Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe
-
Size
203KB
-
MD5
681146f9edea18bd7b89a324404989f7
-
SHA1
67e9993dd3a404fc8675317ba4a5e33152974918
-
SHA256
dab8440bba0fed6c322bfcec169d177da7e81fa081f7df775bc7a84b51137339
-
SHA512
ee1d75684f6332d49a9720bb065f42e7b1dc8561c90bad6df22f7457ebee56ceae0da12d1394f18086039e5e955b496e88fbe8b3dab2e8ced4187394be3d2761
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyEzOICBZHFS15NV70wiww:PhOm2sI93UufdC67cihEzoY3NS
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2292-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-308-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2536-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-379-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2480-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-541-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1440-560-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-567-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-584-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1512-591-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-693-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-870-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-964-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2348-983-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/384-1042-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2724-1147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5vddj.exe7rrxrxl.exe9htbhn.exepdppv.exe7lrxxff.exethnhhh.exe3jpdp.exepjvvd.exelxfxxrr.exenhnthh.exepvdvj.exe5lflllr.exehbnhnb.exedjppp.exepjvdd.exefrxlllr.exevpdpv.exejdppj.exeflllrfx.exe9lfrxxx.exe1jvdd.exelxflrlr.exexrfllll.exebnnhhh.exepjppv.exepjppp.exexlrrfxf.exebnhntn.exevpddd.exe3pddv.exe1lrflrr.exebtbthb.exevpddj.exeddjjv.exe1xllrrx.exexlrlrll.exebnttnt.exethhbtn.exejdjpp.exedppdd.exe1rxxffr.exerfrlrrx.exethnnhb.exe3bnnnn.exedvjjj.exefrffxfl.exerxlrxlf.exenthnnt.exe9nthhh.exe3vvvd.exejvvvj.exelrflfff.exe5tttbh.exebtbhtb.exepdddd.exelxfrlrr.exexrrxxxf.exenbhnbt.exennhnbh.exevdjpv.exepdppv.exefxflllr.exenhtbhb.exe5nbbhh.exepid process 2472 5vddj.exe 2976 7rrxrxl.exe 2600 9htbhn.exe 2500 pdppv.exe 2768 7lrxxff.exe 2680 thnhhh.exe 2180 3jpdp.exe 2168 pjvvd.exe 2120 lxfxxrr.exe 2644 nhnthh.exe 2844 pvdvj.exe 1588 5lflllr.exe 1668 hbnhnb.exe 1728 djppp.exe 1872 pjvdd.exe 2904 frxlllr.exe 284 vpdpv.exe 1464 jdppj.exe 2232 flllrfx.exe 2272 9lfrxxx.exe 2188 1jvdd.exe 544 lxflrlr.exe 580 xrfllll.exe 568 bnnhhh.exe 648 pjppv.exe 1548 pjppp.exe 1680 xlrrfxf.exe 1240 bnhntn.exe 2308 vpddd.exe 2356 3pddv.exe 2328 1lrflrr.exe 2068 btbthb.exe 2660 vpddj.exe 1512 ddjjv.exe 2536 1xllrrx.exe 2592 xlrlrll.exe 2588 bnttnt.exe 2704 thhbtn.exe 2400 jdjpp.exe 2616 dppdd.exe 2560 1rxxffr.exe 2396 rfrlrrx.exe 2468 thnnhb.exe 2412 3bnnnn.exe 2464 dvjjj.exe 2120 frffxfl.exe 2480 rxlrxlf.exe 2884 nthnnt.exe 2896 9nthhh.exe 1000 3vvvd.exe 280 jvvvj.exe 240 lrflfff.exe 2280 5tttbh.exe 2444 btbhtb.exe 1556 pdddd.exe 1156 lxfrlrr.exe 1460 xrrxxxf.exe 2248 nbhnbt.exe 1968 nnhnbh.exe 2752 vdjpv.exe 2024 pdppv.exe 804 fxflllr.exe 1424 nhtbhb.exe 580 5nbbhh.exe -
Processes:
resource yara_rule behavioral1/memory/2472-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-379-0x0000000000430000-0x0000000000459000-memory.dmp upx behavioral1/memory/2480-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-440-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-491-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-560-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-567-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-584-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1512-591-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-622-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-635-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-660-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-667-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-680-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-693-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-700-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-725-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-792-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-805-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-812-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-843-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-863-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-870-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-877-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-928-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-947-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-975-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-978-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2348-983-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe5vddj.exe7rrxrxl.exe9htbhn.exepdppv.exe7lrxxff.exethnhhh.exe3jpdp.exepjvvd.exelxfxxrr.exenhnthh.exepvdvj.exe5lflllr.exehbnhnb.exedjppp.exepjvdd.exedescription pid process target process PID 2292 wrote to memory of 2472 2292 681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe 5vddj.exe PID 2292 wrote to memory of 2472 2292 681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe 5vddj.exe PID 2292 wrote to memory of 2472 2292 681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe 5vddj.exe PID 2292 wrote to memory of 2472 2292 681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe 5vddj.exe PID 2472 wrote to memory of 2976 2472 5vddj.exe 7rrxrxl.exe PID 2472 wrote to memory of 2976 2472 5vddj.exe 7rrxrxl.exe PID 2472 wrote to memory of 2976 2472 5vddj.exe 7rrxrxl.exe PID 2472 wrote to memory of 2976 2472 5vddj.exe 7rrxrxl.exe PID 2976 wrote to memory of 2600 2976 7rrxrxl.exe 9htbhn.exe PID 2976 wrote to memory of 2600 2976 7rrxrxl.exe 9htbhn.exe PID 2976 wrote to memory of 2600 2976 7rrxrxl.exe 9htbhn.exe PID 2976 wrote to memory of 2600 2976 7rrxrxl.exe 9htbhn.exe PID 2600 wrote to memory of 2500 2600 9htbhn.exe pdppv.exe PID 2600 wrote to memory of 2500 2600 9htbhn.exe pdppv.exe PID 2600 wrote to memory of 2500 2600 9htbhn.exe pdppv.exe PID 2600 wrote to memory of 2500 2600 9htbhn.exe pdppv.exe PID 2500 wrote to memory of 2768 2500 pdppv.exe 7lrxxff.exe PID 2500 wrote to memory of 2768 2500 pdppv.exe 7lrxxff.exe PID 2500 wrote to memory of 2768 2500 pdppv.exe 7lrxxff.exe PID 2500 wrote to memory of 2768 2500 pdppv.exe 7lrxxff.exe PID 2768 wrote to memory of 2680 2768 7lrxxff.exe thnhhh.exe PID 2768 wrote to memory of 2680 2768 7lrxxff.exe thnhhh.exe PID 2768 wrote to memory of 2680 2768 7lrxxff.exe thnhhh.exe PID 2768 wrote to memory of 2680 2768 7lrxxff.exe thnhhh.exe PID 2680 wrote to memory of 2180 2680 thnhhh.exe 3jpdp.exe PID 2680 wrote to memory of 2180 2680 thnhhh.exe 3jpdp.exe PID 2680 wrote to memory of 2180 2680 thnhhh.exe 3jpdp.exe PID 2680 wrote to memory of 2180 2680 thnhhh.exe 3jpdp.exe PID 2180 wrote to memory of 2168 2180 3jpdp.exe pjvvd.exe PID 2180 wrote to memory of 2168 2180 3jpdp.exe pjvvd.exe PID 2180 wrote to memory of 2168 2180 3jpdp.exe pjvvd.exe PID 2180 wrote to memory of 2168 2180 3jpdp.exe pjvvd.exe PID 2168 wrote to memory of 2120 2168 pjvvd.exe lxfxxrr.exe PID 2168 wrote to memory of 2120 2168 pjvvd.exe lxfxxrr.exe PID 2168 wrote to memory of 2120 2168 pjvvd.exe lxfxxrr.exe PID 2168 wrote to memory of 2120 2168 pjvvd.exe lxfxxrr.exe PID 2120 wrote to memory of 2644 2120 lxfxxrr.exe nhnthh.exe PID 2120 wrote to memory of 2644 2120 lxfxxrr.exe nhnthh.exe PID 2120 wrote to memory of 2644 2120 lxfxxrr.exe nhnthh.exe PID 2120 wrote to memory of 2644 2120 lxfxxrr.exe nhnthh.exe PID 2644 wrote to memory of 2844 2644 nhnthh.exe pvdvj.exe PID 2644 wrote to memory of 2844 2644 nhnthh.exe pvdvj.exe PID 2644 wrote to memory of 2844 2644 nhnthh.exe pvdvj.exe PID 2644 wrote to memory of 2844 2644 nhnthh.exe pvdvj.exe PID 2844 wrote to memory of 1588 2844 pvdvj.exe 5lflllr.exe PID 2844 wrote to memory of 1588 2844 pvdvj.exe 5lflllr.exe PID 2844 wrote to memory of 1588 2844 pvdvj.exe 5lflllr.exe PID 2844 wrote to memory of 1588 2844 pvdvj.exe 5lflllr.exe PID 1588 wrote to memory of 1668 1588 5lflllr.exe hbnhnb.exe PID 1588 wrote to memory of 1668 1588 5lflllr.exe hbnhnb.exe PID 1588 wrote to memory of 1668 1588 5lflllr.exe hbnhnb.exe PID 1588 wrote to memory of 1668 1588 5lflllr.exe hbnhnb.exe PID 1668 wrote to memory of 1728 1668 hbnhnb.exe djppp.exe PID 1668 wrote to memory of 1728 1668 hbnhnb.exe djppp.exe PID 1668 wrote to memory of 1728 1668 hbnhnb.exe djppp.exe PID 1668 wrote to memory of 1728 1668 hbnhnb.exe djppp.exe PID 1728 wrote to memory of 1872 1728 djppp.exe pjvdd.exe PID 1728 wrote to memory of 1872 1728 djppp.exe pjvdd.exe PID 1728 wrote to memory of 1872 1728 djppp.exe pjvdd.exe PID 1728 wrote to memory of 1872 1728 djppp.exe pjvdd.exe PID 1872 wrote to memory of 2904 1872 pjvdd.exe frxlllr.exe PID 1872 wrote to memory of 2904 1872 pjvdd.exe frxlllr.exe PID 1872 wrote to memory of 2904 1872 pjvdd.exe frxlllr.exe PID 1872 wrote to memory of 2904 1872 pjvdd.exe frxlllr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\5vddj.exec:\5vddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\7rrxrxl.exec:\7rrxrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\9htbhn.exec:\9htbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pdppv.exec:\pdppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\7lrxxff.exec:\7lrxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\thnhhh.exec:\thnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3jpdp.exec:\3jpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\pjvvd.exec:\pjvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\nhnthh.exec:\nhnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pvdvj.exec:\pvdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5lflllr.exec:\5lflllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\hbnhnb.exec:\hbnhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\djppp.exec:\djppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\pjvdd.exec:\pjvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\frxlllr.exec:\frxlllr.exe17⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vpdpv.exec:\vpdpv.exe18⤵
- Executes dropped EXE
PID:284 -
\??\c:\jdppj.exec:\jdppj.exe19⤵
- Executes dropped EXE
PID:1464 -
\??\c:\flllrfx.exec:\flllrfx.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9lfrxxx.exec:\9lfrxxx.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1jvdd.exec:\1jvdd.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lxflrlr.exec:\lxflrlr.exe23⤵
- Executes dropped EXE
PID:544 -
\??\c:\xrfllll.exec:\xrfllll.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\bnnhhh.exec:\bnnhhh.exe25⤵
- Executes dropped EXE
PID:568 -
\??\c:\pjppv.exec:\pjppv.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\pjppp.exec:\pjppp.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xlrrfxf.exec:\xlrrfxf.exe28⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bnhntn.exec:\bnhntn.exe29⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vpddd.exec:\vpddd.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3pddv.exec:\3pddv.exe31⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1lrflrr.exec:\1lrflrr.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\btbthb.exec:\btbthb.exe33⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vpddj.exec:\vpddj.exe34⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ddjjv.exec:\ddjjv.exe35⤵
- Executes dropped EXE
PID:1512 -
\??\c:\1xllrrx.exec:\1xllrrx.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xlrlrll.exec:\xlrlrll.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bnttnt.exec:\bnttnt.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\thhbtn.exec:\thhbtn.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdjpp.exec:\jdjpp.exe40⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dppdd.exec:\dppdd.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1rxxffr.exec:\1rxxffr.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rfrlrrx.exec:\rfrlrrx.exe43⤵
- Executes dropped EXE
PID:2396 -
\??\c:\thnnhb.exec:\thnnhb.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3bnnnn.exec:\3bnnnn.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dvjjj.exec:\dvjjj.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\frffxfl.exec:\frffxfl.exe47⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rxlrxlf.exec:\rxlrxlf.exe48⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nthnnt.exec:\nthnnt.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9nthhh.exec:\9nthhh.exe50⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3vvvd.exec:\3vvvd.exe51⤵
- Executes dropped EXE
PID:1000 -
\??\c:\jvvvj.exec:\jvvvj.exe52⤵
- Executes dropped EXE
PID:280 -
\??\c:\lrflfff.exec:\lrflfff.exe53⤵
- Executes dropped EXE
PID:240 -
\??\c:\5tttbh.exec:\5tttbh.exe54⤵
- Executes dropped EXE
PID:2280 -
\??\c:\btbhtb.exec:\btbhtb.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pdddd.exec:\pdddd.exe56⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lxfrlrr.exec:\lxfrlrr.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe58⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nbhnbt.exec:\nbhnbt.exe59⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nnhnbh.exec:\nnhnbh.exe60⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vdjpv.exec:\vdjpv.exe61⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pdppv.exec:\pdppv.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxflllr.exec:\fxflllr.exe63⤵
- Executes dropped EXE
PID:804 -
\??\c:\nhtbhb.exec:\nhtbhb.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5nbbhh.exec:\5nbbhh.exe65⤵
- Executes dropped EXE
PID:580 -
\??\c:\jvdvd.exec:\jvdvd.exe66⤵PID:1880
-
\??\c:\lfxflxl.exec:\lfxflxl.exe67⤵PID:3052
-
\??\c:\rrxlxfx.exec:\rrxlxfx.exe68⤵PID:3020
-
\??\c:\hbtthh.exec:\hbtthh.exe69⤵PID:2368
-
\??\c:\tntntn.exec:\tntntn.exe70⤵PID:1780
-
\??\c:\vpjpp.exec:\vpjpp.exe71⤵PID:328
-
\??\c:\3jjdv.exec:\3jjdv.exe72⤵PID:1020
-
\??\c:\7rlfllf.exec:\7rlfllf.exe73⤵PID:1960
-
\??\c:\xrllxfr.exec:\xrllxfr.exe74⤵PID:2124
-
\??\c:\5tnbnt.exec:\5tnbnt.exe75⤵PID:1440
-
\??\c:\vpdjv.exec:\vpdjv.exe76⤵PID:2312
-
\??\c:\rfxxfxl.exec:\rfxxfxl.exe77⤵PID:2052
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe78⤵PID:2660
-
\??\c:\3bntnt.exec:\3bntnt.exe79⤵PID:1512
-
\??\c:\nbhhtt.exec:\nbhhtt.exe80⤵PID:2976
-
\??\c:\vpvdp.exec:\vpvdp.exe81⤵PID:2684
-
\??\c:\vjddv.exec:\vjddv.exe82⤵PID:2496
-
\??\c:\flrflrr.exec:\flrflrr.exe83⤵PID:2704
-
\??\c:\hbnhhh.exec:\hbnhhh.exe84⤵PID:2720
-
\??\c:\btnhbh.exec:\btnhbh.exe85⤵PID:2564
-
\??\c:\7vjdd.exec:\7vjdd.exe86⤵PID:2556
-
\??\c:\frffffl.exec:\frffffl.exe87⤵PID:2392
-
\??\c:\frfxlrf.exec:\frfxlrf.exe88⤵PID:2468
-
\??\c:\1nbnbb.exec:\1nbnbb.exe89⤵PID:1584
-
\??\c:\thhhtt.exec:\thhhtt.exe90⤵PID:2168
-
\??\c:\vjvvd.exec:\vjvvd.exe91⤵PID:2740
-
\??\c:\9jddd.exec:\9jddd.exe92⤵PID:2860
-
\??\c:\1xrfrxf.exec:\1xrfrxf.exe93⤵PID:2748
-
\??\c:\xrfllxf.exec:\xrfllxf.exe94⤵PID:820
-
\??\c:\nbnntt.exec:\nbnntt.exe95⤵PID:1668
-
\??\c:\htntnn.exec:\htntnn.exe96⤵PID:1816
-
\??\c:\9pjjj.exec:\9pjjj.exe97⤵PID:1616
-
\??\c:\pdppp.exec:\pdppp.exe98⤵PID:2492
-
\??\c:\xlffxxl.exec:\xlffxxl.exe99⤵PID:2904
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe100⤵PID:1492
-
\??\c:\tnhhtn.exec:\tnhhtn.exe101⤵PID:1724
-
\??\c:\9jjjd.exec:\9jjjd.exe102⤵PID:2132
-
\??\c:\pddvp.exec:\pddvp.exe103⤵PID:2232
-
\??\c:\5rxflrr.exec:\5rxflrr.exe104⤵PID:1248
-
\??\c:\frfxffr.exec:\frfxffr.exe105⤵PID:2228
-
\??\c:\hthhhb.exec:\hthhhb.exe106⤵PID:2012
-
\??\c:\1nnnnh.exec:\1nnnnh.exe107⤵PID:1432
-
\??\c:\vjpvv.exec:\vjpvv.exe108⤵PID:2376
-
\??\c:\pdjdv.exec:\pdjdv.exe109⤵PID:2912
-
\??\c:\xlflllr.exec:\xlflllr.exe110⤵PID:1212
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe111⤵PID:448
-
\??\c:\btnhnn.exec:\btnhnn.exe112⤵PID:1744
-
\??\c:\tnnthn.exec:\tnnthn.exe113⤵PID:1436
-
\??\c:\1pdvv.exec:\1pdvv.exe114⤵PID:1468
-
\??\c:\pdjjp.exec:\pdjjp.exe115⤵PID:1052
-
\??\c:\lrfrxxl.exec:\lrfrxxl.exe116⤵PID:2324
-
\??\c:\bnbbhh.exec:\bnbbhh.exe117⤵PID:1808
-
\??\c:\nhnttb.exec:\nhnttb.exe118⤵PID:2356
-
\??\c:\jvdvj.exec:\jvdvj.exe119⤵PID:1388
-
\??\c:\7pppd.exec:\7pppd.exe120⤵PID:2148
-
\??\c:\frfxffl.exec:\frfxffl.exe121⤵PID:2284
-
\??\c:\3llxlrl.exec:\3llxlrl.exe122⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-