Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe
-
Size
199KB
-
MD5
598c56f883d8ed4f300b2e83f82b579f
-
SHA1
30946e8880cb2c0d744f09dddde8618eaa44ae7d
-
SHA256
380f7a5bbe70d17421152eb207339b1210bdd3d3fc16eeb0d64d2ce5beb554a7
-
SHA512
bd8e77268dd4bf5363e6dd4e1fa19cc4d4c3c4285c8e03242b93a85e6fcb3b804084baf7a0f5215dabcd31cc17b7f0dd00c12e1131486e98455fbd75cf7259bf
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltJ:PhOm2sI93UufdC67cihvH1SG
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2856-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-257-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/744-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-535-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2016-573-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2520-625-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-664-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2220-673-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-714-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2808-715-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-796-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1852-814-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-985-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1200-996-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-1036-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdppp.exe7httnn.exeo200288.exe042066.exe420200.exebnbhnn.exehbntth.exexrlrflx.exe482428.exe0048440.exe08626.exepjvvd.exedvvjp.exe86040.exedvjjp.exe4806828.exehtnttb.exe6088040.exerlllrxf.exevpdjj.exetnbbhh.exea8624.exe864866.exe008684.exefxffllx.exe48064.exe082288.exexrrxllx.exe640628.exenbbthh.exeddvvd.exe08266.exe04246.exe4288880.exe862844.exenhbntt.exe5hbhtn.exebnbntb.exe1xrrfxf.exeppjjd.exe1dpvv.exe9bnntt.exec046440.exe480288.exevpdjv.exennbnbb.exetntttt.exe426288.exe046282.exefxrlffl.exe1xrflfr.exe9jjpj.exe26842.exevjddd.exeddpjd.exes8222.exe6066828.exeffrrffl.exe3pjvj.exehnnhht.exevjvdj.exe20262.exe6428682.exehbbnnn.exepid process 2508 jdppp.exe 2332 7httnn.exe 2568 o200288.exe 2724 042066.exe 2552 420200.exe 2588 bnbhnn.exe 2208 hbntth.exe 2736 xrlrflx.exe 2492 482428.exe 2972 0048440.exe 2608 08626.exe 2784 pjvvd.exe 2824 dvvjp.exe 2148 86040.exe 812 dvjjp.exe 1044 4806828.exe 1072 htnttb.exe 2624 6088040.exe 1636 rlllrxf.exe 1284 vpdjj.exe 1364 tnbbhh.exe 1104 a8624.exe 588 864866.exe 1808 008684.exe 448 fxffllx.exe 2072 48064.exe 1536 082288.exe 1608 xrrxllx.exe 2408 640628.exe 1368 nbbthh.exe 1944 ddvvd.exe 744 08266.exe 892 04246.exe 2344 4288880.exe 1620 862844.exe 2340 nhbntt.exe 2520 5hbhtn.exe 2576 bnbntb.exe 2708 1xrrfxf.exe 2560 ppjjd.exe 2616 1dpvv.exe 2580 9bnntt.exe 2596 c046440.exe 2796 480288.exe 2220 vpdjv.exe 2976 nnbnbb.exe 3024 tntttt.exe 2628 426288.exe 2804 046282.exe 1796 fxrlffl.exe 888 1xrflfr.exe 1376 9jjpj.exe 2952 26842.exe 1836 vjddd.exe 812 ddpjd.exe 2984 s8222.exe 1812 6066828.exe 2624 ffrrffl.exe 2056 3pjvj.exe 2896 hnnhht.exe 668 vjvdj.exe 532 20262.exe 1104 6428682.exe 816 hbbnnn.exe -
Processes:
resource yara_rule behavioral1/memory/2856-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/744-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-439-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-478-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-485-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-492-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-625-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-673-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-714-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2808-715-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-728-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-748-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-761-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-780-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-793-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-814-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-833-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-846-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-859-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-872-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-885-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-907-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-932-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-957-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-970-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-996-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-1010-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-1023-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-1043-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-1062-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exejdppp.exe7httnn.exeo200288.exe042066.exe420200.exebnbhnn.exehbntth.exexrlrflx.exe482428.exe0048440.exe08626.exepjvvd.exedvvjp.exe86040.exedvjjp.exedescription pid process target process PID 2856 wrote to memory of 2508 2856 598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe jdppp.exe PID 2856 wrote to memory of 2508 2856 598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe jdppp.exe PID 2856 wrote to memory of 2508 2856 598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe jdppp.exe PID 2856 wrote to memory of 2508 2856 598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe jdppp.exe PID 2508 wrote to memory of 2332 2508 jdppp.exe 7httnn.exe PID 2508 wrote to memory of 2332 2508 jdppp.exe 7httnn.exe PID 2508 wrote to memory of 2332 2508 jdppp.exe 7httnn.exe PID 2508 wrote to memory of 2332 2508 jdppp.exe 7httnn.exe PID 2332 wrote to memory of 2568 2332 7httnn.exe o200288.exe PID 2332 wrote to memory of 2568 2332 7httnn.exe o200288.exe PID 2332 wrote to memory of 2568 2332 7httnn.exe o200288.exe PID 2332 wrote to memory of 2568 2332 7httnn.exe o200288.exe PID 2568 wrote to memory of 2724 2568 o200288.exe 042066.exe PID 2568 wrote to memory of 2724 2568 o200288.exe 042066.exe PID 2568 wrote to memory of 2724 2568 o200288.exe 042066.exe PID 2568 wrote to memory of 2724 2568 o200288.exe 042066.exe PID 2724 wrote to memory of 2552 2724 042066.exe 420200.exe PID 2724 wrote to memory of 2552 2724 042066.exe 420200.exe PID 2724 wrote to memory of 2552 2724 042066.exe 420200.exe PID 2724 wrote to memory of 2552 2724 042066.exe 420200.exe PID 2552 wrote to memory of 2588 2552 420200.exe bnbhnn.exe PID 2552 wrote to memory of 2588 2552 420200.exe bnbhnn.exe PID 2552 wrote to memory of 2588 2552 420200.exe bnbhnn.exe PID 2552 wrote to memory of 2588 2552 420200.exe bnbhnn.exe PID 2588 wrote to memory of 2208 2588 bnbhnn.exe hbntth.exe PID 2588 wrote to memory of 2208 2588 bnbhnn.exe hbntth.exe PID 2588 wrote to memory of 2208 2588 bnbhnn.exe hbntth.exe PID 2588 wrote to memory of 2208 2588 bnbhnn.exe hbntth.exe PID 2208 wrote to memory of 2736 2208 hbntth.exe xrlrflx.exe PID 2208 wrote to memory of 2736 2208 hbntth.exe xrlrflx.exe PID 2208 wrote to memory of 2736 2208 hbntth.exe xrlrflx.exe PID 2208 wrote to memory of 2736 2208 hbntth.exe xrlrflx.exe PID 2736 wrote to memory of 2492 2736 xrlrflx.exe 482428.exe PID 2736 wrote to memory of 2492 2736 xrlrflx.exe 482428.exe PID 2736 wrote to memory of 2492 2736 xrlrflx.exe 482428.exe PID 2736 wrote to memory of 2492 2736 xrlrflx.exe 482428.exe PID 2492 wrote to memory of 2972 2492 482428.exe 0048440.exe PID 2492 wrote to memory of 2972 2492 482428.exe 0048440.exe PID 2492 wrote to memory of 2972 2492 482428.exe 0048440.exe PID 2492 wrote to memory of 2972 2492 482428.exe 0048440.exe PID 2972 wrote to memory of 2608 2972 0048440.exe 08626.exe PID 2972 wrote to memory of 2608 2972 0048440.exe 08626.exe PID 2972 wrote to memory of 2608 2972 0048440.exe 08626.exe PID 2972 wrote to memory of 2608 2972 0048440.exe 08626.exe PID 2608 wrote to memory of 2784 2608 08626.exe pjvvd.exe PID 2608 wrote to memory of 2784 2608 08626.exe pjvvd.exe PID 2608 wrote to memory of 2784 2608 08626.exe pjvvd.exe PID 2608 wrote to memory of 2784 2608 08626.exe pjvvd.exe PID 2784 wrote to memory of 2824 2784 pjvvd.exe dvvjp.exe PID 2784 wrote to memory of 2824 2784 pjvvd.exe dvvjp.exe PID 2784 wrote to memory of 2824 2784 pjvvd.exe dvvjp.exe PID 2784 wrote to memory of 2824 2784 pjvvd.exe dvvjp.exe PID 2824 wrote to memory of 2148 2824 dvvjp.exe 86040.exe PID 2824 wrote to memory of 2148 2824 dvvjp.exe 86040.exe PID 2824 wrote to memory of 2148 2824 dvvjp.exe 86040.exe PID 2824 wrote to memory of 2148 2824 dvvjp.exe 86040.exe PID 2148 wrote to memory of 812 2148 86040.exe dvjjp.exe PID 2148 wrote to memory of 812 2148 86040.exe dvjjp.exe PID 2148 wrote to memory of 812 2148 86040.exe dvjjp.exe PID 2148 wrote to memory of 812 2148 86040.exe dvjjp.exe PID 812 wrote to memory of 1044 812 dvjjp.exe 4806828.exe PID 812 wrote to memory of 1044 812 dvjjp.exe 4806828.exe PID 812 wrote to memory of 1044 812 dvjjp.exe 4806828.exe PID 812 wrote to memory of 1044 812 dvjjp.exe 4806828.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\598c56f883d8ed4f300b2e83f82b579f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jdppp.exec:\jdppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\7httnn.exec:\7httnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\o200288.exec:\o200288.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\042066.exec:\042066.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\420200.exec:\420200.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bnbhnn.exec:\bnbhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbntth.exec:\hbntth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xrlrflx.exec:\xrlrflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\482428.exec:\482428.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\0048440.exec:\0048440.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\08626.exec:\08626.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pjvvd.exec:\pjvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\dvvjp.exec:\dvvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\86040.exec:\86040.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dvjjp.exec:\dvjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\4806828.exec:\4806828.exe17⤵
- Executes dropped EXE
PID:1044 -
\??\c:\htnttb.exec:\htnttb.exe18⤵
- Executes dropped EXE
PID:1072 -
\??\c:\6088040.exec:\6088040.exe19⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rlllrxf.exec:\rlllrxf.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vpdjj.exec:\vpdjj.exe21⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tnbbhh.exec:\tnbbhh.exe22⤵
- Executes dropped EXE
PID:1364 -
\??\c:\a8624.exec:\a8624.exe23⤵
- Executes dropped EXE
PID:1104 -
\??\c:\864866.exec:\864866.exe24⤵
- Executes dropped EXE
PID:588 -
\??\c:\008684.exec:\008684.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxffllx.exec:\fxffllx.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\48064.exec:\48064.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\082288.exec:\082288.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xrrxllx.exec:\xrrxllx.exe29⤵
- Executes dropped EXE
PID:1608 -
\??\c:\640628.exec:\640628.exe30⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nbbthh.exec:\nbbthh.exe31⤵
- Executes dropped EXE
PID:1368 -
\??\c:\ddvvd.exec:\ddvvd.exe32⤵
- Executes dropped EXE
PID:1944 -
\??\c:\08266.exec:\08266.exe33⤵
- Executes dropped EXE
PID:744 -
\??\c:\04246.exec:\04246.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\4288880.exec:\4288880.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\862844.exec:\862844.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ffrlrfr.exec:\ffrlrfr.exe37⤵PID:1984
-
\??\c:\nhbntt.exec:\nhbntt.exe38⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5hbhtn.exec:\5hbhtn.exe39⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bnbntb.exec:\bnbntb.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1xrrfxf.exec:\1xrrfxf.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ppjjd.exec:\ppjjd.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1dpvv.exec:\1dpvv.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9bnntt.exec:\9bnntt.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\c046440.exec:\c046440.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\480288.exec:\480288.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpdjv.exec:\vpdjv.exe47⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nnbnbb.exec:\nnbnbb.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tntttt.exec:\tntttt.exe49⤵
- Executes dropped EXE
PID:3024 -
\??\c:\426288.exec:\426288.exe50⤵
- Executes dropped EXE
PID:2628 -
\??\c:\046282.exec:\046282.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\fxrlffl.exec:\fxrlffl.exe52⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1xrflfr.exec:\1xrflfr.exe53⤵
- Executes dropped EXE
PID:888 -
\??\c:\9jjpj.exec:\9jjpj.exe54⤵
- Executes dropped EXE
PID:1376 -
\??\c:\26842.exec:\26842.exe55⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vjddd.exec:\vjddd.exe56⤵
- Executes dropped EXE
PID:1836 -
\??\c:\ddpjd.exec:\ddpjd.exe57⤵
- Executes dropped EXE
PID:812 -
\??\c:\s8222.exec:\s8222.exe58⤵
- Executes dropped EXE
PID:2984 -
\??\c:\6066828.exec:\6066828.exe59⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ffrrffl.exec:\ffrrffl.exe60⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3pjvj.exec:\3pjvj.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hnnhht.exec:\hnnhht.exe62⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vjvdj.exec:\vjvdj.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\20262.exec:\20262.exe64⤵
- Executes dropped EXE
PID:532 -
\??\c:\6428682.exec:\6428682.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\hbbnnn.exec:\hbbnnn.exe66⤵
- Executes dropped EXE
PID:816 -
\??\c:\thtthb.exec:\thtthb.exe67⤵PID:2384
-
\??\c:\5ththn.exec:\5ththn.exe68⤵PID:2236
-
\??\c:\rflfffl.exec:\rflfffl.exe69⤵PID:2076
-
\??\c:\628846.exec:\628846.exe70⤵PID:1388
-
\??\c:\c042440.exec:\c042440.exe71⤵PID:2016
-
\??\c:\1tnnbh.exec:\1tnnbh.exe72⤵PID:1712
-
\??\c:\642622.exec:\642622.exe73⤵PID:1868
-
\??\c:\1hbbhh.exec:\1hbbhh.exe74⤵PID:2136
-
\??\c:\3hbhhb.exec:\3hbhhb.exe75⤵PID:624
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe76⤵PID:2164
-
\??\c:\nnttht.exec:\nnttht.exe77⤵PID:2068
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe78⤵PID:2264
-
\??\c:\602484.exec:\602484.exe79⤵PID:1700
-
\??\c:\1fllrrf.exec:\1fllrrf.exe80⤵PID:2932
-
\??\c:\c020402.exec:\c020402.exe81⤵PID:868
-
\??\c:\w64800.exec:\w64800.exe82⤵PID:2160
-
\??\c:\g6426.exec:\g6426.exe83⤵PID:2612
-
\??\c:\vjddd.exec:\vjddd.exe84⤵PID:1648
-
\??\c:\c462002.exec:\c462002.exe85⤵PID:2520
-
\??\c:\u088062.exec:\u088062.exe86⤵PID:2752
-
\??\c:\vjvpd.exec:\vjvpd.exe87⤵PID:2700
-
\??\c:\pdjdp.exec:\pdjdp.exe88⤵PID:2588
-
\??\c:\djpjd.exec:\djpjd.exe89⤵PID:2616
-
\??\c:\5tbtbb.exec:\5tbtbb.exe90⤵PID:2572
-
\??\c:\q82206.exec:\q82206.exe91⤵PID:2736
-
\??\c:\5pjjj.exec:\5pjjj.exe92⤵PID:2548
-
\??\c:\djdjp.exec:\djdjp.exe93⤵PID:2220
-
\??\c:\rrfrfrx.exec:\rrfrfrx.exe94⤵PID:2864
-
\??\c:\6446680.exec:\6446680.exe95⤵PID:3024
-
\??\c:\xrflllx.exec:\xrflllx.exe96⤵PID:2516
-
\??\c:\3nhnhn.exec:\3nhnhn.exe97⤵PID:2640
-
\??\c:\606806.exec:\606806.exe98⤵PID:2840
-
\??\c:\xrlrffl.exec:\xrlrffl.exe99⤵PID:2808
-
\??\c:\vvjvj.exec:\vvjvj.exe100⤵PID:2240
-
\??\c:\046684.exec:\046684.exe101⤵PID:1956
-
\??\c:\3jdjd.exec:\3jdjd.exe102⤵PID:1792
-
\??\c:\xxflrxl.exec:\xxflrxl.exe103⤵PID:2660
-
\??\c:\5hbhnn.exec:\5hbhnn.exe104⤵PID:1616
-
\??\c:\bnhntb.exec:\bnhntb.exe105⤵PID:1672
-
\??\c:\pjvpv.exec:\pjvpv.exe106⤵PID:2080
-
\??\c:\s2662.exec:\s2662.exe107⤵PID:2680
-
\??\c:\nhttnn.exec:\nhttnn.exe108⤵PID:580
-
\??\c:\a4288.exec:\a4288.exe109⤵PID:1028
-
\??\c:\486060.exec:\486060.exe110⤵PID:532
-
\??\c:\nhhhbh.exec:\nhhhbh.exe111⤵PID:1500
-
\??\c:\82280.exec:\82280.exe112⤵PID:816
-
\??\c:\c862224.exec:\c862224.exe113⤵PID:1252
-
\??\c:\s2008.exec:\s2008.exe114⤵PID:1852
-
\??\c:\2088402.exec:\2088402.exe115⤵PID:2252
-
\??\c:\1rxlffr.exec:\1rxlffr.exe116⤵PID:956
-
\??\c:\3hbhbh.exec:\3hbhbh.exe117⤵PID:1324
-
\??\c:\3hhhhh.exec:\3hhhhh.exe118⤵PID:1644
-
\??\c:\bnbbnn.exec:\bnbbnn.exe119⤵PID:400
-
\??\c:\2608006.exec:\2608006.exe120⤵PID:2860
-
\??\c:\htbhnb.exec:\htbhnb.exe121⤵PID:2192
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe122⤵PID:2352
-
\??\c:\5bnnnt.exec:\5bnnnt.exe123⤵PID:1708
-
\??\c:\rlxxllr.exec:\rlxxllr.exe124⤵PID:1968
-
\??\c:\hbtbnn.exec:\hbtbnn.exe125⤵PID:2344
-
\??\c:\hhbbtt.exec:\hhbbtt.exe126⤵PID:1456
-
\??\c:\rlflxxl.exec:\rlflxxl.exe127⤵PID:1620
-
\??\c:\26406.exec:\26406.exe128⤵PID:1244
-
\??\c:\e04462.exec:\e04462.exe129⤵PID:3068
-
\??\c:\202488.exec:\202488.exe130⤵PID:2556
-
\??\c:\btbhtb.exec:\btbhtb.exe131⤵PID:2880
-
\??\c:\hbbttt.exec:\hbbttt.exe132⤵PID:2728
-
\??\c:\lfrxfxf.exec:\lfrxfxf.exe133⤵PID:2696
-
\??\c:\ddppv.exec:\ddppv.exe134⤵PID:1000
-
\??\c:\thtbhh.exec:\thtbhh.exe135⤵PID:2424
-
\??\c:\pjddj.exec:\pjddj.exe136⤵PID:2452
-
\??\c:\vpvvd.exec:\vpvvd.exe137⤵PID:2476
-
\??\c:\xrflxxf.exec:\xrflxxf.exe138⤵PID:2480
-
\??\c:\64006.exec:\64006.exe139⤵PID:2672
-
\??\c:\k08866.exec:\k08866.exe140⤵PID:2864
-
\??\c:\9vjjj.exec:\9vjjj.exe141⤵PID:2620
-
\??\c:\4200662.exec:\4200662.exe142⤵PID:804
-
\??\c:\c840624.exec:\c840624.exe143⤵PID:840
-
\??\c:\4800284.exec:\4800284.exe144⤵PID:1200
-
\??\c:\djjpp.exec:\djjpp.exe145⤵PID:1744
-
\??\c:\2066624.exec:\2066624.exe146⤵PID:2240
-
\??\c:\080800.exec:\080800.exe147⤵PID:2528
-
\??\c:\1jvpp.exec:\1jvpp.exe148⤵PID:2496
-
\??\c:\i026606.exec:\i026606.exe149⤵PID:1812
-
\??\c:\688460.exec:\688460.exe150⤵PID:1540
-
\??\c:\q02440.exec:\q02440.exe151⤵PID:2892
-
\??\c:\w40622.exec:\w40622.exe152⤵PID:324
-
\??\c:\pjdpv.exec:\pjdpv.exe153⤵PID:668
-
\??\c:\ffrllrl.exec:\ffrllrl.exe154⤵PID:1160
-
\??\c:\0804006.exec:\0804006.exe155⤵PID:948
-
\??\c:\dvpdj.exec:\dvpdj.exe156⤵PID:636
-
\??\c:\vjdvp.exec:\vjdvp.exe157⤵PID:2844
-
\??\c:\s6882.exec:\s6882.exe158⤵PID:1088
-
\??\c:\5jdjv.exec:\5jdjv.exe159⤵PID:2032
-
\??\c:\i684666.exec:\i684666.exe160⤵PID:1852
-
\??\c:\5pdpj.exec:\5pdpj.exe161⤵PID:760
-
\??\c:\020688.exec:\020688.exe162⤵PID:1872
-
\??\c:\20820.exec:\20820.exe163⤵PID:608
-
\??\c:\htbhbb.exec:\htbhbb.exe164⤵PID:2116
-
\??\c:\q46640.exec:\q46640.exe165⤵PID:2156
-
\??\c:\q46688.exec:\q46688.exe166⤵PID:2860
-
\??\c:\btbhtb.exec:\btbhtb.exe167⤵PID:2068
-
\??\c:\486088.exec:\486088.exe168⤵PID:2352
-
\??\c:\htbhbb.exec:\htbhbb.exe169⤵PID:1708
-
\??\c:\7tbtbt.exec:\7tbtbt.exe170⤵PID:1968
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe171⤵PID:2344
-
\??\c:\rlfllrx.exec:\rlfllrx.exe172⤵PID:2224
-
\??\c:\m0228.exec:\m0228.exe173⤵PID:2144
-
\??\c:\o688400.exec:\o688400.exe174⤵PID:2392
-
\??\c:\0844662.exec:\0844662.exe175⤵PID:2520
-
\??\c:\4206862.exec:\4206862.exe176⤵PID:1320
-
\??\c:\a0868.exec:\a0868.exe177⤵PID:2296
-
\??\c:\e64882.exec:\e64882.exe178⤵PID:552
-
\??\c:\rflxfxf.exec:\rflxfxf.exe179⤵PID:2584
-
\??\c:\0844640.exec:\0844640.exe180⤵PID:2592
-
\??\c:\bthhhb.exec:\bthhhb.exe181⤵PID:2740
-
\??\c:\jvppj.exec:\jvppj.exe182⤵PID:2456
-
\??\c:\e08026.exec:\e08026.exe183⤵PID:2500
-
\??\c:\8200266.exec:\8200266.exe184⤵PID:1280
-
\??\c:\64224.exec:\64224.exe185⤵PID:3032
-
\??\c:\i644440.exec:\i644440.exe186⤵PID:2756
-
\??\c:\1rxxxxf.exec:\1rxxxxf.exe187⤵PID:2864
-
\??\c:\9djpd.exec:\9djpd.exe188⤵PID:2816
-
\??\c:\1bhbbt.exec:\1bhbbt.exe189⤵PID:2228
-
\??\c:\g2624.exec:\g2624.exe190⤵PID:2488
-
\??\c:\8688844.exec:\8688844.exe191⤵PID:1200
-
\??\c:\q80404.exec:\q80404.exe192⤵PID:1744
-
\??\c:\5nbntb.exec:\5nbntb.exe193⤵PID:1740
-
\??\c:\9jppj.exec:\9jppj.exe194⤵PID:2028
-
\??\c:\rlxffff.exec:\rlxffff.exe195⤵PID:2652
-
\??\c:\g6064.exec:\g6064.exe196⤵PID:1624
-
\??\c:\486204.exec:\486204.exe197⤵PID:1576
-
\??\c:\dpppd.exec:\dpppd.exe198⤵PID:2848
-
\??\c:\tnnhnn.exec:\tnnhnn.exe199⤵PID:2680
-
\??\c:\080622.exec:\080622.exe200⤵PID:1288
-
\??\c:\68402.exec:\68402.exe201⤵PID:1680
-
\??\c:\646004.exec:\646004.exe202⤵PID:1104
-
\??\c:\pjppp.exec:\pjppp.exe203⤵PID:1772
-
\??\c:\2466000.exec:\2466000.exe204⤵PID:2236
-
\??\c:\424406.exec:\424406.exe205⤵PID:1088
-
\??\c:\7frxxxx.exec:\7frxxxx.exe206⤵PID:672
-
\??\c:\k68062.exec:\k68062.exe207⤵PID:1172
-
\??\c:\dddpv.exec:\dddpv.exe208⤵PID:1864
-
\??\c:\o466280.exec:\o466280.exe209⤵PID:2900
-
\??\c:\4688440.exec:\4688440.exe210⤵PID:916
-
\??\c:\q46244.exec:\q46244.exe211⤵PID:2116
-
\??\c:\4888444.exec:\4888444.exe212⤵PID:764
-
\??\c:\thbhtt.exec:\thbhtt.exe213⤵PID:1756
-
\??\c:\20068.exec:\20068.exe214⤵PID:2196
-
\??\c:\frfflfl.exec:\frfflfl.exe215⤵PID:1516
-
\??\c:\684844.exec:\684844.exe216⤵PID:1568
-
\??\c:\dpvvd.exec:\dpvvd.exe217⤵PID:1968
-
\??\c:\4860228.exec:\4860228.exe218⤵PID:1600
-
\??\c:\tbhbbh.exec:\tbhbbh.exe219⤵PID:2764
-
\??\c:\4248406.exec:\4248406.exe220⤵PID:2144
-
\??\c:\frfflll.exec:\frfflll.exe221⤵PID:2052
-
\??\c:\862228.exec:\862228.exe222⤵PID:2288
-
\??\c:\pdvvp.exec:\pdvvp.exe223⤵PID:2704
-
\??\c:\26440.exec:\26440.exe224⤵PID:2880
-
\??\c:\024484.exec:\024484.exe225⤵PID:2464
-
\??\c:\6088402.exec:\6088402.exe226⤵PID:2588
-
\??\c:\dpvjv.exec:\dpvjv.exe227⤵PID:2440
-
\??\c:\xxflxrr.exec:\xxflxrr.exe228⤵PID:2820
-
\??\c:\208644.exec:\208644.exe229⤵PID:2448
-
\??\c:\8088044.exec:\8088044.exe230⤵PID:2316
-
\??\c:\9ddpd.exec:\9ddpd.exe231⤵PID:2220
-
\??\c:\3hhhtt.exec:\3hhhtt.exe232⤵PID:2968
-
\??\c:\608462.exec:\608462.exe233⤵PID:3024
-
\??\c:\86002.exec:\86002.exe234⤵PID:2636
-
\??\c:\jdpvp.exec:\jdpvp.exe235⤵PID:2944
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe236⤵PID:2812
-
\??\c:\jdvdj.exec:\jdvdj.exe237⤵PID:888
-
\??\c:\20222.exec:\20222.exe238⤵PID:612
-
\??\c:\rlxxlrr.exec:\rlxxlrr.exe239⤵PID:1044
-
\??\c:\btbbhn.exec:\btbbhn.exe240⤵PID:1744
-
\??\c:\20880.exec:\20880.exe241⤵PID:1740
-
\??\c:\ththhn.exec:\ththhn.exe242⤵PID:2528