Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe
-
Size
400KB
-
MD5
16710183c9f7b074c19c73584c9536db
-
SHA1
8c795671c0179ddba613d703579518d82266107c
-
SHA256
34b8fc789b121f007058329ca7d79484968c143e7430632a6d52c4632c5eeea3
-
SHA512
63d3da2188103358b3bae6d2beea55948650b762754ef613ffdf23498e3b06d4245304dc17ba33dc287ba389b386b7b84ab3c0c21a0649a77cdbd0122971f7af
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwzWGeaSRnv4bd3uXK:8cm7ImGddXmNt251UriZFwCJFngbUK
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/1636-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-656-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2888-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-786-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/792-1077-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 864 jjvdj.exe 2036 ppdjj.exe 2648 7tnnhh.exe 2964 rlrrflx.exe 2708 7hbbnn.exe 2508 nnbtnb.exe 2544 lxfffxl.exe 2448 bthnnn.exe 1204 5vvvd.exe 2556 lxfxrxx.exe 2748 bnbtbt.exe 1616 jvvpp.exe 2156 rfxlrlx.exe 1920 nbtntb.exe 1732 vpvvj.exe 2768 7xxrfxx.exe 2152 5thnhh.exe 1460 1vjdj.exe 2172 frxxllr.exe 904 ddppd.exe 2044 3rfxllr.exe 324 3bbtnn.exe 1004 7vddd.exe 2840 xlxrrrr.exe 1764 nbhbhb.exe 1608 pvdjj.exe 1008 nhbtth.exe 1600 9dppp.exe 1248 3frrxxl.exe 868 7hnhhh.exe 1164 djvjp.exe 2848 frxrlll.exe 1888 hbntbb.exe 1284 jvjpv.exe 1536 rfffffl.exe 2512 frrxxxr.exe 2704 bntbhb.exe 2036 9jpjd.exe 2168 vjjpv.exe 2976 3llfxrx.exe 2964 5tntbt.exe 2600 nbbhhh.exe 2304 jvppd.exe 2416 rxxlrfl.exe 2896 nbntbt.exe 1808 7tbhhn.exe 2636 vpvjj.exe 2616 lxfxfxf.exe 2640 9lllfxr.exe 272 htbbhh.exe 1768 jvjdd.exe 1928 jpvdj.exe 768 7xllfff.exe 1960 btbhnn.exe 2252 vpddj.exe 1560 jvjjp.exe 2152 rfrrxxx.exe 2776 lfrxxxx.exe 2792 nbnnnh.exe 2216 pdjjj.exe 1856 vjvpv.exe 2352 lxrrxrl.exe 612 tbhbtn.exe 324 5tbtbt.exe -
resource yara_rule behavioral1/memory/1636-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-536-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1656-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-550-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/2968-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-989-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-1045-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1052-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-1077-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 864 1636 16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe 28 PID 1636 wrote to memory of 864 1636 16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe 28 PID 1636 wrote to memory of 864 1636 16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe 28 PID 1636 wrote to memory of 864 1636 16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe 28 PID 864 wrote to memory of 2036 864 jjvdj.exe 29 PID 864 wrote to memory of 2036 864 jjvdj.exe 29 PID 864 wrote to memory of 2036 864 jjvdj.exe 29 PID 864 wrote to memory of 2036 864 jjvdj.exe 29 PID 2036 wrote to memory of 2648 2036 ppdjj.exe 30 PID 2036 wrote to memory of 2648 2036 ppdjj.exe 30 PID 2036 wrote to memory of 2648 2036 ppdjj.exe 30 PID 2036 wrote to memory of 2648 2036 ppdjj.exe 30 PID 2648 wrote to memory of 2964 2648 7tnnhh.exe 31 PID 2648 wrote to memory of 2964 2648 7tnnhh.exe 31 PID 2648 wrote to memory of 2964 2648 7tnnhh.exe 31 PID 2648 wrote to memory of 2964 2648 7tnnhh.exe 31 PID 2964 wrote to memory of 2708 2964 rlrrflx.exe 32 PID 2964 wrote to memory of 2708 2964 rlrrflx.exe 32 PID 2964 wrote to memory of 2708 2964 rlrrflx.exe 32 PID 2964 wrote to memory of 2708 2964 rlrrflx.exe 32 PID 2708 wrote to memory of 2508 2708 7hbbnn.exe 33 PID 2708 wrote to memory of 2508 2708 7hbbnn.exe 33 PID 2708 wrote to memory of 2508 2708 7hbbnn.exe 33 PID 2708 wrote to memory of 2508 2708 7hbbnn.exe 33 PID 2508 wrote to memory of 2544 2508 nnbtnb.exe 34 PID 2508 wrote to memory of 2544 2508 nnbtnb.exe 34 PID 2508 wrote to memory of 2544 2508 nnbtnb.exe 34 PID 2508 wrote to memory of 2544 2508 nnbtnb.exe 34 PID 2544 wrote to memory of 2448 2544 lxfffxl.exe 35 PID 2544 wrote to memory of 2448 2544 lxfffxl.exe 35 PID 2544 wrote to memory of 2448 2544 lxfffxl.exe 35 PID 2544 wrote to memory of 2448 2544 lxfffxl.exe 35 PID 2448 wrote to memory of 1204 2448 bthnnn.exe 36 PID 2448 wrote to memory of 1204 2448 bthnnn.exe 36 PID 2448 wrote to memory of 1204 2448 bthnnn.exe 36 PID 2448 wrote to memory of 1204 2448 bthnnn.exe 36 PID 1204 wrote to memory of 2556 1204 5vvvd.exe 37 PID 1204 wrote to memory of 2556 1204 5vvvd.exe 37 PID 1204 wrote to memory of 2556 1204 5vvvd.exe 37 PID 1204 wrote to memory of 2556 1204 5vvvd.exe 37 PID 2556 wrote to memory of 2748 2556 lxfxrxx.exe 38 PID 2556 wrote to memory of 2748 2556 lxfxrxx.exe 38 PID 2556 wrote to memory of 2748 2556 lxfxrxx.exe 38 PID 2556 wrote to memory of 2748 2556 lxfxrxx.exe 38 PID 2748 wrote to memory of 1616 2748 bnbtbt.exe 39 PID 2748 wrote to memory of 1616 2748 bnbtbt.exe 39 PID 2748 wrote to memory of 1616 2748 bnbtbt.exe 39 PID 2748 wrote to memory of 1616 2748 bnbtbt.exe 39 PID 1616 wrote to memory of 2156 1616 jvvpp.exe 40 PID 1616 wrote to memory of 2156 1616 jvvpp.exe 40 PID 1616 wrote to memory of 2156 1616 jvvpp.exe 40 PID 1616 wrote to memory of 2156 1616 jvvpp.exe 40 PID 2156 wrote to memory of 1920 2156 rfxlrlx.exe 41 PID 2156 wrote to memory of 1920 2156 rfxlrlx.exe 41 PID 2156 wrote to memory of 1920 2156 rfxlrlx.exe 41 PID 2156 wrote to memory of 1920 2156 rfxlrlx.exe 41 PID 1920 wrote to memory of 1732 1920 nbtntb.exe 42 PID 1920 wrote to memory of 1732 1920 nbtntb.exe 42 PID 1920 wrote to memory of 1732 1920 nbtntb.exe 42 PID 1920 wrote to memory of 1732 1920 nbtntb.exe 42 PID 1732 wrote to memory of 2768 1732 vpvvj.exe 43 PID 1732 wrote to memory of 2768 1732 vpvvj.exe 43 PID 1732 wrote to memory of 2768 1732 vpvvj.exe 43 PID 1732 wrote to memory of 2768 1732 vpvvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\jjvdj.exec:\jjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\ppdjj.exec:\ppdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\7tnnhh.exec:\7tnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rlrrflx.exec:\rlrrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7hbbnn.exec:\7hbbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\nnbtnb.exec:\nnbtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\lxfffxl.exec:\lxfffxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\bthnnn.exec:\bthnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5vvvd.exec:\5vvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\bnbtbt.exec:\bnbtbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jvvpp.exec:\jvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\rfxlrlx.exec:\rfxlrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\nbtntb.exec:\nbtntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\vpvvj.exec:\vpvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\7xxrfxx.exec:\7xxrfxx.exe17⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5thnhh.exec:\5thnhh.exe18⤵
- Executes dropped EXE
PID:2152 -
\??\c:\1vjdj.exec:\1vjdj.exe19⤵
- Executes dropped EXE
PID:1460 -
\??\c:\frxxllr.exec:\frxxllr.exe20⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ddppd.exec:\ddppd.exe21⤵
- Executes dropped EXE
PID:904 -
\??\c:\3rfxllr.exec:\3rfxllr.exe22⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3bbtnn.exec:\3bbtnn.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\7vddd.exec:\7vddd.exe24⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe25⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nbhbhb.exec:\nbhbhb.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pvdjj.exec:\pvdjj.exe27⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nhbtth.exec:\nhbtth.exe28⤵
- Executes dropped EXE
PID:1008 -
\??\c:\9dppp.exec:\9dppp.exe29⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3frrxxl.exec:\3frrxxl.exe30⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7hnhhh.exec:\7hnhhh.exe31⤵
- Executes dropped EXE
PID:868 -
\??\c:\djvjp.exec:\djvjp.exe32⤵
- Executes dropped EXE
PID:1164 -
\??\c:\frxrlll.exec:\frxrlll.exe33⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hbntbb.exec:\hbntbb.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jvjpv.exec:\jvjpv.exe35⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rfffffl.exec:\rfffffl.exe36⤵
- Executes dropped EXE
PID:1536 -
\??\c:\frrxxxr.exec:\frrxxxr.exe37⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bntbhb.exec:\bntbhb.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9jpjd.exec:\9jpjd.exe39⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vjjpv.exec:\vjjpv.exe40⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3llfxrx.exec:\3llfxrx.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5tntbt.exec:\5tntbt.exe42⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nbbhhh.exec:\nbbhhh.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jvppd.exec:\jvppd.exe44⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rxxlrfl.exec:\rxxlrfl.exe45⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nbntbt.exec:\nbntbt.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7tbhhn.exec:\7tbhhn.exe47⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vpvjj.exec:\vpvjj.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lxfxfxf.exec:\lxfxfxf.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9lllfxr.exec:\9lllfxr.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\htbbhh.exec:\htbbhh.exe51⤵
- Executes dropped EXE
PID:272 -
\??\c:\jvjdd.exec:\jvjdd.exe52⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jpvdj.exec:\jpvdj.exe53⤵
- Executes dropped EXE
PID:1928 -
\??\c:\7xllfff.exec:\7xllfff.exe54⤵
- Executes dropped EXE
PID:768 -
\??\c:\btbhnn.exec:\btbhnn.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vpddj.exec:\vpddj.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jvjjp.exec:\jvjjp.exe57⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe59⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nbnnnh.exec:\nbnnnh.exe60⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pdjjj.exec:\pdjjj.exe61⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vjvpv.exec:\vjvpv.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lxrrxrl.exec:\lxrrxrl.exe63⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tbhbtn.exec:\tbhbtn.exe64⤵
- Executes dropped EXE
PID:612 -
\??\c:\5tbtbt.exec:\5tbtbt.exe65⤵
- Executes dropped EXE
PID:324 -
\??\c:\dpvpj.exec:\dpvpj.exe66⤵PID:1004
-
\??\c:\5pddd.exec:\5pddd.exe67⤵PID:656
-
\??\c:\lflxfll.exec:\lflxfll.exe68⤵PID:2072
-
\??\c:\5nbnnh.exec:\5nbnnh.exe69⤵PID:1816
-
\??\c:\nbnnnh.exec:\nbnnnh.exe70⤵PID:1484
-
\??\c:\pjddj.exec:\pjddj.exe71⤵PID:1656
-
\??\c:\1xxfxrf.exec:\1xxfxrf.exe72⤵PID:3000
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe73⤵PID:2016
-
\??\c:\thtttn.exec:\thtttn.exe74⤵PID:1628
-
\??\c:\tnbbhb.exec:\tnbbhb.exe75⤵PID:1212
-
\??\c:\dvddj.exec:\dvddj.exe76⤵PID:1164
-
\??\c:\3rxrrll.exec:\3rxrrll.exe77⤵PID:2988
-
\??\c:\7flffxf.exec:\7flffxf.exe78⤵PID:2844
-
\??\c:\1hnhbb.exec:\1hnhbb.exe79⤵PID:1888
-
\??\c:\nbnhbt.exec:\nbnhbt.exe80⤵PID:1284
-
\??\c:\jpdjv.exec:\jpdjv.exe81⤵PID:2972
-
\??\c:\frfffxf.exec:\frfffxf.exe82⤵PID:2968
-
\??\c:\xrllllf.exec:\xrllllf.exe83⤵PID:2524
-
\??\c:\bthhnh.exec:\bthhnh.exe84⤵PID:2036
-
\??\c:\dppjv.exec:\dppjv.exe85⤵PID:2480
-
\??\c:\1vdvv.exec:\1vdvv.exe86⤵PID:2676
-
\??\c:\lfllrll.exec:\lfllrll.exe87⤵PID:2964
-
\??\c:\rxlffxf.exec:\rxlffxf.exe88⤵PID:2372
-
\??\c:\nhhhnh.exec:\nhhhnh.exe89⤵PID:2444
-
\??\c:\vvdjj.exec:\vvdjj.exe90⤵PID:2888
-
\??\c:\jjvjj.exec:\jjvjj.exe91⤵PID:2892
-
\??\c:\frflxxx.exec:\frflxxx.exe92⤵PID:2596
-
\??\c:\btttbh.exec:\btttbh.exe93⤵PID:2440
-
\??\c:\7thhhh.exec:\7thhhh.exe94⤵PID:2740
-
\??\c:\jpjpv.exec:\jpjpv.exe95⤵PID:812
-
\??\c:\3flxrrx.exec:\3flxrrx.exe96⤵PID:1616
-
\??\c:\xxfllfl.exec:\xxfllfl.exe97⤵PID:1916
-
\??\c:\1bntbh.exec:\1bntbh.exe98⤵PID:472
-
\??\c:\tnbbtn.exec:\tnbbtn.exe99⤵PID:1932
-
\??\c:\5pdvv.exec:\5pdvv.exe100⤵PID:1752
-
\??\c:\xxfxffl.exec:\xxfxffl.exe101⤵PID:2136
-
\??\c:\3lrlllr.exec:\3lrlllr.exe102⤵PID:872
-
\??\c:\7bnnnn.exec:\7bnnnn.exe103⤵PID:2868
-
\??\c:\dpjjv.exec:\dpjjv.exe104⤵PID:1612
-
\??\c:\7ddvd.exec:\7ddvd.exe105⤵PID:1460
-
\??\c:\9xrrrrx.exec:\9xrrrrx.exe106⤵PID:2356
-
\??\c:\7ththt.exec:\7ththt.exe107⤵PID:2064
-
\??\c:\5pjpp.exec:\5pjpp.exe108⤵PID:2828
-
\??\c:\ppjpd.exec:\ppjpd.exe109⤵PID:792
-
\??\c:\5xllffl.exec:\5xllffl.exe110⤵PID:696
-
\??\c:\nhnttt.exec:\nhnttt.exe111⤵PID:580
-
\??\c:\1bhbtn.exec:\1bhbtn.exe112⤵PID:2840
-
\??\c:\dpdjp.exec:\dpdjp.exe113⤵PID:1220
-
\??\c:\lxllllr.exec:\lxllllr.exe114⤵PID:1328
-
\??\c:\xrxlrrx.exec:\xrxlrrx.exe115⤵PID:1588
-
\??\c:\btbtbt.exec:\btbtbt.exe116⤵PID:1580
-
\??\c:\jdvdv.exec:\jdvdv.exe117⤵PID:1008
-
\??\c:\dvppp.exec:\dvppp.exe118⤵PID:3000
-
\??\c:\rrfxlrx.exec:\rrfxlrx.exe119⤵PID:2016
-
\??\c:\nhtbhh.exec:\nhtbhh.exe120⤵PID:1628
-
\??\c:\jdvdp.exec:\jdvdp.exe121⤵PID:1212
-
\??\c:\lxfllff.exec:\lxfllff.exe122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-