Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 22:17
Behavioral task
behavioral1
Sample
21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe
-
Size
69KB
-
MD5
21f540803536903cd73ffa714fcd3408
-
SHA1
5d4f87a482efbf40770a78c1e511e093a44a10c8
-
SHA256
bfc229406b2dce68ec16b7972d9d3bf6f9c2f0846bc4b1d35a50081a96fae688
-
SHA512
7d0f7c4420343ff14aa75d97ab7db7ae1b297a18f3b57360a28e3ce62db9e67df58132ace55b6a4ce24d75963b835bf84f64dd32607fe43ab6831512eea0f48c
-
SSDEEP
1536:JvQBeOGtrYS3srx93UBWfwC6Ggnouy8WFRxZOQ+p9D:JhOmTsF93UYfwC6GIoutWFfp+vD
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2136-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-292-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2600-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-543-0x0000000077070000-0x000000007718F000-memory.dmp family_blackmoon behavioral1/memory/1380-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-835-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-957-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2736-740-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1480-1091-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-1102-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/640-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/900-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/804-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/108-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/268-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-1192-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/1732-1208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-1219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-5928-0x0000000076F70000-0x000000007706A000-memory.dmp family_blackmoon behavioral1/memory/2284-9195-0x0000000076F70000-0x000000007706A000-memory.dmp family_blackmoon behavioral1/memory/2284-10226-0x0000000077070000-0x000000007718F000-memory.dmp family_blackmoon behavioral1/memory/2284-15949-0x0000000076F70000-0x000000007706A000-memory.dmp family_blackmoon behavioral1/memory/2284-22280-0x0000000076F70000-0x000000007706A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2136 4206662.exe 2504 828088.exe 2576 rxlrrlr.exe 2580 lfllrrf.exe 2796 48000.exe 2724 8680062.exe 2420 jdvpj.exe 2392 thtbbh.exe 2876 42844.exe 2880 hbnnhh.exe 1844 rxfrrlf.exe 2672 202806.exe 2720 866220.exe 2756 xxfxxrr.exe 1716 thtthn.exe 1648 2028440.exe 1556 tnbntt.exe 2112 442406.exe 268 xrffrrx.exe 2120 9htttt.exe 1116 u624006.exe 2732 6644000.exe 900 vpdjp.exe 1640 hthnbh.exe 2472 tntttb.exe 1160 042444.exe 1680 i646228.exe 1456 480644.exe 108 4644888.exe 320 fxlfrxx.exe 612 88426.exe 2792 rlfrflx.exe 1388 llffrlx.exe 2280 xrllxxf.exe 552 602406.exe 1672 frfffll.exe 2024 k42466.exe 1620 0044662.exe 2264 7xfxxxf.exe 1608 dpvdj.exe 2600 thnbbb.exe 2516 48442.exe 2652 02286.exe 2928 6406662.exe 2540 vpjdj.exe 2620 c862446.exe 2228 2640644.exe 2520 68406.exe 1568 208804.exe 2436 ttntbn.exe 1840 k80602.exe 2464 200026.exe 2384 226246.exe 1748 tthnnt.exe 804 thtttt.exe 1792 xrxfrrx.exe 384 3vpvp.exe 1448 1vjvv.exe 780 7rflfxf.exe 976 hbthhh.exe 488 xrllrlr.exe 1168 3jvvj.exe 2760 7nbtnn.exe 3056 rlxffxx.exe -
resource yara_rule behavioral1/memory/2136-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d87-24.dat upx behavioral1/memory/2580-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f6d-56.dat upx behavioral1/files/0x0009000000016117-72.dat upx behavioral1/files/0x0007000000016d1e-81.dat upx behavioral1/files/0x0006000000016d7e-98.dat upx behavioral1/files/0x0006000000016da7-114.dat upx behavioral1/files/0x0006000000016dbf-129.dat upx behavioral1/memory/2112-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/268-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173d8-169.dat upx behavioral1/files/0x0006000000017456-185.dat upx behavioral1/files/0x000900000001864e-219.dat upx behavioral1/files/0x000500000001866d-236.dat upx behavioral1/memory/2600-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1108-495-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-543-0x0000000077070000-0x000000007718F000-memory.dmp upx behavioral1/memory/1380-607-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/984-700-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/900-711-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/360-732-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2344-812-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-810-0x0000000077070000-0x000000007718F000-memory.dmp upx behavioral1/memory/2284-809-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-835-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/292-895-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1188-901-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1168-957-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2856-694-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-1019-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-993-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-1060-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2156-633-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1480-1091-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-565-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-542-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/640-521-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-1119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-474-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-463-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2332-457-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/900-451-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-440-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1448-399-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/804-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2384-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/552-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c0a-253.dat upx behavioral1/files/0x0005000000018778-246.dat upx behavioral1/memory/320-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/320-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/108-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001866b-229.dat upx behavioral1/memory/1456-221-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2136 2188 21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2136 2188 21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2136 2188 21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2136 2188 21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2504 2136 4206662.exe 29 PID 2136 wrote to memory of 2504 2136 4206662.exe 29 PID 2136 wrote to memory of 2504 2136 4206662.exe 29 PID 2136 wrote to memory of 2504 2136 4206662.exe 29 PID 2504 wrote to memory of 2576 2504 828088.exe 30 PID 2504 wrote to memory of 2576 2504 828088.exe 30 PID 2504 wrote to memory of 2576 2504 828088.exe 30 PID 2504 wrote to memory of 2576 2504 828088.exe 30 PID 2576 wrote to memory of 2580 2576 rxlrrlr.exe 31 PID 2576 wrote to memory of 2580 2576 rxlrrlr.exe 31 PID 2576 wrote to memory of 2580 2576 rxlrrlr.exe 31 PID 2576 wrote to memory of 2580 2576 rxlrrlr.exe 31 PID 2580 wrote to memory of 2796 2580 lfllrrf.exe 32 PID 2580 wrote to memory of 2796 2580 lfllrrf.exe 32 PID 2580 wrote to memory of 2796 2580 lfllrrf.exe 32 PID 2580 wrote to memory of 2796 2580 lfllrrf.exe 32 PID 2796 wrote to memory of 2724 2796 48000.exe 33 PID 2796 wrote to memory of 2724 2796 48000.exe 33 PID 2796 wrote to memory of 2724 2796 48000.exe 33 PID 2796 wrote to memory of 2724 2796 48000.exe 33 PID 2724 wrote to memory of 2420 2724 8680062.exe 34 PID 2724 wrote to memory of 2420 2724 8680062.exe 34 PID 2724 wrote to memory of 2420 2724 8680062.exe 34 PID 2724 wrote to memory of 2420 2724 8680062.exe 34 PID 2420 wrote to memory of 2392 2420 jdvpj.exe 35 PID 2420 wrote to memory of 2392 2420 jdvpj.exe 35 PID 2420 wrote to memory of 2392 2420 jdvpj.exe 35 PID 2420 wrote to memory of 2392 2420 jdvpj.exe 35 PID 2392 wrote to memory of 2876 2392 thtbbh.exe 36 PID 2392 wrote to memory of 2876 2392 thtbbh.exe 36 PID 2392 wrote to memory of 2876 2392 thtbbh.exe 36 PID 2392 wrote to memory of 2876 2392 thtbbh.exe 36 PID 2876 wrote to memory of 2880 2876 42844.exe 227 PID 2876 wrote to memory of 2880 2876 42844.exe 227 PID 2876 wrote to memory of 2880 2876 42844.exe 227 PID 2876 wrote to memory of 2880 2876 42844.exe 227 PID 2880 wrote to memory of 1844 2880 hbnnhh.exe 38 PID 2880 wrote to memory of 1844 2880 hbnnhh.exe 38 PID 2880 wrote to memory of 1844 2880 hbnnhh.exe 38 PID 2880 wrote to memory of 1844 2880 hbnnhh.exe 38 PID 1844 wrote to memory of 2672 1844 rxfrrlf.exe 39 PID 1844 wrote to memory of 2672 1844 rxfrrlf.exe 39 PID 1844 wrote to memory of 2672 1844 rxfrrlf.exe 39 PID 1844 wrote to memory of 2672 1844 rxfrrlf.exe 39 PID 2672 wrote to memory of 2720 2672 202806.exe 40 PID 2672 wrote to memory of 2720 2672 202806.exe 40 PID 2672 wrote to memory of 2720 2672 202806.exe 40 PID 2672 wrote to memory of 2720 2672 202806.exe 40 PID 2720 wrote to memory of 2756 2720 866220.exe 41 PID 2720 wrote to memory of 2756 2720 866220.exe 41 PID 2720 wrote to memory of 2756 2720 866220.exe 41 PID 2720 wrote to memory of 2756 2720 866220.exe 41 PID 2756 wrote to memory of 1716 2756 xxfxxrr.exe 42 PID 2756 wrote to memory of 1716 2756 xxfxxrr.exe 42 PID 2756 wrote to memory of 1716 2756 xxfxxrr.exe 42 PID 2756 wrote to memory of 1716 2756 xxfxxrr.exe 42 PID 1716 wrote to memory of 1648 1716 thtthn.exe 43 PID 1716 wrote to memory of 1648 1716 thtthn.exe 43 PID 1716 wrote to memory of 1648 1716 thtthn.exe 43 PID 1716 wrote to memory of 1648 1716 thtthn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\4206662.exec:\4206662.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\828088.exec:\828088.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rxlrrlr.exec:\rxlrrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lfllrrf.exec:\lfllrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\48000.exec:\48000.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\8680062.exec:\8680062.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jdvpj.exec:\jdvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\thtbbh.exec:\thtbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\42844.exec:\42844.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\hbnnhh.exec:\hbnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rxfrrlf.exec:\rxfrrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\202806.exec:\202806.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\866220.exec:\866220.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\thtthn.exec:\thtthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\2028440.exec:\2028440.exe17⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tnbntt.exec:\tnbntt.exe18⤵
- Executes dropped EXE
PID:1556 -
\??\c:\442406.exec:\442406.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xrffrrx.exec:\xrffrrx.exe20⤵
- Executes dropped EXE
PID:268 -
\??\c:\9htttt.exec:\9htttt.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\u624006.exec:\u624006.exe22⤵
- Executes dropped EXE
PID:1116 -
\??\c:\6644000.exec:\6644000.exe23⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vpdjp.exec:\vpdjp.exe24⤵
- Executes dropped EXE
PID:900 -
\??\c:\hthnbh.exec:\hthnbh.exe25⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tntttb.exec:\tntttb.exe26⤵
- Executes dropped EXE
PID:2472 -
\??\c:\042444.exec:\042444.exe27⤵
- Executes dropped EXE
PID:1160 -
\??\c:\i646228.exec:\i646228.exe28⤵
- Executes dropped EXE
PID:1680 -
\??\c:\480644.exec:\480644.exe29⤵
- Executes dropped EXE
PID:1456 -
\??\c:\4644888.exec:\4644888.exe30⤵
- Executes dropped EXE
PID:108 -
\??\c:\fxlfrxx.exec:\fxlfrxx.exe31⤵
- Executes dropped EXE
PID:320 -
\??\c:\88426.exec:\88426.exe32⤵
- Executes dropped EXE
PID:612 -
\??\c:\rlfrflx.exec:\rlfrflx.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\llffrlx.exec:\llffrlx.exe34⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xrllxxf.exec:\xrllxxf.exe35⤵
- Executes dropped EXE
PID:2280 -
\??\c:\602406.exec:\602406.exe36⤵
- Executes dropped EXE
PID:552 -
\??\c:\frfffll.exec:\frfffll.exe37⤵
- Executes dropped EXE
PID:1672 -
\??\c:\k42466.exec:\k42466.exe38⤵
- Executes dropped EXE
PID:2024 -
\??\c:\0044662.exec:\0044662.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7xfxxxf.exec:\7xfxxxf.exe40⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dpvdj.exec:\dpvdj.exe41⤵
- Executes dropped EXE
PID:1608 -
\??\c:\thnbbb.exec:\thnbbb.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\48442.exec:\48442.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\02286.exec:\02286.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\6406662.exec:\6406662.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vpjdj.exec:\vpjdj.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\c862446.exec:\c862446.exe47⤵
- Executes dropped EXE
PID:2620 -
\??\c:\2640644.exec:\2640644.exe48⤵
- Executes dropped EXE
PID:2228 -
\??\c:\68406.exec:\68406.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\208804.exec:\208804.exe50⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ttntbn.exec:\ttntbn.exe51⤵
- Executes dropped EXE
PID:2436 -
\??\c:\k80602.exec:\k80602.exe52⤵
- Executes dropped EXE
PID:1840 -
\??\c:\200026.exec:\200026.exe53⤵
- Executes dropped EXE
PID:2464 -
\??\c:\226246.exec:\226246.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tthnnt.exec:\tthnnt.exe55⤵
- Executes dropped EXE
PID:1748 -
\??\c:\thtttt.exec:\thtttt.exe56⤵
- Executes dropped EXE
PID:804 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3vpvp.exec:\3vpvp.exe58⤵
- Executes dropped EXE
PID:384 -
\??\c:\1vjvv.exec:\1vjvv.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\7rflfxf.exec:\7rflfxf.exe60⤵
- Executes dropped EXE
PID:780 -
\??\c:\hbthhh.exec:\hbthhh.exe61⤵
- Executes dropped EXE
PID:976 -
\??\c:\xrllrlr.exec:\xrllrlr.exe62⤵
- Executes dropped EXE
PID:488 -
\??\c:\3jvvj.exec:\3jvvj.exe63⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7nbtnn.exec:\7nbtnn.exe64⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rlxffxx.exec:\rlxffxx.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1bnthh.exec:\1bnthh.exe66⤵PID:2696
-
\??\c:\5btnnn.exec:\5btnnn.exe67⤵PID:2732
-
\??\c:\2002484.exec:\2002484.exe68⤵PID:900
-
\??\c:\7nhnbb.exec:\7nhnbb.exe69⤵PID:2060
-
\??\c:\vpjjv.exec:\vpjjv.exe70⤵PID:2332
-
\??\c:\80624.exec:\80624.exe71⤵PID:2872
-
\??\c:\424028.exec:\424028.exe72⤵PID:360
-
\??\c:\480022.exec:\480022.exe73⤵PID:1704
-
\??\c:\bnttbh.exec:\bnttbh.exe74⤵PID:1256
-
\??\c:\tnhhhh.exec:\tnhhhh.exe75⤵PID:1452
-
\??\c:\9bhntb.exec:\9bhntb.exe76⤵PID:1796
-
\??\c:\xrrrxrf.exec:\xrrrxrf.exe77⤵PID:1108
-
\??\c:\3lffxrl.exec:\3lffxrl.exe78⤵PID:2308
-
\??\c:\ppdjv.exec:\ppdjv.exe79⤵PID:612
-
\??\c:\u062840.exec:\u062840.exe80⤵PID:1932
-
\??\c:\vpjvp.exec:\vpjvp.exe81⤵PID:640
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe82⤵PID:2568
-
\??\c:\8022848.exec:\8022848.exe83⤵PID:2280
-
\??\c:\420460.exec:\420460.exe84⤵PID:1676
-
\??\c:\7xflfff.exec:\7xflfff.exe85⤵PID:808
-
\??\c:\dvvvj.exec:\dvvvj.exe86⤵PID:2284
-
\??\c:\224400.exec:\224400.exe87⤵PID:2784
-
\??\c:\42002.exec:\42002.exe88⤵PID:1480
-
\??\c:\280002.exec:\280002.exe89⤵PID:2136
-
\??\c:\04446.exec:\04446.exe90⤵PID:3016
-
\??\c:\hnbhhn.exec:\hnbhhn.exe91⤵PID:2584
-
\??\c:\482244.exec:\482244.exe92⤵PID:1292
-
\??\c:\9bttbb.exec:\9bttbb.exe93⤵PID:2396
-
\??\c:\xxxxxlr.exec:\xxxxxlr.exe94⤵PID:2724
-
\??\c:\dpvpp.exec:\dpvpp.exe95⤵PID:2928
-
\??\c:\2000262.exec:\2000262.exe96⤵PID:2372
-
\??\c:\280826.exec:\280826.exe97⤵PID:2964
-
\??\c:\4246666.exec:\4246666.exe98⤵PID:1380
-
\??\c:\5vjpd.exec:\5vjpd.exe99⤵PID:2512
-
\??\c:\2406224.exec:\2406224.exe100⤵PID:2376
-
\??\c:\hbtttt.exec:\hbtttt.exe101⤵PID:2288
-
\??\c:\9nbbhn.exec:\9nbbhn.exe102⤵PID:2704
-
\??\c:\9pdjp.exec:\9pdjp.exe103⤵PID:1844
-
\??\c:\pjdjp.exec:\pjdjp.exe104⤵PID:2156
-
\??\c:\hhnttn.exec:\hhnttn.exe105⤵PID:1736
-
\??\c:\9rxrrrx.exec:\9rxrrrx.exe106⤵PID:2496
-
\??\c:\vpdpp.exec:\vpdpp.exe107⤵PID:1588
-
\??\c:\9ddjj.exec:\9ddjj.exe108⤵PID:2196
-
\??\c:\bhnbtb.exec:\bhnbtb.exe109⤵PID:1648
-
\??\c:\xlllllx.exec:\xlllllx.exe110⤵PID:1460
-
\??\c:\s2686.exec:\s2686.exe111⤵PID:780
-
\??\c:\606244.exec:\606244.exe112⤵PID:2656
-
\??\c:\jvvdv.exec:\jvvdv.exe113⤵PID:268
-
\??\c:\tnhtbh.exec:\tnhtbh.exe114⤵PID:2192
-
\??\c:\5flflrx.exec:\5flflrx.exe115⤵PID:1696
-
\??\c:\tnhntn.exec:\tnhntn.exe116⤵PID:2856
-
\??\c:\4244006.exec:\4244006.exe117⤵PID:984
-
\??\c:\m6840.exec:\m6840.exe118⤵PID:2732
-
\??\c:\pdvvj.exec:\pdvvj.exe119⤵PID:900
-
\??\c:\806006.exec:\806006.exe120⤵PID:2556
-
\??\c:\k24082.exec:\k24082.exe121⤵PID:2300
-
\??\c:\086688.exec:\086688.exe122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-