Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 00:45
Behavioral task
behavioral1
Sample
0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe
-
Size
232KB
-
MD5
0207be56172ef24acfda330d48fd7c8c
-
SHA1
be59f20aa13224a4f245c3c0e50eccfeed1bbece
-
SHA256
3a9a57d586141522128c8fb98ca1c1846d63309816a38b3672c7a743d90c0feb
-
SHA512
e3d55842c24a72580789c9289d812682bb1bbc24ecba1c4a334e8c44044c6094211b7ed4554ef596b5b74e57492f22b879d54f2b17c7ec931ef60e13b9041404
-
SSDEEP
3072:ThOmTsF93UYfwC6GIout0fmCiiiXAsACF486jFX8fkYtB6J6eUTV4qQG4:Tcm4FmowdHoSgWrXD486jFX88Y/eUBY
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2980-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1404-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-49-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2528-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-138-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1104-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/580-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-209-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1636-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/308-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-305-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-306-0x0000000077A10000-0x0000000077B2F000-memory.dmp family_blackmoon behavioral1/memory/2872-309-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-307-0x0000000077910000-0x0000000077A0A000-memory.dmp family_blackmoon behavioral1/memory/1888-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-322-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2872-335-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2632-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-435-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/940-452-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2040-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-487-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1504-508-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/268-579-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/268-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-700-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1716-775-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1264-805-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2872-1173-0x0000000077A10000-0x0000000077B2F000-memory.dmp family_blackmoon behavioral1/memory/2872-1462-0x0000000077910000-0x0000000077A0A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1448 xjlnx.exe 1404 hnftnln.exe 2996 ldlfd.exe 2636 rdxjvfj.exe 2772 lxnplhp.exe 2360 rdlxhxh.exe 2528 rrprtt.exe 2396 txjlr.exe 2840 hrttr.exe 2848 rrpvdj.exe 696 jhftfvd.exe 1368 xrplp.exe 756 thllb.exe 2584 vbdrlj.exe 2688 pfpthhb.exe 2704 xvfdbvj.exe 1164 hpptdtl.exe 1104 jfpndf.exe 1984 ldjtp.exe 308 phpvbb.exe 1696 dxhrnjn.exe 1636 lnjvr.exe 3028 njpjl.exe 580 ddhpbnt.exe 2212 nvxrb.exe 1988 nbhldr.exe 2232 fhxbj.exe 3008 jbrdtv.exe 1968 vxdrnh.exe 980 nljtjn.exe 3000 lhdxjv.exe 1944 tjlbdn.exe 1288 tlnrdlp.exe 1548 npxtrxv.exe 2320 bttnb.exe 268 hhhblnh.exe 1196 blvbv.exe 1700 bhtdjr.exe 3056 tlxnh.exe 2872 btttfnf.exe 2276 pntplt.exe 1500 dfnltl.exe 1404 jltttt.exe 2632 bdnlt.exe 2636 jpbjb.exe 2532 rbtnxn.exe 2616 fvxfpdv.exe 2380 rtbpfjh.exe 2524 njpnd.exe 2244 vdvxj.exe 2396 xbdtd.exe 2208 nxbpnbh.exe 2028 dtptvv.exe 2844 drxpb.exe 1056 vxtlrnt.exe 1840 lptpthp.exe 756 thhdpfp.exe 2588 xnbfth.exe 2544 vnrnbn.exe 1980 dpljdjt.exe 1948 htbdlft.exe 1916 hffdbhd.exe 1824 njhxxlj.exe 940 lvfff.exe -
resource yara_rule behavioral1/memory/2980-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d0000000122d1-5.dat upx behavioral1/memory/2980-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1448-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1448-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00230000000122f8-16.dat upx behavioral1/files/0x000900000001267d-25.dat upx behavioral1/memory/1404-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001269e-32.dat upx behavioral1/memory/2636-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000126c7-42.dat upx behavioral1/memory/2636-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000126f7-51.dat upx behavioral1/memory/2772-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000139d6-62.dat upx behavioral1/files/0x0006000000014c67-69.dat upx behavioral1/memory/2528-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014e3d-77.dat upx behavioral1/memory/2840-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014ec4-84.dat upx behavioral1/files/0x001a000000012300-92.dat upx behavioral1/files/0x0006000000015264-108.dat upx behavioral1/memory/1368-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014fe1-100.dat upx behavioral1/files/0x0006000000015364-115.dat upx behavioral1/memory/756-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155d4-124.dat upx behavioral1/memory/2688-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155d9-131.dat upx behavioral1/files/0x00060000000155e2-141.dat upx behavioral1/files/0x000600000001560a-148.dat upx behavioral1/memory/1104-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015a2d-156.dat upx behavioral1/files/0x0006000000015a98-166.dat upx behavioral1/files/0x0006000000015c0d-174.dat upx behavioral1/memory/1696-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c23-181.dat upx behavioral1/files/0x0006000000015c2f-189.dat upx behavioral1/memory/580-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c52-205.dat upx behavioral1/files/0x0006000000015c5d-215.dat upx behavioral1/memory/2212-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c69-221.dat upx behavioral1/memory/3008-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c7c-228.dat upx behavioral1/files/0x0006000000015c87-237.dat upx behavioral1/files/0x0006000000015cb9-243.dat upx behavioral1/files/0x0006000000015d88-251.dat upx behavioral1/memory/980-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015db4-258.dat upx behavioral1/memory/1944-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2320-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1196-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c3c-197.dat upx behavioral1/memory/1636-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/308-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/308-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1164-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1888-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1888-316-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 1448 2980 0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe 28 PID 2980 wrote to memory of 1448 2980 0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe 28 PID 2980 wrote to memory of 1448 2980 0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe 28 PID 2980 wrote to memory of 1448 2980 0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe 28 PID 1448 wrote to memory of 1404 1448 xjlnx.exe 29 PID 1448 wrote to memory of 1404 1448 xjlnx.exe 29 PID 1448 wrote to memory of 1404 1448 xjlnx.exe 29 PID 1448 wrote to memory of 1404 1448 xjlnx.exe 29 PID 1404 wrote to memory of 2996 1404 hnftnln.exe 30 PID 1404 wrote to memory of 2996 1404 hnftnln.exe 30 PID 1404 wrote to memory of 2996 1404 hnftnln.exe 30 PID 1404 wrote to memory of 2996 1404 hnftnln.exe 30 PID 2996 wrote to memory of 2636 2996 ldlfd.exe 31 PID 2996 wrote to memory of 2636 2996 ldlfd.exe 31 PID 2996 wrote to memory of 2636 2996 ldlfd.exe 31 PID 2996 wrote to memory of 2636 2996 ldlfd.exe 31 PID 2636 wrote to memory of 2772 2636 rdxjvfj.exe 32 PID 2636 wrote to memory of 2772 2636 rdxjvfj.exe 32 PID 2636 wrote to memory of 2772 2636 rdxjvfj.exe 32 PID 2636 wrote to memory of 2772 2636 rdxjvfj.exe 32 PID 2772 wrote to memory of 2360 2772 lxnplhp.exe 33 PID 2772 wrote to memory of 2360 2772 lxnplhp.exe 33 PID 2772 wrote to memory of 2360 2772 lxnplhp.exe 33 PID 2772 wrote to memory of 2360 2772 lxnplhp.exe 33 PID 2360 wrote to memory of 2528 2360 rdlxhxh.exe 34 PID 2360 wrote to memory of 2528 2360 rdlxhxh.exe 34 PID 2360 wrote to memory of 2528 2360 rdlxhxh.exe 34 PID 2360 wrote to memory of 2528 2360 rdlxhxh.exe 34 PID 2528 wrote to memory of 2396 2528 rrprtt.exe 35 PID 2528 wrote to memory of 2396 2528 rrprtt.exe 35 PID 2528 wrote to memory of 2396 2528 rrprtt.exe 35 PID 2528 wrote to memory of 2396 2528 rrprtt.exe 35 PID 2396 wrote to memory of 2840 2396 txjlr.exe 36 PID 2396 wrote to memory of 2840 2396 txjlr.exe 36 PID 2396 wrote to memory of 2840 2396 txjlr.exe 36 PID 2396 wrote to memory of 2840 2396 txjlr.exe 36 PID 2840 wrote to memory of 2848 2840 hrttr.exe 37 PID 2840 wrote to memory of 2848 2840 hrttr.exe 37 PID 2840 wrote to memory of 2848 2840 hrttr.exe 37 PID 2840 wrote to memory of 2848 2840 hrttr.exe 37 PID 2848 wrote to memory of 696 2848 rrpvdj.exe 38 PID 2848 wrote to memory of 696 2848 rrpvdj.exe 38 PID 2848 wrote to memory of 696 2848 rrpvdj.exe 38 PID 2848 wrote to memory of 696 2848 rrpvdj.exe 38 PID 696 wrote to memory of 1368 696 jhftfvd.exe 39 PID 696 wrote to memory of 1368 696 jhftfvd.exe 39 PID 696 wrote to memory of 1368 696 jhftfvd.exe 39 PID 696 wrote to memory of 1368 696 jhftfvd.exe 39 PID 1368 wrote to memory of 756 1368 xrplp.exe 40 PID 1368 wrote to memory of 756 1368 xrplp.exe 40 PID 1368 wrote to memory of 756 1368 xrplp.exe 40 PID 1368 wrote to memory of 756 1368 xrplp.exe 40 PID 756 wrote to memory of 2584 756 thllb.exe 41 PID 756 wrote to memory of 2584 756 thllb.exe 41 PID 756 wrote to memory of 2584 756 thllb.exe 41 PID 756 wrote to memory of 2584 756 thllb.exe 41 PID 2584 wrote to memory of 2688 2584 vbdrlj.exe 42 PID 2584 wrote to memory of 2688 2584 vbdrlj.exe 42 PID 2584 wrote to memory of 2688 2584 vbdrlj.exe 42 PID 2584 wrote to memory of 2688 2584 vbdrlj.exe 42 PID 2688 wrote to memory of 2704 2688 pfpthhb.exe 43 PID 2688 wrote to memory of 2704 2688 pfpthhb.exe 43 PID 2688 wrote to memory of 2704 2688 pfpthhb.exe 43 PID 2688 wrote to memory of 2704 2688 pfpthhb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0207be56172ef24acfda330d48fd7c8c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\xjlnx.exec:\xjlnx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\hnftnln.exec:\hnftnln.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\ldlfd.exec:\ldlfd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rdxjvfj.exec:\rdxjvfj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lxnplhp.exec:\lxnplhp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rdlxhxh.exec:\rdlxhxh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\rrprtt.exec:\rrprtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\txjlr.exec:\txjlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hrttr.exec:\hrttr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rrpvdj.exec:\rrpvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jhftfvd.exec:\jhftfvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\xrplp.exec:\xrplp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\thllb.exec:\thllb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vbdrlj.exec:\vbdrlj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pfpthhb.exec:\pfpthhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xvfdbvj.exec:\xvfdbvj.exe17⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hpptdtl.exec:\hpptdtl.exe18⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jfpndf.exec:\jfpndf.exe19⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ldjtp.exec:\ldjtp.exe20⤵
- Executes dropped EXE
PID:1984 -
\??\c:\phpvbb.exec:\phpvbb.exe21⤵
- Executes dropped EXE
PID:308 -
\??\c:\dxhrnjn.exec:\dxhrnjn.exe22⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lnjvr.exec:\lnjvr.exe23⤵
- Executes dropped EXE
PID:1636 -
\??\c:\njpjl.exec:\njpjl.exe24⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ddhpbnt.exec:\ddhpbnt.exe25⤵
- Executes dropped EXE
PID:580 -
\??\c:\nvxrb.exec:\nvxrb.exe26⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nbhldr.exec:\nbhldr.exe27⤵
- Executes dropped EXE
PID:1988 -
\??\c:\fhxbj.exec:\fhxbj.exe28⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jbrdtv.exec:\jbrdtv.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vxdrnh.exec:\vxdrnh.exe30⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nljtjn.exec:\nljtjn.exe31⤵
- Executes dropped EXE
PID:980 -
\??\c:\lhdxjv.exec:\lhdxjv.exe32⤵
- Executes dropped EXE
PID:3000 -
\??\c:\tjlbdn.exec:\tjlbdn.exe33⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tlnrdlp.exec:\tlnrdlp.exe34⤵
- Executes dropped EXE
PID:1288 -
\??\c:\npxtrxv.exec:\npxtrxv.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bttnb.exec:\bttnb.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hhhblnh.exec:\hhhblnh.exe37⤵
- Executes dropped EXE
PID:268 -
\??\c:\blvbv.exec:\blvbv.exe38⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bhtdjr.exec:\bhtdjr.exe39⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tlxnh.exec:\tlxnh.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\btttfnf.exec:\btttfnf.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bhjdx.exec:\bhjdx.exe42⤵PID:1888
-
\??\c:\pntplt.exec:\pntplt.exe43⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dfnltl.exec:\dfnltl.exe44⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jltttt.exec:\jltttt.exe45⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bdnlt.exec:\bdnlt.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jpbjb.exec:\jpbjb.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rbtnxn.exec:\rbtnxn.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fvxfpdv.exec:\fvxfpdv.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rtbpfjh.exec:\rtbpfjh.exe50⤵
- Executes dropped EXE
PID:2380 -
\??\c:\njpnd.exec:\njpnd.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vdvxj.exec:\vdvxj.exe52⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xbdtd.exec:\xbdtd.exe53⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nxbpnbh.exec:\nxbpnbh.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dtptvv.exec:\dtptvv.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\drxpb.exec:\drxpb.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vxtlrnt.exec:\vxtlrnt.exe57⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lptpthp.exec:\lptpthp.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\thhdpfp.exec:\thhdpfp.exe59⤵
- Executes dropped EXE
PID:756 -
\??\c:\xnbfth.exec:\xnbfth.exe60⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vnrnbn.exec:\vnrnbn.exe61⤵
- Executes dropped EXE
PID:2544 -
\??\c:\dpljdjt.exec:\dpljdjt.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\htbdlft.exec:\htbdlft.exe63⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hffdbhd.exec:\hffdbhd.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\njhxxlj.exec:\njhxxlj.exe65⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lvfff.exec:\lvfff.exe66⤵
- Executes dropped EXE
PID:940 -
\??\c:\nnpdrrp.exec:\nnpdrrp.exe67⤵PID:948
-
\??\c:\fdnxndd.exec:\fdnxndd.exe68⤵PID:2040
-
\??\c:\jbvxjv.exec:\jbvxjv.exe69⤵PID:2180
-
\??\c:\fjbjr.exec:\fjbjr.exe70⤵PID:3012
-
\??\c:\vhdxlh.exec:\vhdxlh.exe71⤵PID:2728
-
\??\c:\pjvnt.exec:\pjvnt.exe72⤵PID:2684
-
\??\c:\xrrbjt.exec:\xrrbjt.exe73⤵PID:2768
-
\??\c:\brpfrxh.exec:\brpfrxh.exe74⤵PID:1112
-
\??\c:\jrxhrjj.exec:\jrxhrjj.exe75⤵PID:2212
-
\??\c:\tfnnr.exec:\tfnnr.exe76⤵PID:1504
-
\??\c:\dbvrb.exec:\dbvrb.exe77⤵PID:2084
-
\??\c:\nbtffdh.exec:\nbtffdh.exe78⤵PID:1268
-
\??\c:\xvrbfn.exec:\xvrbfn.exe79⤵PID:2044
-
\??\c:\xlbhp.exec:\xlbhp.exe80⤵PID:3020
-
\??\c:\jbfrtlh.exec:\jbfrtlh.exe81⤵PID:1476
-
\??\c:\pfdnbj.exec:\pfdnbj.exe82⤵PID:2796
-
\??\c:\lfhjxd.exec:\lfhjxd.exe83⤵PID:3000
-
\??\c:\hhxth.exec:\hhxth.exe84⤵PID:1048
-
\??\c:\bfbpfdl.exec:\bfbpfdl.exe85⤵PID:672
-
\??\c:\dbhnvvt.exec:\dbhnvvt.exe86⤵PID:1120
-
\??\c:\jbttppv.exec:\jbttppv.exe87⤵PID:1652
-
\??\c:\fjfdxr.exec:\fjfdxr.exe88⤵PID:2320
-
\??\c:\jprvt.exec:\jprvt.exe89⤵PID:268
-
\??\c:\rpdvp.exec:\rpdvp.exe90⤵PID:1196
-
\??\c:\bpfrj.exec:\bpfrj.exe91⤵PID:2124
-
\??\c:\rxvpfvl.exec:\rxvpfvl.exe92⤵PID:2696
-
\??\c:\xfbvt.exec:\xfbvt.exe93⤵PID:1612
-
\??\c:\frvxv.exec:\frvxv.exe94⤵PID:1888
-
\??\c:\ttvttb.exec:\ttvttb.exe95⤵PID:1740
-
\??\c:\xtrhv.exec:\xtrhv.exe96⤵PID:2252
-
\??\c:\rbxvv.exec:\rbxvv.exe97⤵PID:2512
-
\??\c:\hfxfh.exec:\hfxfh.exe98⤵PID:1132
-
\??\c:\jbpjjh.exec:\jbpjjh.exe99⤵PID:2760
-
\??\c:\pxhjnf.exec:\pxhjnf.exe100⤵PID:2644
-
\??\c:\nvttd.exec:\nvttd.exe101⤵PID:2912
-
\??\c:\lndjfxt.exec:\lndjfxt.exe102⤵PID:2516
-
\??\c:\ltdfjb.exec:\ltdfjb.exe103⤵PID:2388
-
\??\c:\vjjlx.exec:\vjjlx.exe104⤵PID:2368
-
\??\c:\dxjpf.exec:\dxjpf.exe105⤵PID:2476
-
\??\c:\fxjpldd.exec:\fxjpldd.exe106⤵PID:1160
-
\??\c:\hbvjx.exec:\hbvjx.exe107⤵PID:1384
-
\??\c:\xldlv.exec:\xldlv.exe108⤵PID:1656
-
\??\c:\dfxpd.exec:\dfxpd.exe109⤵PID:2328
-
\??\c:\tjxnr.exec:\tjxnr.exe110⤵PID:2080
-
\??\c:\ppjxdt.exec:\ppjxdt.exe111⤵PID:908
-
\??\c:\jvfftv.exec:\jvfftv.exe112⤵PID:888
-
\??\c:\trrdj.exec:\trrdj.exe113⤵PID:1772
-
\??\c:\fdjnv.exec:\fdjnv.exe114⤵PID:2588
-
\??\c:\rdpll.exec:\rdpll.exe115⤵PID:2572
-
\??\c:\hnxvjlr.exec:\hnxvjlr.exe116⤵PID:1980
-
\??\c:\vbldxh.exec:\vbldxh.exe117⤵PID:1540
-
\??\c:\dffpxd.exec:\dffpxd.exe118⤵PID:944
-
\??\c:\xhdhrvv.exec:\xhdhrvv.exe119⤵PID:1128
-
\??\c:\nvljp.exec:\nvljp.exe120⤵PID:940
-
\??\c:\lhtttj.exec:\lhtttj.exe121⤵PID:2224
-
\??\c:\bjbrn.exec:\bjbrn.exe122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-