Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 18:21
Behavioral task
behavioral1
Sample
e81d63337bef6ebe2ec64854e618d91d_JaffaCakes118.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
e81d63337bef6ebe2ec64854e618d91d_JaffaCakes118.exe
-
Size
76KB
-
MD5
e81d63337bef6ebe2ec64854e618d91d
-
SHA1
e80fdee490584e95eb287814c1ba4e4b002dae37
-
SHA256
0fa708afb950135235414a19701664fa98611da87fc53503077566cabb432e47
-
SHA512
36445a6144820606d7a43d736a2d5d32838d18a78eac7d35da6e9abdc2e71ff68756535e8b6a44f97472a0e06f828fe98f095b8749450de2d7979ab7eab3053a
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNYl7tSS52nIsrtuXmHzl3n:khOmTsF93UYfwC6GIoutpYB7tSS5Ctug
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/440-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-835-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-887-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-891-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-986-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-1023-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 440 vvdvv.exe 1232 604488.exe 2628 66882.exe 4920 620602.exe 3640 vjdjv.exe 3000 s2422.exe 3776 6206044.exe 4408 28042.exe 2412 4800426.exe 2316 68260.exe 2052 3ppjv.exe 592 862244.exe 1400 lfxlfxr.exe 1252 xxfxfxf.exe 4696 xlrlfff.exe 2960 xxrrlfx.exe 4488 006266.exe 2012 626488.exe 1340 httnhb.exe 1100 nhnnnt.exe 3364 fffxxrr.exe 4384 tbbhhh.exe 1744 4422282.exe 2588 4084044.exe 2796 hbbtbt.exe 3496 60608.exe 3188 4886860.exe 2104 btbtnh.exe 4000 7djjv.exe 2288 8624826.exe 3104 xfffxrl.exe 5012 frxrlll.exe 3532 vjpdp.exe 5016 400408.exe 2876 flllxxr.exe 4020 u600484.exe 412 i860804.exe 720 66660.exe 3068 lxfxllf.exe 3968 084422.exe 1428 pjjdv.exe 2164 0406800.exe 372 c222660.exe 4476 xxxrlrr.exe 4860 84226.exe 4312 4406666.exe 3368 hbhhbb.exe 1556 jvjdv.exe 3660 jddvd.exe 4856 48886.exe 1004 ddppv.exe 3500 4420064.exe 4920 pvjpp.exe 1672 828288.exe 3776 dvjdv.exe 4160 00604.exe 4132 rrrrflf.exe 3296 k02044.exe 2316 1ddvp.exe 4140 rxxxrll.exe 3680 c684406.exe 5000 o688222.exe 1460 hhbbtt.exe 4980 02644.exe -
resource yara_rule behavioral2/memory/1984-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023204-3.dat upx behavioral2/memory/440-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1984-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1232-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002320f-17.dat upx behavioral2/files/0x0007000000023210-21.dat upx behavioral2/files/0x0007000000023211-26.dat upx behavioral2/memory/2628-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002320b-11.dat upx behavioral2/files/0x0007000000023212-33.dat upx behavioral2/memory/3000-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3640-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023213-39.dat upx behavioral2/memory/3776-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023214-44.dat upx behavioral2/memory/4408-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023215-51.dat upx behavioral2/files/0x0007000000023216-55.dat upx behavioral2/files/0x0007000000023217-60.dat upx behavioral2/memory/2316-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023218-67.dat upx behavioral2/files/0x0007000000023219-70.dat upx behavioral2/memory/1400-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002321a-76.dat upx behavioral2/memory/1400-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1252-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002321b-82.dat upx behavioral2/memory/4696-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002321c-90.dat upx behavioral2/memory/2960-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002321d-95.dat upx behavioral2/memory/4488-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002321e-100.dat upx behavioral2/memory/4488-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002321f-105.dat upx behavioral2/memory/2012-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002320c-110.dat upx behavioral2/memory/1340-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1100-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3364-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023221-117.dat upx behavioral2/files/0x0007000000023222-121.dat upx behavioral2/memory/4384-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023223-128.dat upx behavioral2/memory/1744-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3364-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1744-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023224-135.dat upx behavioral2/memory/2588-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023225-139.dat upx behavioral2/files/0x0007000000023226-146.dat upx behavioral2/files/0x0007000000023227-149.dat upx behavioral2/memory/3188-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023228-156.dat upx behavioral2/files/0x0007000000023229-162.dat upx behavioral2/memory/2104-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4000-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322a-169.dat upx behavioral2/memory/2288-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322b-173.dat upx behavioral2/memory/3104-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322c-179.dat upx behavioral2/memory/3532-187-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 440 1984 e81d63337bef6ebe2ec64854e618d91d_JaffaCakes118.exe 85 PID 1984 wrote to memory of 440 1984 e81d63337bef6ebe2ec64854e618d91d_JaffaCakes118.exe 85 PID 1984 wrote to memory of 440 1984 e81d63337bef6ebe2ec64854e618d91d_JaffaCakes118.exe 85 PID 440 wrote to memory of 1232 440 vvdvv.exe 86 PID 440 wrote to memory of 1232 440 vvdvv.exe 86 PID 440 wrote to memory of 1232 440 vvdvv.exe 86 PID 1232 wrote to memory of 2628 1232 604488.exe 87 PID 1232 wrote to memory of 2628 1232 604488.exe 87 PID 1232 wrote to memory of 2628 1232 604488.exe 87 PID 2628 wrote to memory of 4920 2628 66882.exe 88 PID 2628 wrote to memory of 4920 2628 66882.exe 88 PID 2628 wrote to memory of 4920 2628 66882.exe 88 PID 4920 wrote to memory of 3640 4920 620602.exe 89 PID 4920 wrote to memory of 3640 4920 620602.exe 89 PID 4920 wrote to memory of 3640 4920 620602.exe 89 PID 3640 wrote to memory of 3000 3640 vjdjv.exe 90 PID 3640 wrote to memory of 3000 3640 vjdjv.exe 90 PID 3640 wrote to memory of 3000 3640 vjdjv.exe 90 PID 3000 wrote to memory of 3776 3000 s2422.exe 91 PID 3000 wrote to memory of 3776 3000 s2422.exe 91 PID 3000 wrote to memory of 3776 3000 s2422.exe 91 PID 3776 wrote to memory of 4408 3776 6206044.exe 92 PID 3776 wrote to memory of 4408 3776 6206044.exe 92 PID 3776 wrote to memory of 4408 3776 6206044.exe 92 PID 4408 wrote to memory of 2412 4408 28042.exe 93 PID 4408 wrote to memory of 2412 4408 28042.exe 93 PID 4408 wrote to memory of 2412 4408 28042.exe 93 PID 2412 wrote to memory of 2316 2412 4800426.exe 94 PID 2412 wrote to memory of 2316 2412 4800426.exe 94 PID 2412 wrote to memory of 2316 2412 4800426.exe 94 PID 2316 wrote to memory of 2052 2316 68260.exe 95 PID 2316 wrote to memory of 2052 2316 68260.exe 95 PID 2316 wrote to memory of 2052 2316 68260.exe 95 PID 2052 wrote to memory of 592 2052 3ppjv.exe 96 PID 2052 wrote to memory of 592 2052 3ppjv.exe 96 PID 2052 wrote to memory of 592 2052 3ppjv.exe 96 PID 592 wrote to memory of 1400 592 862244.exe 97 PID 592 wrote to memory of 1400 592 862244.exe 97 PID 592 wrote to memory of 1400 592 862244.exe 97 PID 1400 wrote to memory of 1252 1400 lfxlfxr.exe 98 PID 1400 wrote to memory of 1252 1400 lfxlfxr.exe 98 PID 1400 wrote to memory of 1252 1400 lfxlfxr.exe 98 PID 1252 wrote to memory of 4696 1252 xxfxfxf.exe 99 PID 1252 wrote to memory of 4696 1252 xxfxfxf.exe 99 PID 1252 wrote to memory of 4696 1252 xxfxfxf.exe 99 PID 4696 wrote to memory of 2960 4696 xlrlfff.exe 100 PID 4696 wrote to memory of 2960 4696 xlrlfff.exe 100 PID 4696 wrote to memory of 2960 4696 xlrlfff.exe 100 PID 2960 wrote to memory of 4488 2960 xxrrlfx.exe 101 PID 2960 wrote to memory of 4488 2960 xxrrlfx.exe 101 PID 2960 wrote to memory of 4488 2960 xxrrlfx.exe 101 PID 4488 wrote to memory of 2012 4488 006266.exe 102 PID 4488 wrote to memory of 2012 4488 006266.exe 102 PID 4488 wrote to memory of 2012 4488 006266.exe 102 PID 2012 wrote to memory of 1340 2012 626488.exe 103 PID 2012 wrote to memory of 1340 2012 626488.exe 103 PID 2012 wrote to memory of 1340 2012 626488.exe 103 PID 1340 wrote to memory of 1100 1340 httnhb.exe 104 PID 1340 wrote to memory of 1100 1340 httnhb.exe 104 PID 1340 wrote to memory of 1100 1340 httnhb.exe 104 PID 1100 wrote to memory of 3364 1100 nhnnnt.exe 106 PID 1100 wrote to memory of 3364 1100 nhnnnt.exe 106 PID 1100 wrote to memory of 3364 1100 nhnnnt.exe 106 PID 3364 wrote to memory of 4384 3364 fffxxrr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\e81d63337bef6ebe2ec64854e618d91d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e81d63337bef6ebe2ec64854e618d91d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\vvdvv.exec:\vvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\604488.exec:\604488.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\66882.exec:\66882.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\620602.exec:\620602.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\vjdjv.exec:\vjdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\s2422.exec:\s2422.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\6206044.exec:\6206044.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\28042.exec:\28042.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\4800426.exec:\4800426.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\68260.exec:\68260.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\3ppjv.exec:\3ppjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\862244.exec:\862244.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\xxfxfxf.exec:\xxfxfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\xlrlfff.exec:\xlrlfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\xxrrlfx.exec:\xxrrlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\006266.exec:\006266.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\626488.exec:\626488.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\httnhb.exec:\httnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\nhnnnt.exec:\nhnnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\fffxxrr.exec:\fffxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\tbbhhh.exec:\tbbhhh.exe23⤵
- Executes dropped EXE
PID:4384 -
\??\c:\4422282.exec:\4422282.exe24⤵
- Executes dropped EXE
PID:1744 -
\??\c:\4084044.exec:\4084044.exe25⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hbbtbt.exec:\hbbtbt.exe26⤵
- Executes dropped EXE
PID:2796 -
\??\c:\60608.exec:\60608.exe27⤵
- Executes dropped EXE
PID:3496 -
\??\c:\4886860.exec:\4886860.exe28⤵
- Executes dropped EXE
PID:3188 -
\??\c:\btbtnh.exec:\btbtnh.exe29⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7djjv.exec:\7djjv.exe30⤵
- Executes dropped EXE
PID:4000 -
\??\c:\8624826.exec:\8624826.exe31⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xfffxrl.exec:\xfffxrl.exe32⤵
- Executes dropped EXE
PID:3104 -
\??\c:\frxrlll.exec:\frxrlll.exe33⤵
- Executes dropped EXE
PID:5012 -
\??\c:\vjpdp.exec:\vjpdp.exe34⤵
- Executes dropped EXE
PID:3532 -
\??\c:\400408.exec:\400408.exe35⤵
- Executes dropped EXE
PID:5016 -
\??\c:\flllxxr.exec:\flllxxr.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\u600484.exec:\u600484.exe37⤵
- Executes dropped EXE
PID:4020 -
\??\c:\i860804.exec:\i860804.exe38⤵
- Executes dropped EXE
PID:412 -
\??\c:\66660.exec:\66660.exe39⤵
- Executes dropped EXE
PID:720 -
\??\c:\lxfxllf.exec:\lxfxllf.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\084422.exec:\084422.exe41⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pjjdv.exec:\pjjdv.exe42⤵
- Executes dropped EXE
PID:1428 -
\??\c:\0406800.exec:\0406800.exe43⤵
- Executes dropped EXE
PID:2164 -
\??\c:\c222660.exec:\c222660.exe44⤵
- Executes dropped EXE
PID:372 -
\??\c:\xxxrlrr.exec:\xxxrlrr.exe45⤵
- Executes dropped EXE
PID:4476 -
\??\c:\84226.exec:\84226.exe46⤵
- Executes dropped EXE
PID:4860 -
\??\c:\4406666.exec:\4406666.exe47⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hbhhbb.exec:\hbhhbb.exe48⤵
- Executes dropped EXE
PID:3368 -
\??\c:\jvjdv.exec:\jvjdv.exe49⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jddvd.exec:\jddvd.exe50⤵
- Executes dropped EXE
PID:3660 -
\??\c:\48886.exec:\48886.exe51⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ddppv.exec:\ddppv.exe52⤵
- Executes dropped EXE
PID:1004 -
\??\c:\4420064.exec:\4420064.exe53⤵
- Executes dropped EXE
PID:3500 -
\??\c:\pvjpp.exec:\pvjpp.exe54⤵
- Executes dropped EXE
PID:4920 -
\??\c:\828288.exec:\828288.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvjdv.exec:\dvjdv.exe56⤵
- Executes dropped EXE
PID:3776 -
\??\c:\00604.exec:\00604.exe57⤵
- Executes dropped EXE
PID:4160 -
\??\c:\rrrrflf.exec:\rrrrflf.exe58⤵
- Executes dropped EXE
PID:4132 -
\??\c:\k02044.exec:\k02044.exe59⤵
- Executes dropped EXE
PID:3296 -
\??\c:\1ddvp.exec:\1ddvp.exe60⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rxxxrll.exec:\rxxxrll.exe61⤵
- Executes dropped EXE
PID:4140 -
\??\c:\c684406.exec:\c684406.exe62⤵
- Executes dropped EXE
PID:3680 -
\??\c:\o688222.exec:\o688222.exe63⤵
- Executes dropped EXE
PID:5000 -
\??\c:\hhbbtt.exec:\hhbbtt.exe64⤵
- Executes dropped EXE
PID:1460 -
\??\c:\02644.exec:\02644.exe65⤵
- Executes dropped EXE
PID:4980 -
\??\c:\08442.exec:\08442.exe66⤵PID:3124
-
\??\c:\8460660.exec:\8460660.exe67⤵PID:2076
-
\??\c:\tnnnnn.exec:\tnnnnn.exe68⤵PID:2936
-
\??\c:\02882.exec:\02882.exe69⤵PID:4760
-
\??\c:\2284400.exec:\2284400.exe70⤵PID:3908
-
\??\c:\062828.exec:\062828.exe71⤵PID:2680
-
\??\c:\60044.exec:\60044.exe72⤵PID:4832
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe73⤵PID:880
-
\??\c:\ttntnn.exec:\ttntnn.exe74⤵PID:2304
-
\??\c:\4000444.exec:\4000444.exe75⤵PID:1636
-
\??\c:\jpvpp.exec:\jpvpp.exe76⤵PID:3132
-
\??\c:\dpvvv.exec:\dpvvv.exe77⤵PID:772
-
\??\c:\88404.exec:\88404.exe78⤵PID:2636
-
\??\c:\2200226.exec:\2200226.exe79⤵PID:3512
-
\??\c:\2062226.exec:\2062226.exe80⤵PID:1776
-
\??\c:\bhnhtn.exec:\bhnhtn.exe81⤵PID:2104
-
\??\c:\48044.exec:\48044.exe82⤵PID:3052
-
\??\c:\frxxrrr.exec:\frxxrrr.exe83⤵PID:3540
-
\??\c:\btnhnn.exec:\btnhnn.exe84⤵PID:4940
-
\??\c:\k80488.exec:\k80488.exe85⤵PID:3104
-
\??\c:\84082.exec:\84082.exe86⤵PID:4600
-
\??\c:\6402268.exec:\6402268.exe87⤵PID:5012
-
\??\c:\xllfxrr.exec:\xllfxrr.exe88⤵PID:2556
-
\??\c:\0246066.exec:\0246066.exe89⤵PID:2860
-
\??\c:\3xxxxxx.exec:\3xxxxxx.exe90⤵PID:4220
-
\??\c:\o466604.exec:\o466604.exe91⤵PID:4740
-
\??\c:\jddvd.exec:\jddvd.exe92⤵PID:4020
-
\??\c:\thhthb.exec:\thhthb.exe93⤵PID:412
-
\??\c:\1xxxrxr.exec:\1xxxrxr.exe94⤵PID:4060
-
\??\c:\604422.exec:\604422.exe95⤵PID:3068
-
\??\c:\u862404.exec:\u862404.exe96⤵PID:2360
-
\??\c:\hbnnnt.exec:\hbnnnt.exe97⤵PID:2612
-
\??\c:\4804006.exec:\4804006.exe98⤵PID:116
-
\??\c:\flrlffl.exec:\flrlffl.exe99⤵PID:2008
-
\??\c:\0004264.exec:\0004264.exe100⤵PID:4412
-
\??\c:\4404404.exec:\4404404.exe101⤵PID:3952
-
\??\c:\062222.exec:\062222.exe102⤵PID:2596
-
\??\c:\44626.exec:\44626.exe103⤵PID:3096
-
\??\c:\flfxlff.exec:\flfxlff.exe104⤵PID:4564
-
\??\c:\48442.exec:\48442.exe105⤵PID:1216
-
\??\c:\442402.exec:\442402.exe106⤵PID:3204
-
\??\c:\lfllfxx.exec:\lfllfxx.exe107⤵PID:4944
-
\??\c:\4822284.exec:\4822284.exe108⤵PID:2284
-
\??\c:\hbbtnn.exec:\hbbtnn.exe109⤵PID:1672
-
\??\c:\602640.exec:\602640.exe110⤵PID:64
-
\??\c:\i824462.exec:\i824462.exe111⤵PID:4408
-
\??\c:\2622888.exec:\2622888.exe112⤵PID:4800
-
\??\c:\44644.exec:\44644.exe113⤵PID:1012
-
\??\c:\ntttht.exec:\ntttht.exe114⤵PID:440
-
\??\c:\thbhnh.exec:\thbhnh.exe115⤵PID:4372
-
\??\c:\2228282.exec:\2228282.exe116⤵PID:2656
-
\??\c:\vpppp.exec:\vpppp.exe117⤵PID:3680
-
\??\c:\3jvpv.exec:\3jvpv.exe118⤵PID:2348
-
\??\c:\o282222.exec:\o282222.exe119⤵PID:3516
-
\??\c:\0466604.exec:\0466604.exe120⤵PID:4488
-
\??\c:\pvvdp.exec:\pvvdp.exe121⤵PID:1720
-
\??\c:\ntbbnn.exec:\ntbbnn.exe122⤵PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-