Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe
-
Size
94KB
-
MD5
0036abd78b5af4b6a0a098a2d7a15a0b
-
SHA1
46d3f939be654b6f8b25b895488211be4af6d163
-
SHA256
7439c7685be9b079e1045f93c6c5b82141edb439369b5bb24a1cf8158afab965
-
SHA512
f9aa606eb5d590ec465d86590e5a17ff4cd97f0509fa1943ae13720ca017edba67fdb5ed2b2765e86878903d4c1d73cb2a14254ac44c230de912a6620d4b28c3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzNcI2gxprr4H8You:ymb3NkkiQ3mdBjF+3TYzvTbrr4H/
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/776-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2044 xxrrflf.exe 2960 nbntnh.exe 2716 9rxflrf.exe 2672 btnbnb.exe 2908 jdppp.exe 2536 pdjpv.exe 2784 lxxlxlx.exe 2576 nttbhb.exe 2560 ddvvd.exe 3024 xlxfllr.exe 1916 nbhnhh.exe 1420 fffrrxr.exe 1700 bbhbhb.exe 2344 bhnntt.exe 2492 7xrxxlf.exe 1620 nbtbtt.exe 1528 jpjpj.exe 1220 ddjpv.exe 2712 bhnhhb.exe 2876 jppdp.exe 648 xlrrfrf.exe 2912 pdjjj.exe 2396 lxffrrr.exe 1556 bthbnt.exe 1436 vvpdd.exe 2144 1lffffx.exe 2248 9ppdv.exe 2148 frrxfff.exe 1444 thtntt.exe 2276 3pvjj.exe 2056 flrrrxl.exe 1664 ttthbh.exe 2076 llfflrl.exe 2800 btnnht.exe 2000 bhhhbn.exe 2732 jdjjv.exe 2672 xrxxffx.exe 3056 lfxlrxl.exe 2564 1bnhhh.exe 2556 dpvpv.exe 2756 jpvvp.exe 2524 rxrxffx.exe 2648 nnntnb.exe 2004 1jpdj.exe 3024 djjvp.exe 2260 xxrffrl.exe 1368 1tbhnn.exe 316 jvjjp.exe 1968 vjvvd.exe 236 frffxfr.exe 2424 nbbtbt.exe 1744 jppdv.exe 1640 dpvdj.exe 1116 xflfrlx.exe 2828 xxxlrll.exe 2776 ntbtbb.exe 1440 thnnhb.exe 2468 3dpdj.exe 2184 fffrrfl.exe 1920 9bnnhb.exe 2496 jpvdv.exe 1484 rxxlrrl.exe 2168 ntbtnh.exe 1644 djjpv.exe -
resource yara_rule behavioral1/memory/776-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 776 wrote to memory of 2044 776 0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe 30 PID 776 wrote to memory of 2044 776 0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe 30 PID 776 wrote to memory of 2044 776 0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe 30 PID 776 wrote to memory of 2044 776 0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe 30 PID 2044 wrote to memory of 2960 2044 xxrrflf.exe 31 PID 2044 wrote to memory of 2960 2044 xxrrflf.exe 31 PID 2044 wrote to memory of 2960 2044 xxrrflf.exe 31 PID 2044 wrote to memory of 2960 2044 xxrrflf.exe 31 PID 2960 wrote to memory of 2716 2960 nbntnh.exe 32 PID 2960 wrote to memory of 2716 2960 nbntnh.exe 32 PID 2960 wrote to memory of 2716 2960 nbntnh.exe 32 PID 2960 wrote to memory of 2716 2960 nbntnh.exe 32 PID 2716 wrote to memory of 2672 2716 9rxflrf.exe 33 PID 2716 wrote to memory of 2672 2716 9rxflrf.exe 33 PID 2716 wrote to memory of 2672 2716 9rxflrf.exe 33 PID 2716 wrote to memory of 2672 2716 9rxflrf.exe 33 PID 2672 wrote to memory of 2908 2672 btnbnb.exe 34 PID 2672 wrote to memory of 2908 2672 btnbnb.exe 34 PID 2672 wrote to memory of 2908 2672 btnbnb.exe 34 PID 2672 wrote to memory of 2908 2672 btnbnb.exe 34 PID 2908 wrote to memory of 2536 2908 jdppp.exe 35 PID 2908 wrote to memory of 2536 2908 jdppp.exe 35 PID 2908 wrote to memory of 2536 2908 jdppp.exe 35 PID 2908 wrote to memory of 2536 2908 jdppp.exe 35 PID 2536 wrote to memory of 2784 2536 pdjpv.exe 36 PID 2536 wrote to memory of 2784 2536 pdjpv.exe 36 PID 2536 wrote to memory of 2784 2536 pdjpv.exe 36 PID 2536 wrote to memory of 2784 2536 pdjpv.exe 36 PID 2784 wrote to memory of 2576 2784 lxxlxlx.exe 37 PID 2784 wrote to memory of 2576 2784 lxxlxlx.exe 37 PID 2784 wrote to memory of 2576 2784 lxxlxlx.exe 37 PID 2784 wrote to memory of 2576 2784 lxxlxlx.exe 37 PID 2576 wrote to memory of 2560 2576 nttbhb.exe 38 PID 2576 wrote to memory of 2560 2576 nttbhb.exe 38 PID 2576 wrote to memory of 2560 2576 nttbhb.exe 38 PID 2576 wrote to memory of 2560 2576 nttbhb.exe 38 PID 2560 wrote to memory of 3024 2560 ddvvd.exe 39 PID 2560 wrote to memory of 3024 2560 ddvvd.exe 39 PID 2560 wrote to memory of 3024 2560 ddvvd.exe 39 PID 2560 wrote to memory of 3024 2560 ddvvd.exe 39 PID 3024 wrote to memory of 1916 3024 xlxfllr.exe 40 PID 3024 wrote to memory of 1916 3024 xlxfllr.exe 40 PID 3024 wrote to memory of 1916 3024 xlxfllr.exe 40 PID 3024 wrote to memory of 1916 3024 xlxfllr.exe 40 PID 1916 wrote to memory of 1420 1916 nbhnhh.exe 41 PID 1916 wrote to memory of 1420 1916 nbhnhh.exe 41 PID 1916 wrote to memory of 1420 1916 nbhnhh.exe 41 PID 1916 wrote to memory of 1420 1916 nbhnhh.exe 41 PID 1420 wrote to memory of 1700 1420 fffrrxr.exe 42 PID 1420 wrote to memory of 1700 1420 fffrrxr.exe 42 PID 1420 wrote to memory of 1700 1420 fffrrxr.exe 42 PID 1420 wrote to memory of 1700 1420 fffrrxr.exe 42 PID 1700 wrote to memory of 2344 1700 bbhbhb.exe 43 PID 1700 wrote to memory of 2344 1700 bbhbhb.exe 43 PID 1700 wrote to memory of 2344 1700 bbhbhb.exe 43 PID 1700 wrote to memory of 2344 1700 bbhbhb.exe 43 PID 2344 wrote to memory of 2492 2344 bhnntt.exe 44 PID 2344 wrote to memory of 2492 2344 bhnntt.exe 44 PID 2344 wrote to memory of 2492 2344 bhnntt.exe 44 PID 2344 wrote to memory of 2492 2344 bhnntt.exe 44 PID 2492 wrote to memory of 1620 2492 7xrxxlf.exe 45 PID 2492 wrote to memory of 1620 2492 7xrxxlf.exe 45 PID 2492 wrote to memory of 1620 2492 7xrxxlf.exe 45 PID 2492 wrote to memory of 1620 2492 7xrxxlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0036abd78b5af4b6a0a098a2d7a15a0b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\xxrrflf.exec:\xxrrflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\nbntnh.exec:\nbntnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\9rxflrf.exec:\9rxflrf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\btnbnb.exec:\btnbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\jdppp.exec:\jdppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pdjpv.exec:\pdjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\lxxlxlx.exec:\lxxlxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nttbhb.exec:\nttbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ddvvd.exec:\ddvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xlxfllr.exec:\xlxfllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nbhnhh.exec:\nbhnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\fffrrxr.exec:\fffrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\bbhbhb.exec:\bbhbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\bhnntt.exec:\bhnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\7xrxxlf.exec:\7xrxxlf.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\nbtbtt.exec:\nbtbtt.exe17⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jpjpj.exec:\jpjpj.exe18⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ddjpv.exec:\ddjpv.exe19⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bhnhhb.exec:\bhnhhb.exe20⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jppdp.exec:\jppdp.exe21⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xlrrfrf.exec:\xlrrfrf.exe22⤵
- Executes dropped EXE
PID:648 -
\??\c:\pdjjj.exec:\pdjjj.exe23⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxffrrr.exec:\lxffrrr.exe24⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bthbnt.exec:\bthbnt.exe25⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vvpdd.exec:\vvpdd.exe26⤵
- Executes dropped EXE
PID:1436 -
\??\c:\1lffffx.exec:\1lffffx.exe27⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9ppdv.exec:\9ppdv.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\frrxfff.exec:\frrxfff.exe29⤵
- Executes dropped EXE
PID:2148 -
\??\c:\thtntt.exec:\thtntt.exe30⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3pvjj.exec:\3pvjj.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\flrrrxl.exec:\flrrrxl.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ttthbh.exec:\ttthbh.exe33⤵
- Executes dropped EXE
PID:1664 -
\??\c:\llfflrl.exec:\llfflrl.exe34⤵
- Executes dropped EXE
PID:2076 -
\??\c:\btnnht.exec:\btnnht.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bhhhbn.exec:\bhhhbn.exe36⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jdjjv.exec:\jdjjv.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrxxffx.exec:\xrxxffx.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1bnhhh.exec:\1bnhhh.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dpvpv.exec:\dpvpv.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jpvvp.exec:\jpvvp.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rxrxffx.exec:\rxrxffx.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nnntnb.exec:\nnntnb.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1jpdj.exec:\1jpdj.exe45⤵
- Executes dropped EXE
PID:2004 -
\??\c:\djjvp.exec:\djjvp.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xxrffrl.exec:\xxrffrl.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1tbhnn.exec:\1tbhnn.exe48⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jvjjp.exec:\jvjjp.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\vjvvd.exec:\vjvvd.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\frffxfr.exec:\frffxfr.exe51⤵
- Executes dropped EXE
PID:236 -
\??\c:\nbbtbt.exec:\nbbtbt.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jppdv.exec:\jppdv.exe53⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dpvdj.exec:\dpvdj.exe54⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xflfrlx.exec:\xflfrlx.exe55⤵
- Executes dropped EXE
PID:1116 -
\??\c:\xxxlrll.exec:\xxxlrll.exe56⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ntbtbb.exec:\ntbtbb.exe57⤵
- Executes dropped EXE
PID:2776 -
\??\c:\thnnhb.exec:\thnnhb.exe58⤵
- Executes dropped EXE
PID:1440 -
\??\c:\3dpdj.exec:\3dpdj.exe59⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fffrrfl.exec:\fffrrfl.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\9bnnhb.exec:\9bnnhb.exe61⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jpvdv.exec:\jpvdv.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rxxlrrl.exec:\rxxlrrl.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ntbtnh.exec:\ntbtnh.exe64⤵
- Executes dropped EXE
PID:2168 -
\??\c:\djjpv.exec:\djjpv.exe65⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dvvjp.exec:\dvvjp.exe66⤵PID:2320
-
\??\c:\ffrllrx.exec:\ffrllrx.exe67⤵PID:1084
-
\??\c:\htbntn.exec:\htbntn.exe68⤵PID:2232
-
\??\c:\thtbtn.exec:\thtbtn.exe69⤵PID:2252
-
\??\c:\ppvdd.exec:\ppvdd.exe70⤵PID:776
-
\??\c:\9lfxrfx.exec:\9lfxrfx.exe71⤵PID:2940
-
\??\c:\bnhntb.exec:\bnhntb.exe72⤵PID:3004
-
\??\c:\jdpjv.exec:\jdpjv.exe73⤵PID:1660
-
\??\c:\rfrrlrf.exec:\rfrrlrf.exe74⤵PID:580
-
\??\c:\rxffffl.exec:\rxffffl.exe75⤵PID:2800
-
\??\c:\1thhnn.exec:\1thhnn.exe76⤵PID:2000
-
\??\c:\vjvvd.exec:\vjvvd.exe77⤵PID:2408
-
\??\c:\fxrxlll.exec:\fxrxlll.exe78⤵PID:2672
-
\??\c:\htnttt.exec:\htnttt.exe79⤵PID:2720
-
\??\c:\djpjv.exec:\djpjv.exe80⤵PID:2832
-
\??\c:\djpvd.exec:\djpvd.exe81⤵PID:2592
-
\??\c:\lfrfxxx.exec:\lfrfxxx.exe82⤵PID:2524
-
\??\c:\flxrxfl.exec:\flxrxfl.exe83⤵PID:2984
-
\??\c:\hbbnht.exec:\hbbnht.exe84⤵PID:712
-
\??\c:\dpdvd.exec:\dpdvd.exe85⤵PID:1604
-
\??\c:\5xrlfrf.exec:\5xrlfrf.exe86⤵PID:2084
-
\??\c:\xxxrfrr.exec:\xxxrfrr.exe87⤵PID:1368
-
\??\c:\7tbtth.exec:\7tbtth.exe88⤵PID:1692
-
\??\c:\tttbnn.exec:\tttbnn.exe89⤵PID:1268
-
\??\c:\pdjvd.exec:\pdjvd.exe90⤵PID:1804
-
\??\c:\fflrfrl.exec:\fflrfrl.exe91⤵PID:1924
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe92⤵PID:2480
-
\??\c:\nbtntt.exec:\nbtntt.exe93⤵PID:2516
-
\??\c:\hnhthb.exec:\hnhthb.exe94⤵PID:2820
-
\??\c:\ddddj.exec:\ddddj.exe95⤵PID:2712
-
\??\c:\dppvd.exec:\dppvd.exe96⤵PID:272
-
\??\c:\xlxfllx.exec:\xlxfllx.exe97⤵PID:2868
-
\??\c:\xxxrxll.exec:\xxxrxll.exe98⤵PID:2180
-
\??\c:\thnhnn.exec:\thnhnn.exe99⤵PID:1524
-
\??\c:\httttb.exec:\httttb.exe100⤵PID:276
-
\??\c:\dpjdd.exec:\dpjdd.exe101⤵PID:1592
-
\??\c:\lrrlxfx.exec:\lrrlxfx.exe102⤵PID:536
-
\??\c:\hhbtnb.exec:\hhbtnb.exe103⤵PID:2144
-
\??\c:\hntbht.exec:\hntbht.exe104⤵PID:1588
-
\??\c:\ppvpv.exec:\ppvpv.exe105⤵PID:880
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe106⤵PID:2332
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe107⤵PID:2148
-
\??\c:\ttthbh.exec:\ttthbh.exe108⤵PID:2252
-
\??\c:\ttnthb.exec:\ttnthb.exe109⤵PID:2056
-
\??\c:\7ppdp.exec:\7ppdp.exe110⤵PID:2944
-
\??\c:\lrrflrf.exec:\lrrflrf.exe111⤵PID:2044
-
\??\c:\xflffxf.exec:\xflffxf.exe112⤵PID:1664
-
\??\c:\bhnhhh.exec:\bhnhhh.exe113⤵PID:2996
-
\??\c:\vvjvd.exec:\vvjvd.exe114⤵PID:2140
-
\??\c:\vjpvd.exec:\vjpvd.exe115⤵PID:2676
-
\??\c:\7lxllrf.exec:\7lxllrf.exe116⤵PID:2740
-
\??\c:\bnhhtn.exec:\bnhhtn.exe117⤵PID:2552
-
\??\c:\nttnbt.exec:\nttnbt.exe118⤵PID:2792
-
\??\c:\dpjjj.exec:\dpjjj.exe119⤵PID:2756
-
\??\c:\xxxrxll.exec:\xxxrxll.exe120⤵PID:2452
-
\??\c:\1bbbnb.exec:\1bbbnb.exe121⤵PID:2572
-
\??\c:\ttbnth.exec:\ttbnth.exe122⤵PID:1080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-