Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe
-
Size
215KB
-
MD5
5cf59e9e2a3ad9d19f4e6725813c15a4
-
SHA1
510b0a1bbc76471c24e4db7da4a823c8eb29ab39
-
SHA256
73959f3da99bac493c1d13f516881deb9ed39afcaea18379b51760a4033103c3
-
SHA512
eb2c6983f3028760324c30242f805fb65d99a25f12be09efda2718761e87443eedab5bb51ca004bba89b289b9d805151d57ae740f88bc90da4dfb732c7dd3875
-
SSDEEP
1536:evQBeOGtrYSSsrc93UBIfdC67m6AJiqzgLrTKBk3IU39TeYmKl:ehOm2sI93UufdC67ciRLPvx3teYmw
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1564-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-27-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-396-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2308-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-871-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-936-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/616-1060-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-1215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3dpdp.exerrxfxll.exerxrlrll.exevpvvp.exe5lfxlxf.exetthhhn.exentbtth.exerxrxlxl.exexxrrxlr.exenhtbhh.exelrrlxlf.exevvpvp.exexfrrxrr.exe7nbtth.exevpvdp.exellffffx.exehhbnhn.exedvpvj.exefxlxflx.exeppdpj.exe1llxlxf.exebbhttn.exe3dvdp.exerrxxfrl.exe5jvvj.exejpvjp.exettnbht.exe9vppv.exefrllrxl.exebhthnh.exevddjj.exexllffrr.exe7thhnb.exe1pdjv.exevvvdp.exerrxlxfr.exehtntbb.exe5nbthb.exe1ddvp.exelfxfxlx.exebbtnbn.exeddpjj.exepdvvv.exehbnbtb.exe5tbnbb.exedddpj.exexxxlflr.exetttbbb.exe9tnbbn.exe7jjjd.exexflxfrx.exe1hhbbn.exedddjj.exeddjpv.exelfflrxx.exettttht.exe9jjvj.exevvpjj.exefllflxl.exebbhbhn.exejpppv.exejdvdd.exelrlxrxl.exe5nnttb.exepid process 1920 3dpdp.exe 2828 rrxfxll.exe 2072 rxrlrll.exe 2712 vpvvp.exe 2656 5lfxlxf.exe 2916 tthhhn.exe 2676 ntbtth.exe 2524 rxrxlxl.exe 2240 xxrrxlr.exe 1664 nhtbhh.exe 2964 lrrlxlf.exe 3052 vvpvp.exe 2740 xfrrxrr.exe 1308 7nbtth.exe 1940 vpvdp.exe 2576 llffffx.exe 2880 hhbnhn.exe 288 dvpvj.exe 2404 fxlxflx.exe 3020 ppdpj.exe 264 1llxlxf.exe 1488 bbhttn.exe 1096 3dvdp.exe 1132 rrxxfrl.exe 2028 5jvvj.exe 2472 jpvjp.exe 1676 ttnbht.exe 1372 9vppv.exe 2236 frllrxl.exe 840 bhthnh.exe 2016 vddjj.exe 3036 xllffrr.exe 1396 7thhnb.exe 2396 1pdjv.exe 2588 vvvdp.exe 1864 rrxlxfr.exe 1268 htntbb.exe 1608 5nbthb.exe 2384 1ddvp.exe 2660 lfxfxlx.exe 2620 bbtnbn.exe 2708 ddpjj.exe 2656 pdvvv.exe 2800 hbnbtb.exe 2808 5tbnbb.exe 2572 dddpj.exe 2580 xxxlflr.exe 2560 tttbbb.exe 740 9tnbbn.exe 2928 7jjjd.exe 1256 xflxfrx.exe 1820 1hhbbn.exe 2148 dddjj.exe 2308 ddjpv.exe 2160 lfflrxx.exe 2744 ttttht.exe 2844 9jjvj.exe 1264 vvpjj.exe 2172 fllflxl.exe 1232 bbhbhn.exe 3012 jpppv.exe 2064 jdvdd.exe 536 lrlxrxl.exe 1100 5nnttb.exe -
Processes:
resource yara_rule behavioral1/memory/1564-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-81-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2240-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-480-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1100-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-996-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-1060-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-1109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-1190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-1215-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe3dpdp.exerrxfxll.exerxrlrll.exevpvvp.exe5lfxlxf.exetthhhn.exentbtth.exerxrxlxl.exexxrrxlr.exenhtbhh.exelrrlxlf.exevvpvp.exexfrrxrr.exe7nbtth.exevpvdp.exedescription pid process target process PID 1564 wrote to memory of 1920 1564 5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe 3dpdp.exe PID 1564 wrote to memory of 1920 1564 5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe 3dpdp.exe PID 1564 wrote to memory of 1920 1564 5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe 3dpdp.exe PID 1564 wrote to memory of 1920 1564 5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe 3dpdp.exe PID 1920 wrote to memory of 2828 1920 3dpdp.exe rrxfxll.exe PID 1920 wrote to memory of 2828 1920 3dpdp.exe rrxfxll.exe PID 1920 wrote to memory of 2828 1920 3dpdp.exe rrxfxll.exe PID 1920 wrote to memory of 2828 1920 3dpdp.exe rrxfxll.exe PID 2828 wrote to memory of 2072 2828 rrxfxll.exe rxrlrll.exe PID 2828 wrote to memory of 2072 2828 rrxfxll.exe rxrlrll.exe PID 2828 wrote to memory of 2072 2828 rrxfxll.exe rxrlrll.exe PID 2828 wrote to memory of 2072 2828 rrxfxll.exe rxrlrll.exe PID 2072 wrote to memory of 2712 2072 rxrlrll.exe vpvvp.exe PID 2072 wrote to memory of 2712 2072 rxrlrll.exe vpvvp.exe PID 2072 wrote to memory of 2712 2072 rxrlrll.exe vpvvp.exe PID 2072 wrote to memory of 2712 2072 rxrlrll.exe vpvvp.exe PID 2712 wrote to memory of 2656 2712 vpvvp.exe 5lfxlxf.exe PID 2712 wrote to memory of 2656 2712 vpvvp.exe 5lfxlxf.exe PID 2712 wrote to memory of 2656 2712 vpvvp.exe 5lfxlxf.exe PID 2712 wrote to memory of 2656 2712 vpvvp.exe 5lfxlxf.exe PID 2656 wrote to memory of 2916 2656 5lfxlxf.exe tthhhn.exe PID 2656 wrote to memory of 2916 2656 5lfxlxf.exe tthhhn.exe PID 2656 wrote to memory of 2916 2656 5lfxlxf.exe tthhhn.exe PID 2656 wrote to memory of 2916 2656 5lfxlxf.exe tthhhn.exe PID 2916 wrote to memory of 2676 2916 tthhhn.exe ntbtth.exe PID 2916 wrote to memory of 2676 2916 tthhhn.exe ntbtth.exe PID 2916 wrote to memory of 2676 2916 tthhhn.exe ntbtth.exe PID 2916 wrote to memory of 2676 2916 tthhhn.exe ntbtth.exe PID 2676 wrote to memory of 2524 2676 ntbtth.exe rxrxlxl.exe PID 2676 wrote to memory of 2524 2676 ntbtth.exe rxrxlxl.exe PID 2676 wrote to memory of 2524 2676 ntbtth.exe rxrxlxl.exe PID 2676 wrote to memory of 2524 2676 ntbtth.exe rxrxlxl.exe PID 2524 wrote to memory of 2240 2524 rxrxlxl.exe xxrrxlr.exe PID 2524 wrote to memory of 2240 2524 rxrxlxl.exe xxrrxlr.exe PID 2524 wrote to memory of 2240 2524 rxrxlxl.exe xxrrxlr.exe PID 2524 wrote to memory of 2240 2524 rxrxlxl.exe xxrrxlr.exe PID 2240 wrote to memory of 1664 2240 xxrrxlr.exe nhtbhh.exe PID 2240 wrote to memory of 1664 2240 xxrrxlr.exe nhtbhh.exe PID 2240 wrote to memory of 1664 2240 xxrrxlr.exe nhtbhh.exe PID 2240 wrote to memory of 1664 2240 xxrrxlr.exe nhtbhh.exe PID 1664 wrote to memory of 2964 1664 nhtbhh.exe lrrlxlf.exe PID 1664 wrote to memory of 2964 1664 nhtbhh.exe lrrlxlf.exe PID 1664 wrote to memory of 2964 1664 nhtbhh.exe lrrlxlf.exe PID 1664 wrote to memory of 2964 1664 nhtbhh.exe lrrlxlf.exe PID 2964 wrote to memory of 3052 2964 lrrlxlf.exe vvpvp.exe PID 2964 wrote to memory of 3052 2964 lrrlxlf.exe vvpvp.exe PID 2964 wrote to memory of 3052 2964 lrrlxlf.exe vvpvp.exe PID 2964 wrote to memory of 3052 2964 lrrlxlf.exe vvpvp.exe PID 3052 wrote to memory of 2740 3052 vvpvp.exe xfrrxrr.exe PID 3052 wrote to memory of 2740 3052 vvpvp.exe xfrrxrr.exe PID 3052 wrote to memory of 2740 3052 vvpvp.exe xfrrxrr.exe PID 3052 wrote to memory of 2740 3052 vvpvp.exe xfrrxrr.exe PID 2740 wrote to memory of 1308 2740 xfrrxrr.exe 7nbtth.exe PID 2740 wrote to memory of 1308 2740 xfrrxrr.exe 7nbtth.exe PID 2740 wrote to memory of 1308 2740 xfrrxrr.exe 7nbtth.exe PID 2740 wrote to memory of 1308 2740 xfrrxrr.exe 7nbtth.exe PID 1308 wrote to memory of 1940 1308 7nbtth.exe vpvdp.exe PID 1308 wrote to memory of 1940 1308 7nbtth.exe vpvdp.exe PID 1308 wrote to memory of 1940 1308 7nbtth.exe vpvdp.exe PID 1308 wrote to memory of 1940 1308 7nbtth.exe vpvdp.exe PID 1940 wrote to memory of 2576 1940 vpvdp.exe llffffx.exe PID 1940 wrote to memory of 2576 1940 vpvdp.exe llffffx.exe PID 1940 wrote to memory of 2576 1940 vpvdp.exe llffffx.exe PID 1940 wrote to memory of 2576 1940 vpvdp.exe llffffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5cf59e9e2a3ad9d19f4e6725813c15a4_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\3dpdp.exec:\3dpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rrxfxll.exec:\rrxfxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rxrlrll.exec:\rxrlrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpvvp.exec:\vpvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5lfxlxf.exec:\5lfxlxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tthhhn.exec:\tthhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ntbtth.exec:\ntbtth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rxrxlxl.exec:\rxrxlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xxrrxlr.exec:\xxrrxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nhtbhh.exec:\nhtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\lrrlxlf.exec:\lrrlxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vvpvp.exec:\vvpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\xfrrxrr.exec:\xfrrxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7nbtth.exec:\7nbtth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\vpvdp.exec:\vpvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\llffffx.exec:\llffffx.exe17⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hhbnhn.exec:\hhbnhn.exe18⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dvpvj.exec:\dvpvj.exe19⤵
- Executes dropped EXE
PID:288 -
\??\c:\fxlxflx.exec:\fxlxflx.exe20⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ppdpj.exec:\ppdpj.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1llxlxf.exec:\1llxlxf.exe22⤵
- Executes dropped EXE
PID:264 -
\??\c:\bbhttn.exec:\bbhttn.exe23⤵
- Executes dropped EXE
PID:1488 -
\??\c:\3dvdp.exec:\3dvdp.exe24⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rrxxfrl.exec:\rrxxfrl.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\5jvvj.exec:\5jvvj.exe26⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jpvjp.exec:\jpvjp.exe27⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ttnbht.exec:\ttnbht.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9vppv.exec:\9vppv.exe29⤵
- Executes dropped EXE
PID:1372 -
\??\c:\frllrxl.exec:\frllrxl.exe30⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bhthnh.exec:\bhthnh.exe31⤵
- Executes dropped EXE
PID:840 -
\??\c:\vddjj.exec:\vddjj.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xllffrr.exec:\xllffrr.exe33⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7thhnb.exec:\7thhnb.exe34⤵
- Executes dropped EXE
PID:1396 -
\??\c:\1pdjv.exec:\1pdjv.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvvdp.exec:\vvvdp.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe37⤵
- Executes dropped EXE
PID:1864 -
\??\c:\htntbb.exec:\htntbb.exe38⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5nbthb.exec:\5nbthb.exe39⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1ddvp.exec:\1ddvp.exe40⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lfxfxlx.exec:\lfxfxlx.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bbtnbn.exec:\bbtnbn.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ddpjj.exec:\ddpjj.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdvvv.exec:\pdvvv.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbnbtb.exec:\hbnbtb.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5tbnbb.exec:\5tbnbb.exe46⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dddpj.exec:\dddpj.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xxxlflr.exec:\xxxlflr.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tttbbb.exec:\tttbbb.exe49⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9tnbbn.exec:\9tnbbn.exe50⤵
- Executes dropped EXE
PID:740 -
\??\c:\7jjjd.exec:\7jjjd.exe51⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xflxfrx.exec:\xflxfrx.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\1hhbbn.exec:\1hhbbn.exe53⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dddjj.exec:\dddjj.exe54⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ddjpv.exec:\ddjpv.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lfflrxx.exec:\lfflrxx.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ttttht.exec:\ttttht.exe57⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9jjvj.exec:\9jjvj.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vvpjj.exec:\vvpjj.exe59⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fllflxl.exec:\fllflxl.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bbhbhn.exec:\bbhbhn.exe61⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jpppv.exec:\jpppv.exe62⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jdvdd.exec:\jdvdd.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lrlxrxl.exec:\lrlxrxl.exe64⤵
- Executes dropped EXE
PID:536 -
\??\c:\5nnttb.exec:\5nnttb.exe65⤵
- Executes dropped EXE
PID:1100 -
\??\c:\5jjvj.exec:\5jjvj.exe66⤵PID:2000
-
\??\c:\ddvvp.exec:\ddvvp.exe67⤵PID:1340
-
\??\c:\xfllxxx.exec:\xfllxxx.exe68⤵PID:676
-
\??\c:\htbhtt.exec:\htbhtt.exe69⤵PID:1516
-
\??\c:\vvppp.exec:\vvppp.exe70⤵PID:1528
-
\??\c:\9xxxlrf.exec:\9xxxlrf.exe71⤵PID:328
-
\??\c:\ffrlflf.exec:\ffrlflf.exe72⤵PID:1336
-
\??\c:\bnbhnt.exec:\bnbhnt.exe73⤵PID:988
-
\??\c:\7pjpj.exec:\7pjpj.exe74⤵PID:1956
-
\??\c:\jjjvp.exec:\jjjvp.exe75⤵PID:892
-
\??\c:\ffxffrl.exec:\ffxffrl.exe76⤵PID:3000
-
\??\c:\tbntnb.exec:\tbntnb.exe77⤵PID:2440
-
\??\c:\5jdpv.exec:\5jdpv.exe78⤵PID:828
-
\??\c:\vvvpv.exec:\vvvpv.exe79⤵PID:880
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe80⤵PID:2176
-
\??\c:\9tnbbt.exec:\9tnbbt.exe81⤵PID:1928
-
\??\c:\ppjpp.exec:\ppjpp.exe82⤵PID:2468
-
\??\c:\djppv.exec:\djppv.exe83⤵PID:2372
-
\??\c:\llfrllx.exec:\llfrllx.exe84⤵PID:1268
-
\??\c:\hhhtnb.exec:\hhhtnb.exe85⤵PID:2652
-
\??\c:\pvjdp.exec:\pvjdp.exe86⤵PID:2716
-
\??\c:\vvjvj.exec:\vvjvj.exe87⤵PID:2664
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe88⤵PID:2628
-
\??\c:\htnhth.exec:\htnhth.exe89⤵PID:2876
-
\??\c:\jddpd.exec:\jddpd.exe90⤵PID:1276
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe91⤵PID:2684
-
\??\c:\3bnbbn.exec:\3bnbbn.exe92⤵PID:2332
-
\??\c:\3pjpv.exec:\3pjpv.exe93⤵PID:2100
-
\??\c:\9fllrrx.exec:\9fllrrx.exe94⤵PID:1796
-
\??\c:\hhbbth.exec:\hhbbth.exe95⤵PID:1084
-
\??\c:\tnnttb.exec:\tnnttb.exe96⤵PID:2960
-
\??\c:\jdddv.exec:\jdddv.exe97⤵PID:3068
-
\??\c:\ffxxfrx.exec:\ffxxfrx.exe98⤵PID:2776
-
\??\c:\hbnntb.exec:\hbnntb.exe99⤵PID:2484
-
\??\c:\3bnnbb.exec:\3bnnbb.exe100⤵PID:744
-
\??\c:\jddpp.exec:\jddpp.exe101⤵PID:2752
-
\??\c:\3rrffxf.exec:\3rrffxf.exe102⤵PID:2836
-
\??\c:\nhhthb.exec:\nhhthb.exe103⤵PID:2924
-
\??\c:\5pdvd.exec:\5pdvd.exe104⤵PID:2868
-
\??\c:\rxrflxl.exec:\rxrflxl.exe105⤵PID:372
-
\??\c:\xrllrxf.exec:\xrllrxf.exe106⤵PID:3016
-
\??\c:\tnhhht.exec:\tnhhht.exe107⤵PID:1688
-
\??\c:\jpvjj.exec:\jpvjj.exe108⤵PID:624
-
\??\c:\rllrxfr.exec:\rllrxfr.exe109⤵PID:2292
-
\??\c:\7xxlxlx.exec:\7xxlxlx.exe110⤵PID:1656
-
\??\c:\vddvv.exec:\vddvv.exe111⤵PID:1804
-
\??\c:\fxxlrlf.exec:\fxxlrlf.exe112⤵PID:1360
-
\??\c:\ffrlflx.exec:\ffrlflx.exe113⤵PID:1504
-
\??\c:\thtbhn.exec:\thtbhn.exe114⤵PID:548
-
\??\c:\3dpvj.exec:\3dpvj.exe115⤵PID:1776
-
\??\c:\9rlxfrr.exec:\9rlxfrr.exe116⤵PID:1968
-
\??\c:\3hbhbb.exec:\3hbhbb.exe117⤵PID:928
-
\??\c:\hhhhbt.exec:\hhhhbt.exe118⤵PID:1936
-
\??\c:\5dppd.exec:\5dppd.exe119⤵PID:2236
-
\??\c:\3xrxflf.exec:\3xrxflf.exe120⤵PID:2288
-
\??\c:\xrrxxrf.exec:\xrrxxrf.exe121⤵PID:1976
-
\??\c:\3bbhtb.exec:\3bbhtb.exe122⤵PID:1624
-
\??\c:\jdpjp.exec:\jdpjp.exe123⤵PID:3060
-
\??\c:\7thhnh.exec:\7thhnh.exe124⤵PID:1064
-
\??\c:\bnhtnh.exec:\bnhtnh.exe125⤵PID:2396
-
\??\c:\pvjpd.exec:\pvjpd.exe126⤵PID:2216
-
\??\c:\bbbhbb.exec:\bbbhbb.exe127⤵PID:1580
-
\??\c:\ntnbhn.exec:\ntnbhn.exe128⤵PID:1916
-
\??\c:\vdvvv.exec:\vdvvv.exe129⤵PID:2616
-
\??\c:\rrlrlxf.exec:\rrlrlxf.exe130⤵PID:2516
-
\??\c:\bttbnn.exec:\bttbnn.exe131⤵PID:2324
-
\??\c:\1vpvj.exec:\1vpvj.exe132⤵PID:2072
-
\??\c:\xxflffr.exec:\xxflffr.exe133⤵PID:2712
-
\??\c:\tnbnbn.exec:\tnbnbn.exe134⤵PID:2804
-
\??\c:\thtthb.exec:\thtthb.exe135⤵PID:2876
-
\??\c:\pdjpj.exec:\pdjpj.exe136⤵PID:1276
-
\??\c:\3ffxllx.exec:\3ffxllx.exe137⤵PID:1692
-
\??\c:\tnhhnn.exec:\tnhhnn.exe138⤵PID:2240
-
\??\c:\bbbnbn.exec:\bbbnbn.exe139⤵PID:2956
-
\??\c:\9pvjp.exec:\9pvjp.exe140⤵PID:2908
-
\??\c:\lfrflxf.exec:\lfrflxf.exe141⤵PID:2920
-
\??\c:\nhttnn.exec:\nhttnn.exe142⤵PID:1256
-
\??\c:\1dvdp.exec:\1dvdp.exe143⤵PID:2864
-
\??\c:\lfrllfl.exec:\lfrllfl.exe144⤵PID:1272
-
\??\c:\rflfrlr.exec:\rflfrlr.exe145⤵PID:1448
-
\??\c:\hhhhhb.exec:\hhhhhb.exe146⤵PID:2784
-
\??\c:\vdvdd.exec:\vdvdd.exe147⤵PID:2760
-
\??\c:\vjvpv.exec:\vjvpv.exe148⤵PID:2844
-
\??\c:\lrlrffl.exec:\lrlrffl.exe149⤵PID:1752
-
\??\c:\bbntbt.exec:\bbntbt.exe150⤵PID:2736
-
\??\c:\7djjj.exec:\7djjj.exe151⤵PID:616
-
\??\c:\llxflxf.exec:\llxflxf.exe152⤵PID:480
-
\??\c:\btthnt.exec:\btthnt.exe153⤵PID:352
-
\??\c:\9nbhtb.exec:\9nbhtb.exe154⤵PID:536
-
\??\c:\3jvjd.exec:\3jvjd.exe155⤵PID:1100
-
\??\c:\lrxxxlf.exec:\lrxxxlf.exe156⤵PID:2000
-
\??\c:\thhtbb.exec:\thhtbb.exe157⤵PID:1804
-
\??\c:\jvdvp.exec:\jvdvp.exe158⤵PID:412
-
\??\c:\ppvjv.exec:\ppvjv.exe159⤵PID:1392
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe160⤵PID:2364
-
\??\c:\hbthtb.exec:\hbthtb.exe161⤵PID:2472
-
\??\c:\jjddj.exec:\jjddj.exe162⤵PID:1336
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe163⤵PID:2132
-
\??\c:\5rrrfrx.exec:\5rrrfrx.exe164⤵PID:2388
-
\??\c:\bhhtth.exec:\bhhtth.exe165⤵PID:3028
-
\??\c:\dvvdp.exec:\dvvdp.exe166⤵PID:868
-
\??\c:\rlxlfrf.exec:\rlxlfrf.exe167⤵PID:1736
-
\??\c:\1lllfrf.exec:\1lllfrf.exe168⤵PID:792
-
\??\c:\btthnb.exec:\btthnb.exe169⤵PID:1624
-
\??\c:\jpvjp.exec:\jpvjp.exe170⤵PID:3056
-
\??\c:\rlfrlrf.exec:\rlfrlrf.exe171⤵PID:1312
-
\??\c:\xrlflfr.exec:\xrlflfr.exe172⤵PID:2688
-
\??\c:\thtbnt.exec:\thtbnt.exe173⤵PID:2432
-
\??\c:\vjpjj.exec:\vjpjj.exe174⤵PID:820
-
\??\c:\xfxllrr.exec:\xfxllrr.exe175⤵PID:2376
-
\??\c:\xxrxlxf.exec:\xxrxlxf.exe176⤵PID:1268
-
\??\c:\bhnhht.exec:\bhnhht.exe177⤵PID:3008
-
\??\c:\jjjdj.exec:\jjjdj.exe178⤵PID:2728
-
\??\c:\rxllfff.exec:\rxllfff.exe179⤵PID:2532
-
\??\c:\7nntbn.exec:\7nntbn.exe180⤵PID:2672
-
\??\c:\ttnbtb.exec:\ttnbtb.exe181⤵PID:2536
-
\??\c:\vpvdj.exec:\vpvdj.exe182⤵PID:2676
-
\??\c:\rfrxrxx.exec:\rfrxrxx.exe183⤵PID:2512
-
\??\c:\tnbbhn.exec:\tnbbhn.exe184⤵PID:2584
-
\??\c:\tnbtnt.exec:\tnbtnt.exe185⤵PID:1948
-
\??\c:\5vpvd.exec:\5vpvd.exe186⤵PID:1796
-
\??\c:\rxlrxrr.exec:\rxlrxrr.exe187⤵PID:2896
-
\??\c:\1hnbnt.exec:\1hnbnt.exe188⤵PID:2964
-
\??\c:\nttbbh.exec:\nttbbh.exe189⤵PID:2856
-
\??\c:\pjvdd.exec:\pjvdd.exe190⤵PID:2740
-
\??\c:\1rrflfr.exec:\1rrflfr.exe191⤵PID:304
-
\??\c:\nnbbtb.exec:\nnbbtb.exe192⤵PID:1292
-
\??\c:\hnnbhh.exec:\hnnbhh.exe193⤵PID:2848
-
\??\c:\vvvjd.exec:\vvvjd.exe194⤵PID:2860
-
\??\c:\1xflrxf.exec:\1xflrxf.exe195⤵PID:796
-
\??\c:\5llxflx.exec:\5llxflx.exe196⤵PID:1696
-
\??\c:\nhtnbb.exec:\nhtnbb.exe197⤵PID:2404
-
\??\c:\ddvdp.exec:\ddvdp.exe198⤵PID:3024
-
\??\c:\ddjpj.exec:\ddjpj.exe199⤵PID:1724
-
\??\c:\7rfxxrl.exec:\7rfxxrl.exe200⤵PID:624
-
\??\c:\3tnnbh.exec:\3tnnbh.exe201⤵PID:964
-
\??\c:\pjppd.exec:\pjppd.exe202⤵PID:536
-
\??\c:\jddjv.exec:\jddjv.exe203⤵PID:1544
-
\??\c:\xxlflrx.exec:\xxlflrx.exe204⤵PID:1132
-
\??\c:\btnntb.exec:\btnntb.exe205⤵PID:1476
-
\??\c:\nhntbh.exec:\nhntbh.exe206⤵PID:2348
-
\??\c:\djpdd.exec:\djpdd.exe207⤵PID:316
-
\??\c:\frxlflx.exec:\frxlflx.exe208⤵PID:596
-
\??\c:\bbntbh.exec:\bbntbh.exe209⤵PID:1964
-
\??\c:\bbbbth.exec:\bbbbth.exe210⤵PID:1944
-
\??\c:\jjpvv.exec:\jjpvv.exe211⤵PID:2044
-
\??\c:\rrlxffx.exec:\rrlxffx.exe212⤵PID:2320
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe213⤵PID:1076
-
\??\c:\nnhbtt.exec:\nnhbtt.exe214⤵PID:324
-
\??\c:\jdjjj.exec:\jdjjj.exe215⤵PID:3036
-
\??\c:\vdjdj.exec:\vdjdj.exe216⤵PID:2424
-
\??\c:\fllxfrr.exec:\fllxfrr.exe217⤵PID:3060
-
\??\c:\hbntbh.exec:\hbntbh.exe218⤵PID:2176
-
\??\c:\ddpdv.exec:\ddpdv.exe219⤵PID:1312
-
\??\c:\pdvjj.exec:\pdvjj.exe220⤵PID:1616
-
\??\c:\lfllxfr.exec:\lfllxfr.exe221⤵PID:2432
-
\??\c:\7bbhbn.exec:\7bbhbn.exe222⤵PID:1916
-
\??\c:\hhbnbh.exec:\hhbnbh.exe223⤵PID:2376
-
\??\c:\djpdj.exec:\djpdj.exe224⤵PID:2112
-
\??\c:\9xxflrl.exec:\9xxflrl.exe225⤵PID:2696
-
\??\c:\9lxlfxr.exec:\9lxlfxr.exe226⤵PID:2728
-
\??\c:\7tbbhb.exec:\7tbbhb.exe227⤵PID:2664
-
\??\c:\vvjdp.exec:\vvjdp.exe228⤵PID:2648
-
\??\c:\9flflrr.exec:\9flflrr.exe229⤵PID:2508
-
\??\c:\7fxlrfr.exec:\7fxlrfr.exe230⤵PID:2684
-
\??\c:\tnnnhn.exec:\tnnnhn.exe231⤵PID:2168
-
\??\c:\pvpjv.exec:\pvpjv.exe232⤵PID:2332
-
\??\c:\1vpdp.exec:\1vpdp.exe233⤵PID:2780
-
\??\c:\llffllf.exec:\llffllf.exe234⤵PID:2956
-
\??\c:\bhhthn.exec:\bhhthn.exe235⤵PID:1364
-
\??\c:\hnnbht.exec:\hnnbht.exe236⤵PID:2920
-
\??\c:\pjjjj.exec:\pjjjj.exe237⤵PID:1256
-
\??\c:\7fxlllx.exec:\7fxlllx.exe238⤵PID:2864
-
\??\c:\bhnnht.exec:\bhnnht.exe239⤵PID:2612
-
\??\c:\ppdjv.exec:\ppdjv.exe240⤵PID:2768
-
\??\c:\lxxxflr.exec:\lxxxflr.exe241⤵PID:2744
-
\??\c:\hnhhbn.exec:\hnhhbn.exe242⤵PID:2004