Analysis
-
max time kernel
124s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
055b570b5c7c648baf774447328297e1_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
055b570b5c7c648baf774447328297e1_JaffaCakes118.exe
-
Size
95KB
-
MD5
055b570b5c7c648baf774447328297e1
-
SHA1
c49a53c4b7a031248219b8640ffd3fc88ff9f8d5
-
SHA256
0b3cba31373ae4c648184dd7433c5b24a91b966a1076a227d32e6a1a417fea2c
-
SHA512
df0bc2317114ee4772375e7a0ab99110868b44b191adb6bdd9fdfbbbd2e33aebf9ddabca83081989f73ecdd066c32b4ed2082c731e7d38316ea3a28f6c992092
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzNmNMvVjoq:ymb3NkkiQ3mdBjF+3TYzvTt8q
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1596-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4188 jjvjv.exe 748 rxllfxx.exe 1596 tbhhhb.exe 1560 ddjdd.exe 2128 rlrxfll.exe 2004 tnnhtt.exe 5036 pjvvv.exe 2992 7frlllx.exe 2656 xfrrxxx.exe 544 ntbnbt.exe 4520 dpjdp.exe 2068 flffxfl.exe 1184 fllfrxr.exe 4924 nttbnt.exe 4692 vpvpd.exe 1284 rxfrlfr.exe 3560 rfxxrxf.exe 1012 tbtttn.exe 4972 1djdd.exe 1608 djpvv.exe 3880 xlrrxfl.exe 1344 nnbttb.exe 4908 hhnnhn.exe 4052 jpddp.exe 1128 3dpjj.exe 2592 fxrffll.exe 2876 ttnbnb.exe 1028 nbbnbh.exe 1496 jppjd.exe 3156 fffffll.exe 3640 bbthbb.exe 4120 djvvv.exe 4344 vdpjd.exe 3456 rlxfflr.exe 3044 1rxxxxx.exe 4416 bntttt.exe 5092 3vddj.exe 1468 5pjjj.exe 4788 rxflfll.exe 64 3hnttb.exe 2128 hhbtth.exe 5040 dvjvv.exe 468 frxlrfr.exe 5036 llrfrrl.exe 4564 htbbtb.exe 4324 dvjjd.exe 4288 ppvpv.exe 4032 hhnbtt.exe 2068 bnhbbb.exe 4888 dddpj.exe 4580 fflfxfx.exe 376 btttbn.exe 1172 tnbthb.exe 3116 vpddp.exe 1564 xxffffl.exe 1860 rlfrfxl.exe 2260 hbbttt.exe 2080 vvdpj.exe 972 pvdvj.exe 3304 xfxrlff.exe 2984 rxrlxxl.exe 3716 nbhnhh.exe 1124 vdvvd.exe 2664 vvvpj.exe -
resource yara_rule behavioral2/memory/1596-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1036 wrote to memory of 4188 1036 055b570b5c7c648baf774447328297e1_JaffaCakes118.exe 86 PID 1036 wrote to memory of 4188 1036 055b570b5c7c648baf774447328297e1_JaffaCakes118.exe 86 PID 1036 wrote to memory of 4188 1036 055b570b5c7c648baf774447328297e1_JaffaCakes118.exe 86 PID 4188 wrote to memory of 748 4188 jjvjv.exe 87 PID 4188 wrote to memory of 748 4188 jjvjv.exe 87 PID 4188 wrote to memory of 748 4188 jjvjv.exe 87 PID 748 wrote to memory of 1596 748 rxllfxx.exe 88 PID 748 wrote to memory of 1596 748 rxllfxx.exe 88 PID 748 wrote to memory of 1596 748 rxllfxx.exe 88 PID 1596 wrote to memory of 1560 1596 tbhhhb.exe 89 PID 1596 wrote to memory of 1560 1596 tbhhhb.exe 89 PID 1596 wrote to memory of 1560 1596 tbhhhb.exe 89 PID 1560 wrote to memory of 2128 1560 ddjdd.exe 90 PID 1560 wrote to memory of 2128 1560 ddjdd.exe 90 PID 1560 wrote to memory of 2128 1560 ddjdd.exe 90 PID 2128 wrote to memory of 2004 2128 rlrxfll.exe 268 PID 2128 wrote to memory of 2004 2128 rlrxfll.exe 268 PID 2128 wrote to memory of 2004 2128 rlrxfll.exe 268 PID 2004 wrote to memory of 5036 2004 tnnhtt.exe 92 PID 2004 wrote to memory of 5036 2004 tnnhtt.exe 92 PID 2004 wrote to memory of 5036 2004 tnnhtt.exe 92 PID 5036 wrote to memory of 2992 5036 pjvvv.exe 93 PID 5036 wrote to memory of 2992 5036 pjvvv.exe 93 PID 5036 wrote to memory of 2992 5036 pjvvv.exe 93 PID 2992 wrote to memory of 2656 2992 7frlllx.exe 94 PID 2992 wrote to memory of 2656 2992 7frlllx.exe 94 PID 2992 wrote to memory of 2656 2992 7frlllx.exe 94 PID 2656 wrote to memory of 544 2656 xfrrxxx.exe 95 PID 2656 wrote to memory of 544 2656 xfrrxxx.exe 95 PID 2656 wrote to memory of 544 2656 xfrrxxx.exe 95 PID 544 wrote to memory of 4520 544 ntbnbt.exe 96 PID 544 wrote to memory of 4520 544 ntbnbt.exe 96 PID 544 wrote to memory of 4520 544 ntbnbt.exe 96 PID 4520 wrote to memory of 2068 4520 dpjdp.exe 97 PID 4520 wrote to memory of 2068 4520 dpjdp.exe 97 PID 4520 wrote to memory of 2068 4520 dpjdp.exe 97 PID 2068 wrote to memory of 1184 2068 flffxfl.exe 99 PID 2068 wrote to memory of 1184 2068 flffxfl.exe 99 PID 2068 wrote to memory of 1184 2068 flffxfl.exe 99 PID 1184 wrote to memory of 4924 1184 fllfrxr.exe 100 PID 1184 wrote to memory of 4924 1184 fllfrxr.exe 100 PID 1184 wrote to memory of 4924 1184 fllfrxr.exe 100 PID 4924 wrote to memory of 4692 4924 nttbnt.exe 101 PID 4924 wrote to memory of 4692 4924 nttbnt.exe 101 PID 4924 wrote to memory of 4692 4924 nttbnt.exe 101 PID 4692 wrote to memory of 1284 4692 vpvpd.exe 103 PID 4692 wrote to memory of 1284 4692 vpvpd.exe 103 PID 4692 wrote to memory of 1284 4692 vpvpd.exe 103 PID 1284 wrote to memory of 3560 1284 rxfrlfr.exe 104 PID 1284 wrote to memory of 3560 1284 rxfrlfr.exe 104 PID 1284 wrote to memory of 3560 1284 rxfrlfr.exe 104 PID 3560 wrote to memory of 1012 3560 rfxxrxf.exe 105 PID 3560 wrote to memory of 1012 3560 rfxxrxf.exe 105 PID 3560 wrote to memory of 1012 3560 rfxxrxf.exe 105 PID 1012 wrote to memory of 4972 1012 tbtttn.exe 106 PID 1012 wrote to memory of 4972 1012 tbtttn.exe 106 PID 1012 wrote to memory of 4972 1012 tbtttn.exe 106 PID 4972 wrote to memory of 1608 4972 1djdd.exe 108 PID 4972 wrote to memory of 1608 4972 1djdd.exe 108 PID 4972 wrote to memory of 1608 4972 1djdd.exe 108 PID 1608 wrote to memory of 3880 1608 djpvv.exe 109 PID 1608 wrote to memory of 3880 1608 djpvv.exe 109 PID 1608 wrote to memory of 3880 1608 djpvv.exe 109 PID 3880 wrote to memory of 1344 3880 xlrrxfl.exe 110
Processes
-
C:\Windows\system32\usoclient.exeC:\Windows\system32\usoclient.exe StartScan1⤵PID:2760
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\055b570b5c7c648baf774447328297e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\055b570b5c7c648baf774447328297e1_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\jjvjv.exec:\jjvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\rxllfxx.exec:\rxllfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\tbhhhb.exec:\tbhhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\ddjdd.exec:\ddjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\rlrxfll.exec:\rlrxfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\tnnhtt.exec:\tnnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pjvvv.exec:\pjvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\7frlllx.exec:\7frlllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xfrrxxx.exec:\xfrrxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ntbnbt.exec:\ntbnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\dpjdp.exec:\dpjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\flffxfl.exec:\flffxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\fllfrxr.exec:\fllfrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\nttbnt.exec:\nttbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\vpvpd.exec:\vpvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\rxfrlfr.exec:\rxfrlfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\rfxxrxf.exec:\rfxxrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\tbtttn.exec:\tbtttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\1djdd.exec:\1djdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\djpvv.exec:\djpvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\xlrrxfl.exec:\xlrrxfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\nnbttb.exec:\nnbttb.exe23⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hhnnhn.exec:\hhnnhn.exe24⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jpddp.exec:\jpddp.exe25⤵
- Executes dropped EXE
PID:4052 -
\??\c:\3dpjj.exec:\3dpjj.exe26⤵
- Executes dropped EXE
PID:1128 -
\??\c:\fxrffll.exec:\fxrffll.exe27⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ttnbnb.exec:\ttnbnb.exe28⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nbbnbh.exec:\nbbnbh.exe29⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jppjd.exec:\jppjd.exe30⤵
- Executes dropped EXE
PID:1496 -
\??\c:\fffffll.exec:\fffffll.exe31⤵
- Executes dropped EXE
PID:3156 -
\??\c:\bbthbb.exec:\bbthbb.exe32⤵
- Executes dropped EXE
PID:3640 -
\??\c:\djvvv.exec:\djvvv.exe33⤵
- Executes dropped EXE
PID:4120 -
\??\c:\vdpjd.exec:\vdpjd.exe34⤵
- Executes dropped EXE
PID:4344 -
\??\c:\rlxfflr.exec:\rlxfflr.exe35⤵
- Executes dropped EXE
PID:3456 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bntttt.exec:\bntttt.exe37⤵
- Executes dropped EXE
PID:4416 -
\??\c:\3vddj.exec:\3vddj.exe38⤵
- Executes dropped EXE
PID:5092 -
\??\c:\5pjjj.exec:\5pjjj.exe39⤵
- Executes dropped EXE
PID:1468 -
\??\c:\rxflfll.exec:\rxflfll.exe40⤵
- Executes dropped EXE
PID:4788 -
\??\c:\3hnttb.exec:\3hnttb.exe41⤵
- Executes dropped EXE
PID:64 -
\??\c:\hhbtth.exec:\hhbtth.exe42⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dvjvv.exec:\dvjvv.exe43⤵
- Executes dropped EXE
PID:5040 -
\??\c:\frxlrfr.exec:\frxlrfr.exe44⤵
- Executes dropped EXE
PID:468 -
\??\c:\llrfrrl.exec:\llrfrrl.exe45⤵
- Executes dropped EXE
PID:5036 -
\??\c:\htbbtb.exec:\htbbtb.exe46⤵
- Executes dropped EXE
PID:4564 -
\??\c:\dvjjd.exec:\dvjjd.exe47⤵
- Executes dropped EXE
PID:4324 -
\??\c:\ppvpv.exec:\ppvpv.exe48⤵
- Executes dropped EXE
PID:4288 -
\??\c:\hhnbtt.exec:\hhnbtt.exe49⤵
- Executes dropped EXE
PID:4032 -
\??\c:\bnhbbb.exec:\bnhbbb.exe50⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dddpj.exec:\dddpj.exe51⤵
- Executes dropped EXE
PID:4888 -
\??\c:\fflfxfx.exec:\fflfxfx.exe52⤵
- Executes dropped EXE
PID:4580 -
\??\c:\btttbn.exec:\btttbn.exe53⤵
- Executes dropped EXE
PID:376 -
\??\c:\tnbthb.exec:\tnbthb.exe54⤵
- Executes dropped EXE
PID:1172 -
\??\c:\vpddp.exec:\vpddp.exe55⤵
- Executes dropped EXE
PID:3116 -
\??\c:\xxffffl.exec:\xxffffl.exe56⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hbbttt.exec:\hbbttt.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vvdpj.exec:\vvdpj.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pvdvj.exec:\pvdvj.exe60⤵
- Executes dropped EXE
PID:972 -
\??\c:\xfxrlff.exec:\xfxrlff.exe61⤵
- Executes dropped EXE
PID:3304 -
\??\c:\rxrlxxl.exec:\rxrlxxl.exe62⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nbhnhh.exec:\nbhnhh.exe63⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vdvvd.exec:\vdvvd.exe64⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vvvpj.exec:\vvvpj.exe65⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe66⤵PID:956
-
\??\c:\7nhtth.exec:\7nhtth.exe67⤵PID:4116
-
\??\c:\xfxrlfr.exec:\xfxrlfr.exe68⤵PID:456
-
\??\c:\1nbbbh.exec:\1nbbbh.exe69⤵PID:996
-
\??\c:\ddjdv.exec:\ddjdv.exe70⤵PID:2256
-
\??\c:\jpvjd.exec:\jpvjd.exe71⤵PID:1324
-
\??\c:\frxrrxx.exec:\frxrrxx.exe72⤵PID:3700
-
\??\c:\hhhhtt.exec:\hhhhtt.exe73⤵PID:3184
-
\??\c:\dpvdd.exec:\dpvdd.exe74⤵PID:4056
-
\??\c:\lflrrrr.exec:\lflrrrr.exe75⤵PID:2708
-
\??\c:\fxxlfll.exec:\fxxlfll.exe76⤵PID:3568
-
\??\c:\ttttbb.exec:\ttttbb.exe77⤵PID:3912
-
\??\c:\dvvvp.exec:\dvvvp.exe78⤵PID:4344
-
\??\c:\dpppp.exec:\dpppp.exe79⤵PID:3276
-
\??\c:\rlxfllx.exec:\rlxfllx.exe80⤵PID:3044
-
\??\c:\9bthtn.exec:\9bthtn.exe81⤵PID:3660
-
\??\c:\pddvd.exec:\pddvd.exe82⤵PID:3828
-
\??\c:\lxlrxrl.exec:\lxlrxrl.exe83⤵PID:856
-
\??\c:\1bhhnt.exec:\1bhhnt.exe84⤵PID:4656
-
\??\c:\nthnbb.exec:\nthnbb.exe85⤵PID:2024
-
\??\c:\pdddd.exec:\pdddd.exe86⤵PID:3992
-
\??\c:\xfrxlxf.exec:\xfrxlxf.exe87⤵PID:4808
-
\??\c:\rfxrfll.exec:\rfxrfll.exe88⤵PID:2056
-
\??\c:\5hbhbh.exec:\5hbhbh.exe89⤵PID:4012
-
\??\c:\lfxlxxx.exec:\lfxlxxx.exe90⤵PID:2760
-
\??\c:\ttbtbh.exec:\ttbtbh.exe91⤵PID:680
-
\??\c:\jdvvv.exec:\jdvvv.exe92⤵PID:2656
-
\??\c:\fxfxxlf.exec:\fxfxxlf.exe93⤵PID:4208
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe94⤵PID:1880
-
\??\c:\bbtbnt.exec:\bbtbnt.exe95⤵PID:2828
-
\??\c:\djjdv.exec:\djjdv.exe96⤵PID:3100
-
\??\c:\fflxxrf.exec:\fflxxrf.exe97⤵PID:5080
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe98⤵PID:4276
-
\??\c:\3thhnn.exec:\3thhnn.exe99⤵PID:4264
-
\??\c:\bbhhnn.exec:\bbhhnn.exe100⤵PID:4068
-
\??\c:\dppdp.exec:\dppdp.exe101⤵PID:4692
-
\??\c:\rrfllrf.exec:\rrfllrf.exe102⤵PID:1328
-
\??\c:\rfffxxx.exec:\rfffxxx.exe103⤵PID:1132
-
\??\c:\tbntbn.exec:\tbntbn.exe104⤵PID:1568
-
\??\c:\vjjvv.exec:\vjjvv.exe105⤵PID:4860
-
\??\c:\jdpjd.exec:\jdpjd.exe106⤵PID:2352
-
\??\c:\lffxfxx.exec:\lffxfxx.exe107⤵PID:2408
-
\??\c:\tbnnhh.exec:\tbnnhh.exe108⤵PID:860
-
\??\c:\btbtnn.exec:\btbtnn.exe109⤵PID:3264
-
\??\c:\hbbthb.exec:\hbbthb.exe110⤵PID:2920
-
\??\c:\ddvpp.exec:\ddvpp.exe111⤵PID:2940
-
\??\c:\pppjp.exec:\pppjp.exe112⤵PID:960
-
\??\c:\rfrffrr.exec:\rfrffrr.exe113⤵PID:1684
-
\??\c:\xfllrfr.exec:\xfllrfr.exe114⤵PID:3252
-
\??\c:\bbhhtt.exec:\bbhhtt.exe115⤵PID:2524
-
\??\c:\pjjjj.exec:\pjjjj.exe116⤵PID:3532
-
\??\c:\dvvvd.exec:\dvvvd.exe117⤵PID:2384
-
\??\c:\fxxfxff.exec:\fxxfxff.exe118⤵PID:4156
-
\??\c:\5bthht.exec:\5bthht.exe119⤵PID:1004
-
\??\c:\ntttnt.exec:\ntttnt.exe120⤵PID:3184
-
\??\c:\vppjd.exec:\vppjd.exe121⤵PID:3220
-
\??\c:\rfffxfx.exec:\rfffxfx.exe122⤵PID:4120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-