Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 19:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe
-
Size
386KB
-
MD5
60dcae1fae996736f647fa8280065e65
-
SHA1
7aeb8ff842ff4b1fb8c609b495dbd7a0966aabd3
-
SHA256
bb683d400ba7da06fea8265438f9f2da38cb60c2c5d1dfe0ecf7243ac58a7068
-
SHA512
5f1002a3b4a34033f07b442ada15b693ae142227ad3a3fd8e9ecc82bce45455c06284cf6e3968b8af1a577716c75748e7e299c51e3ce9f939c61c5c8348acffa
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFw8TCvtcM72o+:8cm7ImGddXmNt251UriZFwGCvVQ
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2280-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-1146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-1174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-1236-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2804-1250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1204-1270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrfrllf.exenbttbt.exe9rffxfx.exe7bnntb.exe1dvvj.exexlrxfxf.exejdjvd.exexllfxxx.exenhtthh.exefrfxfxf.exennhnbh.exebtbbnn.exedpdpj.exefxrlrlr.exepvvdv.exevvpdj.exe1lxfllr.exejdpdp.exelffrxlx.exenbhhhb.exe5vppj.exe3vvvj.exe9bbttt.exejdjpv.exerlxfrxf.exeththhb.exe7dvjv.exe1lrrrff.exe3thhnn.exefxllxxl.exehbtbnb.exedpvdj.exexfrrrrx.exennbnnt.exelrflxfl.exe1xrxlll.exettntht.exevpddj.exe3dpvv.exe9llfxfr.exe1bntbh.exenhbbtt.exevpddj.exejpjdj.exefxrrxfx.exehttthh.exehbthnn.exevpdpd.exe3xlffxr.exerlrrxxl.exebtnnnh.exehbtthn.exepjdjp.exelfxflrf.exelfrrxrf.exehhbnbn.exe9jvpj.exe5rrflrf.exexrffrrf.exettthnn.exejjdjd.exerllxxfr.exelrlrffr.exehnhhtb.exepid process 1928 rrfrllf.exe 1836 nbttbt.exe 2012 9rffxfx.exe 2596 7bnntb.exe 2928 1dvvj.exe 2916 xlrxfxf.exe 2488 jdjvd.exe 1316 xllfxxx.exe 2452 nhtthh.exe 1056 frfxfxf.exe 3068 nnhnbh.exe 2892 btbbnn.exe 296 dpdpj.exe 2836 fxrlrlr.exe 2692 pvvdv.exe 2860 vvpdj.exe 3032 1lxfllr.exe 1636 jdpdp.exe 1768 lffrxlx.exe 2076 nbhhhb.exe 1172 5vppj.exe 1388 3vvvj.exe 1972 9bbttt.exe 2520 jdjpv.exe 2924 rlxfrxf.exe 1784 ththhb.exe 1368 7dvjv.exe 796 1lrrrff.exe 1664 3thhnn.exe 2088 fxllxxl.exe 2204 hbtbnb.exe 1696 dpvdj.exe 2960 xfrrrrx.exe 1272 nnbnnt.exe 2008 lrflxfl.exe 2228 1xrxlll.exe 1796 ttntht.exe 2144 vpddj.exe 2660 3dpvv.exe 2604 9llfxfr.exe 2460 1bntbh.exe 2556 nhbbtt.exe 2916 vpddj.exe 2632 jpjdj.exe 812 fxrrxfx.exe 2484 httthh.exe 2528 hbthnn.exe 2624 vpdpd.exe 2468 3xlffxr.exe 2792 rlrrxxl.exe 3044 btnnnh.exe 2848 hbtthn.exe 2824 pjdjp.exe 1584 lfxflrf.exe 3048 lfrrxrf.exe 3004 hhbnbn.exe 2180 9jvpj.exe 1532 5rrflrf.exe 1564 xrffrrf.exe 1800 ttthnn.exe 1172 jjdjd.exe 1756 rllxxfr.exe 2244 lrlrffr.exe 1868 hnhhtb.exe -
Processes:
resource yara_rule behavioral1/memory/2280-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-1160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-1167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-1174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-1181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-1250-0x0000000000220000-0x000000000024A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
60dcae1fae996736f647fa8280065e65_JaffaCakes118.exerrfrllf.exenbttbt.exe9rffxfx.exe7bnntb.exe1dvvj.exexlrxfxf.exejdjvd.exexllfxxx.exenhtthh.exefrfxfxf.exennhnbh.exebtbbnn.exedpdpj.exefxrlrlr.exepvvdv.exedescription pid process target process PID 2280 wrote to memory of 1928 2280 60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe rrfrllf.exe PID 2280 wrote to memory of 1928 2280 60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe rrfrllf.exe PID 2280 wrote to memory of 1928 2280 60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe rrfrllf.exe PID 2280 wrote to memory of 1928 2280 60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe rrfrllf.exe PID 1928 wrote to memory of 1836 1928 rrfrllf.exe nbttbt.exe PID 1928 wrote to memory of 1836 1928 rrfrllf.exe nbttbt.exe PID 1928 wrote to memory of 1836 1928 rrfrllf.exe nbttbt.exe PID 1928 wrote to memory of 1836 1928 rrfrllf.exe nbttbt.exe PID 1836 wrote to memory of 2012 1836 nbttbt.exe 9rffxfx.exe PID 1836 wrote to memory of 2012 1836 nbttbt.exe 9rffxfx.exe PID 1836 wrote to memory of 2012 1836 nbttbt.exe 9rffxfx.exe PID 1836 wrote to memory of 2012 1836 nbttbt.exe 9rffxfx.exe PID 2012 wrote to memory of 2596 2012 9rffxfx.exe 7bnntb.exe PID 2012 wrote to memory of 2596 2012 9rffxfx.exe 7bnntb.exe PID 2012 wrote to memory of 2596 2012 9rffxfx.exe 7bnntb.exe PID 2012 wrote to memory of 2596 2012 9rffxfx.exe 7bnntb.exe PID 2596 wrote to memory of 2928 2596 7bnntb.exe 1dvvj.exe PID 2596 wrote to memory of 2928 2596 7bnntb.exe 1dvvj.exe PID 2596 wrote to memory of 2928 2596 7bnntb.exe 1dvvj.exe PID 2596 wrote to memory of 2928 2596 7bnntb.exe 1dvvj.exe PID 2928 wrote to memory of 2916 2928 1dvvj.exe xlrxfxf.exe PID 2928 wrote to memory of 2916 2928 1dvvj.exe xlrxfxf.exe PID 2928 wrote to memory of 2916 2928 1dvvj.exe xlrxfxf.exe PID 2928 wrote to memory of 2916 2928 1dvvj.exe xlrxfxf.exe PID 2916 wrote to memory of 2488 2916 xlrxfxf.exe jdjvd.exe PID 2916 wrote to memory of 2488 2916 xlrxfxf.exe jdjvd.exe PID 2916 wrote to memory of 2488 2916 xlrxfxf.exe jdjvd.exe PID 2916 wrote to memory of 2488 2916 xlrxfxf.exe jdjvd.exe PID 2488 wrote to memory of 1316 2488 jdjvd.exe xllfxxx.exe PID 2488 wrote to memory of 1316 2488 jdjvd.exe xllfxxx.exe PID 2488 wrote to memory of 1316 2488 jdjvd.exe xllfxxx.exe PID 2488 wrote to memory of 1316 2488 jdjvd.exe xllfxxx.exe PID 1316 wrote to memory of 2452 1316 xllfxxx.exe nhtthh.exe PID 1316 wrote to memory of 2452 1316 xllfxxx.exe nhtthh.exe PID 1316 wrote to memory of 2452 1316 xllfxxx.exe nhtthh.exe PID 1316 wrote to memory of 2452 1316 xllfxxx.exe nhtthh.exe PID 2452 wrote to memory of 1056 2452 nhtthh.exe frfxfxf.exe PID 2452 wrote to memory of 1056 2452 nhtthh.exe frfxfxf.exe PID 2452 wrote to memory of 1056 2452 nhtthh.exe frfxfxf.exe PID 2452 wrote to memory of 1056 2452 nhtthh.exe frfxfxf.exe PID 1056 wrote to memory of 3068 1056 frfxfxf.exe nnhnbh.exe PID 1056 wrote to memory of 3068 1056 frfxfxf.exe nnhnbh.exe PID 1056 wrote to memory of 3068 1056 frfxfxf.exe nnhnbh.exe PID 1056 wrote to memory of 3068 1056 frfxfxf.exe nnhnbh.exe PID 3068 wrote to memory of 2892 3068 nnhnbh.exe btbbnn.exe PID 3068 wrote to memory of 2892 3068 nnhnbh.exe btbbnn.exe PID 3068 wrote to memory of 2892 3068 nnhnbh.exe btbbnn.exe PID 3068 wrote to memory of 2892 3068 nnhnbh.exe btbbnn.exe PID 2892 wrote to memory of 296 2892 btbbnn.exe dpdpj.exe PID 2892 wrote to memory of 296 2892 btbbnn.exe dpdpj.exe PID 2892 wrote to memory of 296 2892 btbbnn.exe dpdpj.exe PID 2892 wrote to memory of 296 2892 btbbnn.exe dpdpj.exe PID 296 wrote to memory of 2836 296 dpdpj.exe fxrlrlr.exe PID 296 wrote to memory of 2836 296 dpdpj.exe fxrlrlr.exe PID 296 wrote to memory of 2836 296 dpdpj.exe fxrlrlr.exe PID 296 wrote to memory of 2836 296 dpdpj.exe fxrlrlr.exe PID 2836 wrote to memory of 2692 2836 fxrlrlr.exe pvvdv.exe PID 2836 wrote to memory of 2692 2836 fxrlrlr.exe pvvdv.exe PID 2836 wrote to memory of 2692 2836 fxrlrlr.exe pvvdv.exe PID 2836 wrote to memory of 2692 2836 fxrlrlr.exe pvvdv.exe PID 2692 wrote to memory of 2860 2692 pvvdv.exe vvpdj.exe PID 2692 wrote to memory of 2860 2692 pvvdv.exe vvpdj.exe PID 2692 wrote to memory of 2860 2692 pvvdv.exe vvpdj.exe PID 2692 wrote to memory of 2860 2692 pvvdv.exe vvpdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\rrfrllf.exec:\rrfrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\nbttbt.exec:\nbttbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\9rffxfx.exec:\9rffxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\7bnntb.exec:\7bnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1dvvj.exec:\1dvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xlrxfxf.exec:\xlrxfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jdjvd.exec:\jdjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xllfxxx.exec:\xllfxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\nhtthh.exec:\nhtthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\frfxfxf.exec:\frfxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\nnhnbh.exec:\nnhnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\btbbnn.exec:\btbbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dpdpj.exec:\dpdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\fxrlrlr.exec:\fxrlrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\pvvdv.exec:\pvvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vvpdj.exec:\vvpdj.exe17⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1lxfllr.exec:\1lxfllr.exe18⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdpdp.exec:\jdpdp.exe19⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lffrxlx.exec:\lffrxlx.exe20⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nbhhhb.exec:\nbhhhb.exe21⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5vppj.exec:\5vppj.exe22⤵
- Executes dropped EXE
PID:1172 -
\??\c:\3vvvj.exec:\3vvvj.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\9bbttt.exec:\9bbttt.exe24⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jdjpv.exec:\jdjpv.exe25⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe26⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ththhb.exec:\ththhb.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7dvjv.exec:\7dvjv.exe28⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1lrrrff.exec:\1lrrrff.exe29⤵
- Executes dropped EXE
PID:796 -
\??\c:\3thhnn.exec:\3thhnn.exe30⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxllxxl.exec:\fxllxxl.exe31⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hbtbnb.exec:\hbtbnb.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dpvdj.exec:\dpvdj.exe33⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xfrrrrx.exec:\xfrrrrx.exe34⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nnbnnt.exec:\nnbnnt.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nthntt.exec:\nthntt.exe36⤵PID:2964
-
\??\c:\lrflxfl.exec:\lrflxfl.exe37⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1xrxlll.exec:\1xrxlll.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ttntht.exec:\ttntht.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vpddj.exec:\vpddj.exe40⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3dpvv.exec:\3dpvv.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9llfxfr.exec:\9llfxfr.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1bntbh.exec:\1bntbh.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nhbbtt.exec:\nhbbtt.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vpddj.exec:\vpddj.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jpjdj.exec:\jpjdj.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fxrrxfx.exec:\fxrrxfx.exe47⤵
- Executes dropped EXE
PID:812 -
\??\c:\httthh.exec:\httthh.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbthnn.exec:\hbthnn.exe49⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vpdpd.exec:\vpdpd.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3xlffxr.exec:\3xlffxr.exe51⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe52⤵
- Executes dropped EXE
PID:2792 -
\??\c:\btnnnh.exec:\btnnnh.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hbtthn.exec:\hbtthn.exe54⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjdjp.exec:\pjdjp.exe55⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lfxflrf.exec:\lfxflrf.exe56⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe57⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hhbnbn.exec:\hhbnbn.exe58⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9jvpj.exec:\9jvpj.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5rrflrf.exec:\5rrflrf.exe60⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xrffrrf.exec:\xrffrrf.exe61⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ttthnn.exec:\ttthnn.exe62⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jjdjd.exec:\jjdjd.exe63⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rllxxfr.exec:\rllxxfr.exe64⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lrlrffr.exec:\lrlrffr.exe65⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hnhhtb.exec:\hnhhtb.exe66⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5jvvd.exec:\5jvvd.exe67⤵PID:1752
-
\??\c:\ppjvj.exec:\ppjvj.exe68⤵PID:2492
-
\??\c:\fxrllfl.exec:\fxrllfl.exe69⤵PID:1788
-
\??\c:\hnhtht.exec:\hnhtht.exe70⤵PID:1548
-
\??\c:\3vjpj.exec:\3vjpj.exe71⤵PID:644
-
\??\c:\xlfflrr.exec:\xlfflrr.exe72⤵PID:1652
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe73⤵PID:1856
-
\??\c:\bbbhnn.exec:\bbbhnn.exe74⤵PID:968
-
\??\c:\bthbbb.exec:\bthbbb.exe75⤵PID:2532
-
\??\c:\1dppj.exec:\1dppj.exe76⤵PID:2072
-
\??\c:\rrfffll.exec:\rrfffll.exe77⤵PID:1256
-
\??\c:\9fxxllr.exec:\9fxxllr.exe78⤵PID:2080
-
\??\c:\7tttbb.exec:\7tttbb.exe79⤵PID:2188
-
\??\c:\tththn.exec:\tththn.exe80⤵PID:1612
-
\??\c:\jvjdd.exec:\jvjdd.exe81⤵PID:312
-
\??\c:\1lflflr.exec:\1lflflr.exe82⤵PID:1048
-
\??\c:\nhhtnt.exec:\nhhtnt.exe83⤵PID:2904
-
\??\c:\hbtbnt.exec:\hbtbnt.exe84⤵PID:2032
-
\??\c:\vddpv.exec:\vddpv.exe85⤵PID:2384
-
\??\c:\xxxxflx.exec:\xxxxflx.exe86⤵PID:2596
-
\??\c:\rfllrlr.exec:\rfllrlr.exe87⤵PID:2264
-
\??\c:\tnhntb.exec:\tnhntb.exe88⤵PID:2580
-
\??\c:\3dvvd.exec:\3dvvd.exe89⤵PID:2764
-
\??\c:\xrfrlxl.exec:\xrfrlxl.exe90⤵PID:2488
-
\??\c:\xlxxxrr.exec:\xlxxxrr.exe91⤵PID:2476
-
\??\c:\hbttbb.exec:\hbttbb.exe92⤵PID:2508
-
\??\c:\pjjdj.exec:\pjjdj.exe93⤵PID:2452
-
\??\c:\3dvdj.exec:\3dvdj.exe94⤵PID:2696
-
\??\c:\9lrrxxf.exec:\9lrrxxf.exe95⤵PID:3064
-
\??\c:\nnbbnt.exec:\nnbbnt.exe96⤵PID:3052
-
\??\c:\thbbhb.exec:\thbbhb.exe97⤵PID:2852
-
\??\c:\vvpjp.exec:\vvpjp.exe98⤵PID:2844
-
\??\c:\jdppv.exec:\jdppv.exe99⤵PID:2992
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe100⤵PID:2776
-
\??\c:\nhthnn.exec:\nhthnn.exe101⤵PID:1444
-
\??\c:\nhbhbb.exec:\nhbhbb.exe102⤵PID:2732
-
\??\c:\djpjj.exec:\djpjj.exe103⤵PID:1648
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe104⤵PID:2248
-
\??\c:\fxflllr.exec:\fxflllr.exe105⤵PID:1684
-
\??\c:\tbnhtt.exec:\tbnhtt.exe106⤵PID:868
-
\??\c:\ddjdd.exec:\ddjdd.exe107⤵PID:1792
-
\??\c:\pddvp.exec:\pddvp.exe108⤵PID:1800
-
\??\c:\3fllfxx.exec:\3fllfxx.exe109⤵PID:1496
-
\??\c:\tnhhnt.exec:\tnhhnt.exe110⤵PID:1388
-
\??\c:\1hbbtn.exec:\1hbbtn.exe111⤵PID:1592
-
\??\c:\pjddj.exec:\pjddj.exe112⤵PID:1708
-
\??\c:\rflxfxx.exec:\rflxfxx.exe113⤵PID:2636
-
\??\c:\xrflrrx.exec:\xrflrrx.exe114⤵PID:1776
-
\??\c:\bntntn.exec:\bntntn.exe115⤵PID:1352
-
\??\c:\tnbbhh.exec:\tnbbhh.exe116⤵PID:1920
-
\??\c:\dpddj.exec:\dpddj.exe117⤵PID:1660
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe118⤵PID:2308
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe119⤵PID:2536
-
\??\c:\tnhhnt.exec:\tnhhnt.exe120⤵PID:1632
-
\??\c:\9jvpp.exec:\9jvpp.exe121⤵PID:2940
-
\??\c:\jdvjd.exec:\jdvjd.exe122⤵PID:2060
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe123⤵PID:1136
-
\??\c:\hnhtnt.exec:\hnhtnt.exe124⤵PID:1580
-
\??\c:\5tbbnn.exec:\5tbbnn.exe125⤵PID:1604
-
\??\c:\9pjdd.exec:\9pjdd.exe126⤵PID:1928
-
\??\c:\fxllrlr.exec:\fxllrlr.exe127⤵PID:280
-
\??\c:\fxfffxx.exec:\fxfffxx.exe128⤵PID:2372
-
\??\c:\hnnhbt.exec:\hnnhbt.exe129⤵PID:2268
-
\??\c:\7hhhtt.exec:\7hhhtt.exe130⤵PID:2656
-
\??\c:\vdjdd.exec:\vdjdd.exe131⤵PID:2236
-
\??\c:\fxxfflx.exec:\fxxfflx.exe132⤵PID:2596
-
\??\c:\9lfxlll.exec:\9lfxlll.exe133⤵PID:2460
-
\??\c:\hnhbhh.exec:\hnhbhh.exe134⤵PID:2560
-
\??\c:\pdpjv.exec:\pdpjv.exe135⤵PID:2764
-
\??\c:\9vjjj.exec:\9vjjj.exe136⤵PID:2448
-
\??\c:\xlrlllr.exec:\xlrlllr.exe137⤵PID:812
-
\??\c:\nhbhbb.exec:\nhbhbb.exe138⤵PID:2504
-
\??\c:\jvjvp.exec:\jvjvp.exe139⤵PID:2528
-
\??\c:\jdddp.exec:\jdddp.exe140⤵PID:2716
-
\??\c:\rfxrllr.exec:\rfxrllr.exe141⤵PID:556
-
\??\c:\tnbhnn.exec:\tnbhnn.exe142⤵PID:1448
-
\??\c:\vpdpd.exec:\vpdpd.exe143⤵PID:2852
-
\??\c:\frlfllr.exec:\frlfllr.exe144⤵PID:2840
-
\??\c:\lflflrr.exec:\lflflrr.exe145⤵PID:2824
-
\??\c:\nnhtbh.exec:\nnhtbh.exe146⤵PID:2776
-
\??\c:\vpdvj.exec:\vpdvj.exe147⤵PID:300
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe148⤵PID:1556
-
\??\c:\5bbbnb.exec:\5bbbnb.exe149⤵PID:2180
-
\??\c:\tnthnt.exec:\tnthnt.exe150⤵PID:1716
-
\??\c:\jvjjj.exec:\jvjjj.exe151⤵PID:1564
-
\??\c:\3lffffl.exec:\3lffffl.exe152⤵PID:2040
-
\??\c:\9fllrxx.exec:\9fllrxx.exe153⤵PID:1804
-
\??\c:\5btttt.exec:\5btttt.exe154⤵PID:860
-
\??\c:\9vpvv.exec:\9vpvv.exe155⤵PID:2244
-
\??\c:\jjdpd.exec:\jjdpd.exe156⤵PID:2420
-
\??\c:\9lfrxff.exec:\9lfrxff.exe157⤵PID:1064
-
\??\c:\nhbhtb.exec:\nhbhtb.exe158⤵PID:2152
-
\??\c:\9vjdj.exec:\9vjdj.exe159⤵PID:964
-
\??\c:\vpddj.exec:\vpddj.exe160⤵PID:1776
-
\??\c:\5xlxxfl.exec:\5xlxxfl.exe161⤵PID:2044
-
\??\c:\llflxxr.exec:\llflxxr.exe162⤵PID:1068
-
\??\c:\bnhhnn.exec:\bnhhnn.exe163⤵PID:1856
-
\??\c:\vpjjp.exec:\vpjjp.exe164⤵PID:2308
-
\??\c:\dvpvp.exec:\dvpvp.exe165⤵PID:2304
-
\??\c:\xxflrff.exec:\xxflrff.exe166⤵PID:2120
-
\??\c:\9lxxxfl.exec:\9lxxxfl.exe167⤵PID:1516
-
\??\c:\9ttbnb.exec:\9ttbnb.exe168⤵PID:1520
-
\??\c:\dpddd.exec:\dpddd.exe169⤵PID:1780
-
\??\c:\vvjpv.exec:\vvjpv.exe170⤵PID:320
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe171⤵PID:2008
-
\??\c:\hnhbtt.exec:\hnhbtt.exe172⤵PID:1836
-
\??\c:\jdpvd.exec:\jdpvd.exe173⤵PID:2136
-
\??\c:\ppppd.exec:\ppppd.exe174⤵PID:2544
-
\??\c:\xrlrflf.exec:\xrlrflf.exe175⤵PID:1960
-
\??\c:\btthtt.exec:\btthtt.exe176⤵PID:2236
-
\??\c:\bthntt.exec:\bthntt.exe177⤵PID:2264
-
\??\c:\jdvvj.exec:\jdvvj.exe178⤵PID:2460
-
\??\c:\fxfxffl.exec:\fxfxffl.exe179⤵PID:2488
-
\??\c:\hhhbht.exec:\hhhbht.exe180⤵PID:2156
-
\??\c:\5nttnt.exec:\5nttnt.exe181⤵PID:2448
-
\??\c:\vpddj.exec:\vpddj.exe182⤵PID:812
-
\??\c:\jdpvp.exec:\jdpvp.exe183⤵PID:2100
-
\??\c:\lfflrrx.exec:\lfflrrx.exe184⤵PID:2820
-
\??\c:\hhhnbn.exec:\hhhnbn.exe185⤵PID:2804
-
\??\c:\dvjjp.exec:\dvjjp.exe186⤵PID:2896
-
\??\c:\vdvdj.exec:\vdvdj.exe187⤵PID:2816
-
\??\c:\1fflxfr.exec:\1fflxfr.exe188⤵PID:2428
-
\??\c:\fxllrrx.exec:\fxllrrx.exe189⤵PID:1204
-
\??\c:\hbhttt.exec:\hbhttt.exe190⤵PID:2996
-
\??\c:\dpddd.exec:\dpddd.exe191⤵PID:2864
-
\??\c:\5rlrflx.exec:\5rlrflx.exe192⤵PID:2776
-
\??\c:\lfffrxl.exec:\lfffrxl.exe193⤵PID:300
-
\??\c:\hhtbbb.exec:\hhtbbb.exe194⤵PID:1644
-
\??\c:\bthnnh.exec:\bthnnh.exe195⤵PID:2036
-
\??\c:\pjdvd.exec:\pjdvd.exe196⤵PID:1728
-
\??\c:\llfxflr.exec:\llfxflr.exe197⤵PID:2076
-
\??\c:\7xrllfr.exec:\7xrllfr.exe198⤵PID:324
-
\??\c:\bnbbhb.exec:\bnbbhb.exe199⤵PID:592
-
\??\c:\pdppp.exec:\pdppp.exe200⤵PID:2884
-
\??\c:\jvppv.exec:\jvppv.exe201⤵PID:828
-
\??\c:\rlxxlfr.exec:\rlxxlfr.exe202⤵PID:2420
-
\??\c:\7bnnnh.exec:\7bnnnh.exe203⤵PID:2316
-
\??\c:\dpddd.exec:\dpddd.exe204⤵PID:1880
-
\??\c:\7ppdp.exec:\7ppdp.exe205⤵PID:964
-
\??\c:\ffrfllx.exec:\ffrfllx.exe206⤵PID:1548
-
\??\c:\7nttbb.exec:\7nttbb.exe207⤵PID:944
-
\??\c:\htnnbb.exec:\htnnbb.exe208⤵PID:1068
-
\??\c:\9vjjp.exec:\9vjjp.exe209⤵PID:2320
-
\??\c:\frfffxf.exec:\frfffxf.exe210⤵PID:2308
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe211⤵PID:2204
-
\??\c:\thtbhh.exec:\thtbhh.exe212⤵PID:2920
-
\??\c:\ddpjd.exec:\ddpjd.exe213⤵PID:1724
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe214⤵PID:1580
-
\??\c:\frlffff.exec:\frlffff.exe215⤵PID:1780
-
\??\c:\7tttnn.exec:\7tttnn.exe216⤵PID:1928
-
\??\c:\jdppv.exec:\jdppv.exe217⤵PID:2016
-
\??\c:\1dvvd.exec:\1dvvd.exe218⤵PID:1836
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe219⤵PID:2660
-
\??\c:\bthbnh.exec:\bthbnh.exe220⤵PID:2656
-
\??\c:\bnhbhh.exec:\bnhbhh.exe221⤵PID:2012
-
\??\c:\dpddj.exec:\dpddj.exe222⤵PID:2112
-
\??\c:\xlffllx.exec:\xlffllx.exe223⤵PID:2556
-
\??\c:\5frxflr.exec:\5frxflr.exe224⤵PID:2584
-
\??\c:\3nthtt.exec:\3nthtt.exe225⤵PID:2688
-
\??\c:\1dpjj.exec:\1dpjj.exe226⤵PID:2128
-
\??\c:\1djpj.exec:\1djpj.exe227⤵PID:2096
-
\??\c:\9xfllll.exec:\9xfllll.exe228⤵PID:1348
-
\??\c:\fxxrxrr.exec:\fxxrxrr.exe229⤵PID:2620
-
\??\c:\tthhnt.exec:\tthhnt.exe230⤵PID:3068
-
\??\c:\5jpvp.exec:\5jpvp.exe231⤵PID:3012
-
\??\c:\ppjjp.exec:\ppjjp.exe232⤵PID:2792
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe233⤵PID:2832
-
\??\c:\frxxrrx.exec:\frxxrrx.exe234⤵PID:2984
-
\??\c:\thnhnh.exec:\thnhnh.exe235⤵PID:2708
-
\??\c:\1vvvp.exec:\1vvvp.exe236⤵PID:1976
-
\??\c:\7vddd.exec:\7vddd.exe237⤵PID:2692
-
\??\c:\xrfrrrx.exec:\xrfrrrx.exe238⤵PID:896
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe239⤵PID:1600
-
\??\c:\bbbbhb.exec:\bbbbhb.exe240⤵PID:1768
-
\??\c:\bnbbhh.exec:\bnbbhh.exe241⤵PID:1740
-
\??\c:\pjvpd.exec:\pjvpd.exe242⤵PID:2004