Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 22:17
Behavioral task
behavioral1
Sample
21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe
-
Size
69KB
-
MD5
21f540803536903cd73ffa714fcd3408
-
SHA1
5d4f87a482efbf40770a78c1e511e093a44a10c8
-
SHA256
bfc229406b2dce68ec16b7972d9d3bf6f9c2f0846bc4b1d35a50081a96fae688
-
SHA512
7d0f7c4420343ff14aa75d97ab7db7ae1b297a18f3b57360a28e3ce62db9e67df58132ace55b6a4ce24d75963b835bf84f64dd32607fe43ab6831512eea0f48c
-
SSDEEP
1536:JvQBeOGtrYS3srx93UBWfwC6Ggnouy8WFRxZOQ+p9D:JhOmTsF93UYfwC6GIoutWFfp+vD
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3056-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/708-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3416-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-637-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-738-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2020 jvvpd.exe 2480 rrlfffl.exe 5048 nbthbn.exe 1476 jddjp.exe 708 ddjjp.exe 2640 7httnt.exe 4432 hhhbtt.exe 1516 dvdjp.exe 3168 rxffxxx.exe 1072 xrrrffl.exe 4592 bbbbbh.exe 2112 tthbtt.exe 3976 vvddd.exe 3260 rxxxxrr.exe 4692 lrrrffl.exe 5000 bttnhh.exe 2408 dvjdp.exe 1680 xlflfff.exe 3348 7xfxrrr.exe 4704 ntnhhh.exe 3924 ddppv.exe 4056 xfrrxfr.exe 3408 1xffrxf.exe 2868 nhnhbb.exe 1340 7jddp.exe 3328 vdppp.exe 4244 frrrfff.exe 464 tthtbt.exe 3856 httbbh.exe 2644 vdppj.exe 3576 frxrxxx.exe 4428 nbhbhb.exe 2600 bbhhbb.exe 1628 vjppj.exe 412 jjpdd.exe 4072 7lfflff.exe 4060 bhnnhh.exe 4928 bhnbtt.exe 1180 dpjjp.exe 2160 pppdv.exe 4920 lrxrlrr.exe 3672 hbttth.exe 2308 dvpjp.exe 3388 pjjvj.exe 2164 lflfrrl.exe 3400 xxxrlll.exe 2012 nhnhhh.exe 4324 hthbbb.exe 4348 vjjjd.exe 4452 ffxrrrr.exe 536 ttnnnh.exe 384 hnbbht.exe 4636 pjpjp.exe 2668 jjvpj.exe 2988 fllfxxr.exe 3720 flxxrfx.exe 3776 btnhbb.exe 4944 vddvd.exe 920 dddvp.exe 1072 xxrrrrr.exe 2956 hhhbtb.exe 3164 nhnnbh.exe 1096 pjjdp.exe 2100 3xlfxrl.exe -
resource yara_rule behavioral2/memory/3056-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023b10-3.dat upx behavioral2/memory/3056-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2020-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b70-10.dat upx behavioral2/memory/2480-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-11.dat upx behavioral2/memory/5048-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-19.dat upx behavioral2/memory/1476-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-24.dat upx behavioral2/memory/708-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-29.dat upx behavioral2/files/0x000a000000023b86-34.dat upx behavioral2/memory/2640-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-38.dat upx behavioral2/memory/4432-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1516-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3168-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-49.dat upx behavioral2/files/0x000a000000023b8a-53.dat upx behavioral2/files/0x000a000000023b88-44.dat upx behavioral2/memory/4592-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-63.dat upx behavioral2/files/0x000a000000023b8b-59.dat upx behavioral2/memory/2112-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3976-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-68.dat upx behavioral2/memory/3260-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8e-73.dat upx behavioral2/memory/3260-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-78.dat upx behavioral2/files/0x000a000000023b90-82.dat upx behavioral2/memory/5000-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-87.dat upx behavioral2/memory/2408-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1680-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-94.dat upx behavioral2/memory/3348-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b93-98.dat upx behavioral2/files/0x000a000000023b94-102.dat upx behavioral2/memory/4704-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-107.dat upx behavioral2/files/0x000a000000023b96-111.dat upx behavioral2/files/0x000a000000023b97-115.dat upx behavioral2/memory/3408-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-120.dat upx behavioral2/files/0x000a000000023b99-124.dat upx behavioral2/files/0x000a000000023b9a-128.dat upx behavioral2/files/0x000a000000023b9b-133.dat upx behavioral2/memory/464-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-137.dat upx behavioral2/files/0x000a000000023b9d-141.dat upx behavioral2/memory/3856-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-146.dat upx behavioral2/memory/3576-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b77-153.dat upx behavioral2/memory/3576-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4428-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2600-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1628-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1628-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4072-169-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2020 3056 21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe 83 PID 3056 wrote to memory of 2020 3056 21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe 83 PID 3056 wrote to memory of 2020 3056 21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe 83 PID 2020 wrote to memory of 2480 2020 jvvpd.exe 84 PID 2020 wrote to memory of 2480 2020 jvvpd.exe 84 PID 2020 wrote to memory of 2480 2020 jvvpd.exe 84 PID 2480 wrote to memory of 5048 2480 rrlfffl.exe 85 PID 2480 wrote to memory of 5048 2480 rrlfffl.exe 85 PID 2480 wrote to memory of 5048 2480 rrlfffl.exe 85 PID 5048 wrote to memory of 1476 5048 nbthbn.exe 86 PID 5048 wrote to memory of 1476 5048 nbthbn.exe 86 PID 5048 wrote to memory of 1476 5048 nbthbn.exe 86 PID 1476 wrote to memory of 708 1476 jddjp.exe 87 PID 1476 wrote to memory of 708 1476 jddjp.exe 87 PID 1476 wrote to memory of 708 1476 jddjp.exe 87 PID 708 wrote to memory of 2640 708 ddjjp.exe 88 PID 708 wrote to memory of 2640 708 ddjjp.exe 88 PID 708 wrote to memory of 2640 708 ddjjp.exe 88 PID 2640 wrote to memory of 4432 2640 7httnt.exe 89 PID 2640 wrote to memory of 4432 2640 7httnt.exe 89 PID 2640 wrote to memory of 4432 2640 7httnt.exe 89 PID 4432 wrote to memory of 1516 4432 hhhbtt.exe 90 PID 4432 wrote to memory of 1516 4432 hhhbtt.exe 90 PID 4432 wrote to memory of 1516 4432 hhhbtt.exe 90 PID 1516 wrote to memory of 3168 1516 dvdjp.exe 91 PID 1516 wrote to memory of 3168 1516 dvdjp.exe 91 PID 1516 wrote to memory of 3168 1516 dvdjp.exe 91 PID 3168 wrote to memory of 1072 3168 rxffxxx.exe 92 PID 3168 wrote to memory of 1072 3168 rxffxxx.exe 92 PID 3168 wrote to memory of 1072 3168 rxffxxx.exe 92 PID 1072 wrote to memory of 4592 1072 xrrrffl.exe 93 PID 1072 wrote to memory of 4592 1072 xrrrffl.exe 93 PID 1072 wrote to memory of 4592 1072 xrrrffl.exe 93 PID 4592 wrote to memory of 2112 4592 bbbbbh.exe 94 PID 4592 wrote to memory of 2112 4592 bbbbbh.exe 94 PID 4592 wrote to memory of 2112 4592 bbbbbh.exe 94 PID 2112 wrote to memory of 3976 2112 tthbtt.exe 95 PID 2112 wrote to memory of 3976 2112 tthbtt.exe 95 PID 2112 wrote to memory of 3976 2112 tthbtt.exe 95 PID 3976 wrote to memory of 3260 3976 vvddd.exe 96 PID 3976 wrote to memory of 3260 3976 vvddd.exe 96 PID 3976 wrote to memory of 3260 3976 vvddd.exe 96 PID 3260 wrote to memory of 4692 3260 rxxxxrr.exe 97 PID 3260 wrote to memory of 4692 3260 rxxxxrr.exe 97 PID 3260 wrote to memory of 4692 3260 rxxxxrr.exe 97 PID 4692 wrote to memory of 5000 4692 lrrrffl.exe 98 PID 4692 wrote to memory of 5000 4692 lrrrffl.exe 98 PID 4692 wrote to memory of 5000 4692 lrrrffl.exe 98 PID 5000 wrote to memory of 2408 5000 bttnhh.exe 99 PID 5000 wrote to memory of 2408 5000 bttnhh.exe 99 PID 5000 wrote to memory of 2408 5000 bttnhh.exe 99 PID 2408 wrote to memory of 1680 2408 dvjdp.exe 100 PID 2408 wrote to memory of 1680 2408 dvjdp.exe 100 PID 2408 wrote to memory of 1680 2408 dvjdp.exe 100 PID 1680 wrote to memory of 3348 1680 xlflfff.exe 101 PID 1680 wrote to memory of 3348 1680 xlflfff.exe 101 PID 1680 wrote to memory of 3348 1680 xlflfff.exe 101 PID 3348 wrote to memory of 4704 3348 7xfxrrr.exe 102 PID 3348 wrote to memory of 4704 3348 7xfxrrr.exe 102 PID 3348 wrote to memory of 4704 3348 7xfxrrr.exe 102 PID 4704 wrote to memory of 3924 4704 ntnhhh.exe 103 PID 4704 wrote to memory of 3924 4704 ntnhhh.exe 103 PID 4704 wrote to memory of 3924 4704 ntnhhh.exe 103 PID 3924 wrote to memory of 4056 3924 ddppv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\21f540803536903cd73ffa714fcd3408_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\jvvpd.exec:\jvvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\rrlfffl.exec:\rrlfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nbthbn.exec:\nbthbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\jddjp.exec:\jddjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\ddjjp.exec:\ddjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\7httnt.exec:\7httnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hhhbtt.exec:\hhhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\dvdjp.exec:\dvdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\rxffxxx.exec:\rxffxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\xrrrffl.exec:\xrrrffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\bbbbbh.exec:\bbbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\tthbtt.exec:\tthbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vvddd.exec:\vvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\rxxxxrr.exec:\rxxxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\lrrrffl.exec:\lrrrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bttnhh.exec:\bttnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\dvjdp.exec:\dvjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xlflfff.exec:\xlflfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\ntnhhh.exec:\ntnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\ddppv.exec:\ddppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\xfrrxfr.exec:\xfrrxfr.exe23⤵
- Executes dropped EXE
PID:4056 -
\??\c:\1xffrxf.exec:\1xffrxf.exe24⤵
- Executes dropped EXE
PID:3408 -
\??\c:\nhnhbb.exec:\nhnhbb.exe25⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7jddp.exec:\7jddp.exe26⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vdppp.exec:\vdppp.exe27⤵
- Executes dropped EXE
PID:3328 -
\??\c:\frrrfff.exec:\frrrfff.exe28⤵
- Executes dropped EXE
PID:4244 -
\??\c:\tthtbt.exec:\tthtbt.exe29⤵
- Executes dropped EXE
PID:464 -
\??\c:\httbbh.exec:\httbbh.exe30⤵
- Executes dropped EXE
PID:3856 -
\??\c:\vdppj.exec:\vdppj.exe31⤵
- Executes dropped EXE
PID:2644 -
\??\c:\frxrxxx.exec:\frxrxxx.exe32⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nbhbhb.exec:\nbhbhb.exe33⤵
- Executes dropped EXE
PID:4428 -
\??\c:\bbhhbb.exec:\bbhhbb.exe34⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vjppj.exec:\vjppj.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jjpdd.exec:\jjpdd.exe36⤵
- Executes dropped EXE
PID:412 -
\??\c:\7lfflff.exec:\7lfflff.exe37⤵
- Executes dropped EXE
PID:4072 -
\??\c:\bhnnhh.exec:\bhnnhh.exe38⤵
- Executes dropped EXE
PID:4060 -
\??\c:\bhnbtt.exec:\bhnbtt.exe39⤵
- Executes dropped EXE
PID:4928 -
\??\c:\dpjjp.exec:\dpjjp.exe40⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pppdv.exec:\pppdv.exe41⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lrxrlrr.exec:\lrxrlrr.exe42⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hbttth.exec:\hbttth.exe43⤵
- Executes dropped EXE
PID:3672 -
\??\c:\dvpjp.exec:\dvpjp.exe44⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pjjvj.exec:\pjjvj.exe45⤵
- Executes dropped EXE
PID:3388 -
\??\c:\lflfrrl.exec:\lflfrrl.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxxrlll.exec:\xxxrlll.exe47⤵
- Executes dropped EXE
PID:3400 -
\??\c:\nhnhhh.exec:\nhnhhh.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hthbbb.exec:\hthbbb.exe49⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vjjjd.exec:\vjjjd.exe50⤵
- Executes dropped EXE
PID:4348 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe51⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ttnnnh.exec:\ttnnnh.exe52⤵
- Executes dropped EXE
PID:536 -
\??\c:\hnbbht.exec:\hnbbht.exe53⤵
- Executes dropped EXE
PID:384 -
\??\c:\pjpjp.exec:\pjpjp.exe54⤵
- Executes dropped EXE
PID:4636 -
\??\c:\jjvpj.exec:\jjvpj.exe55⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fllfxxr.exec:\fllfxxr.exe56⤵
- Executes dropped EXE
PID:2988 -
\??\c:\flxxrfx.exec:\flxxrfx.exe57⤵
- Executes dropped EXE
PID:3720 -
\??\c:\btnhbb.exec:\btnhbb.exe58⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vddvd.exec:\vddvd.exe59⤵
- Executes dropped EXE
PID:4944 -
\??\c:\dddvp.exec:\dddvp.exe60⤵
- Executes dropped EXE
PID:920 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe61⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hhhbtb.exec:\hhhbtb.exe62⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nhnnbh.exec:\nhnnbh.exe63⤵
- Executes dropped EXE
PID:3164 -
\??\c:\pjjdp.exec:\pjjdp.exe64⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3xlfxrl.exec:\3xlfxrl.exe65⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rfxrffx.exec:\rfxrffx.exe66⤵PID:2500
-
\??\c:\tnnnhn.exec:\tnnnhn.exe67⤵PID:1392
-
\??\c:\vjjpp.exec:\vjjpp.exe68⤵PID:4692
-
\??\c:\3vjjd.exec:\3vjjd.exe69⤵PID:3132
-
\??\c:\xlxrlxx.exec:\xlxrlxx.exe70⤵PID:3492
-
\??\c:\xxfffff.exec:\xxfffff.exe71⤵PID:3528
-
\??\c:\1bbbtt.exec:\1bbbtt.exe72⤵PID:5044
-
\??\c:\hbhbbt.exec:\hbhbbt.exe73⤵PID:3876
-
\??\c:\pjjdp.exec:\pjjdp.exe74⤵PID:3784
-
\??\c:\ddjdd.exec:\ddjdd.exe75⤵PID:4704
-
\??\c:\ffffxrr.exec:\ffffxrr.exe76⤵PID:4968
-
\??\c:\hhhhhn.exec:\hhhhhn.exe77⤵PID:2096
-
\??\c:\tbnnnt.exec:\tbnnnt.exe78⤵PID:2348
-
\??\c:\jdddd.exec:\jdddd.exe79⤵PID:4628
-
\??\c:\pjppp.exec:\pjppp.exe80⤵PID:4696
-
\??\c:\1fffxxr.exec:\1fffxxr.exe81⤵PID:3044
-
\??\c:\fllllll.exec:\fllllll.exe82⤵PID:3420
-
\??\c:\nhbbtb.exec:\nhbbtb.exe83⤵PID:3160
-
\??\c:\jppjd.exec:\jppjd.exe84⤵PID:5060
-
\??\c:\pjjjd.exec:\pjjjd.exe85⤵PID:4672
-
\??\c:\xfffllf.exec:\xfffllf.exe86⤵PID:1344
-
\??\c:\tntnhh.exec:\tntnhh.exe87⤵PID:1736
-
\??\c:\httnhh.exec:\httnhh.exe88⤵PID:1124
-
\??\c:\9ppjv.exec:\9ppjv.exe89⤵PID:3576
-
\??\c:\ddjdp.exec:\ddjdp.exe90⤵PID:1488
-
\??\c:\rfxxrxr.exec:\rfxxrxr.exe91⤵PID:2368
-
\??\c:\9ttnhn.exec:\9ttnhn.exe92⤵PID:3584
-
\??\c:\hthhbh.exec:\hthhbh.exe93⤵PID:2520
-
\??\c:\pppjd.exec:\pppjd.exe94⤵PID:956
-
\??\c:\ppppp.exec:\ppppp.exe95⤵PID:3520
-
\??\c:\xrllffl.exec:\xrllffl.exe96⤵PID:3792
-
\??\c:\tbhhbb.exec:\tbhhbb.exe97⤵PID:1916
-
\??\c:\hnnhbh.exec:\hnnhbh.exe98⤵PID:1580
-
\??\c:\dvdpj.exec:\dvdpj.exe99⤵PID:456
-
\??\c:\vvvpj.exec:\vvvpj.exe100⤵PID:3672
-
\??\c:\rrllllf.exec:\rrllllf.exe101⤵PID:2940
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe102⤵PID:3076
-
\??\c:\thnbbb.exec:\thnbbb.exe103⤵PID:2200
-
\??\c:\vjpjp.exec:\vjpjp.exe104⤵PID:4136
-
\??\c:\xfrlffx.exec:\xfrlffx.exe105⤵PID:2340
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe106⤵PID:4364
-
\??\c:\nthbtt.exec:\nthbtt.exe107⤵PID:3268
-
\??\c:\1ttnnt.exec:\1ttnnt.exe108⤵PID:1140
-
\??\c:\pjppd.exec:\pjppd.exe109⤵PID:3312
-
\??\c:\bbtnhb.exec:\bbtnhb.exe110⤵PID:5104
-
\??\c:\nhtnhh.exec:\nhtnhh.exe111⤵PID:2692
-
\??\c:\dppvp.exec:\dppvp.exe112⤵PID:2988
-
\??\c:\pjdvd.exec:\pjdvd.exe113⤵PID:4992
-
\??\c:\rflffff.exec:\rflffff.exe114⤵PID:3720
-
\??\c:\9tbbtb.exec:\9tbbtb.exe115⤵PID:2536
-
\??\c:\ttnnhn.exec:\ttnnhn.exe116⤵PID:3812
-
\??\c:\pjjjd.exec:\pjjjd.exe117⤵PID:4944
-
\??\c:\jjpjj.exec:\jjpjj.exe118⤵PID:920
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:3444
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe120⤵PID:4620
-
\??\c:\nnhhhn.exec:\nnhhhn.exe121⤵PID:440
-
\??\c:\btttnn.exec:\btttnn.exe122⤵PID:1948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-