??\c:\xfrlrlf.exec:\xfrlrlf.exe82⤵PID:2608
-
\??\c:\lfrxlfr.exec:\lfrxlfr.exe83⤵PID:2588
-
\??\c:\3xrllrr.exec:\3xrllrr.exe84⤵PID:2932
-
\??\c:\bnbnnh.exec:\bnbnnh.exe85⤵PID:2956
-
\??\c:\thtbtn.exec:\thtbtn.exe86⤵PID:1700
-
\??\c:\jdvdd.exec:\jdvdd.exe87⤵PID:2028
-
\??\c:\vpjjj.exec:\vpjjj.exe88⤵PID:2516
-
\??\c:\7lxxxxf.exec:\7lxxxxf.exe89⤵PID:2892
-
\??\c:\5rxxfxx.exec:\5rxxfxx.exe90⤵PID:2864
-
\??\c:\3lfflfr.exec:\3lfflfr.exe91⤵PID:2924
-
\??\c:\bnnbtn.exec:\bnnbtn.exe92⤵PID:2696
-
\??\c:\thtbbt.exec:\thtbbt.exe93⤵PID:2732
-
\??\c:\9vjjd.exec:\9vjjd.exe94⤵PID:2472
-
\??\c:\7vppd.exec:\7vppd.exe95⤵PID:1308
-
\??\c:\xlllfxf.exec:\xlllfxf.exe96⤵PID:1652
-
\??\c:\xllfxff.exec:\xllfxff.exe97⤵PID:1892
-
\??\c:\5lfxlff.exec:\5lfxlff.exe98⤵PID:1648
-
\??\c:\thhhhb.exec:\thhhhb.exe99⤵PID:2272
-
\??\c:\hbtttn.exec:\hbtttn.exe100⤵PID:2636
-
\??\c:\7dpjp.exec:\7dpjp.exe101⤵PID:2116
-
\??\c:\vpdvd.exec:\vpdvd.exe102⤵PID:1316
-
\??\c:\lxxxlxl.exec:\lxxxlxl.exe103⤵PID:2888
-
\??\c:\5lxlxff.exec:\5lxlxff.exe104⤵PID:1288
-
\??\c:\lxxxllx.exec:\lxxxllx.exe105⤵PID:2220
-
\??\c:\thttbt.exec:\thttbt.exe106⤵PID:2960
-
\??\c:\hbnthb.exec:\hbnthb.exe107⤵PID:324
-
\??\c:\3pvvv.exec:\3pvvv.exe108⤵PID:980
-
\??\c:\3pjpd.exec:\3pjpd.exe109⤵PID:564
-
\??\c:\lfllrrf.exec:\lfllrrf.exe110⤵PID:3032
-
\??\c:\5frrxxf.exec:\5frrxxf.exe111⤵PID:3068
-
\??\c:\rxfflfl.exec:\rxfflfl.exe112⤵PID:752
-
\??\c:\bthttt.exec:\bthttt.exe113⤵PID:1368
-
\??\c:\hthhnn.exec:\hthhnn.exe114⤵PID:2388
-
\??\c:\7dppv.exec:\7dppv.exe115⤵PID:696
-
\??\c:\jdjpj.exec:\jdjpj.exe116⤵PID:2684
-
\??\c:\jppjp.exec:\jppjp.exe117⤵PID:852
-
\??\c:\xrffxxf.exec:\xrffxxf.exe118⤵PID:2044
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe119⤵PID:404
-
\??\c:\btnnbh.exec:\btnnbh.exe120⤵PID:880
-
\??\c:\5bnnbh.exec:\5bnnbh.exe121⤵PID:312
-
\??\c:\5btttb.exec:\5btttb.exe122⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-