Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe
-
Size
211KB
-
MD5
044e98c2f9fb4c6966970e32ef11a6a3
-
SHA1
29d7fe446b8e57e0e9fb66ae05dafdfdbccc510a
-
SHA256
bcb5089a4953d599c0cc71b3b15b865ff83aa1aea71f69900e60420c67b5f012
-
SHA512
0183a413af5799f19f998abd05cfe6125037c370de025976d97afa82e8acd4c267d4a46f34b445bf110539c404b8c7662523c6dbd6faf96b27d5683b0ded0146
-
SSDEEP
3072:EhOm2sI93UufdC67ciyt3ujFf7TQsq5Va9h9Z:Ecm7ImGddXyt38TU5WZ
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2908-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-70-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-193-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1104-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/308-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-244-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/628-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-400-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/556-408-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-494-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1996-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-636-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2916-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-662-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-702-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1240-716-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1188-765-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lvnnht.exexdtnr.exeptbhj.exervpbrbd.exefndbb.exetrlbdvd.exedxlxth.exexpfhrxl.exexdbpnl.exextdjhrp.exetbjxtjd.exejhbtb.exevjxvpt.exebhdnl.exexnfjd.exehrxrbbh.exexbxfd.exerfrjx.exejlnnb.exetbnxhvx.exexxhhdrf.exelhjlnh.exedrjrfft.exevdnpvxh.exedvjhhh.exevnldd.exetvrbdnn.exexlxnl.exepdhdxx.exevljjx.exeppptvr.exehjdrd.exexnnxxj.exevfhvfv.exenhvbfh.exejlxjfh.exenrxvxdj.exefdhhjt.exedrphbb.exevrppxdh.exebnfrxx.exebpbdbhf.exerhnnlrd.exebbbxprt.exefpxvvt.exerpjdpbn.exerxhnvtt.exefdrfdfh.exeppjnp.exepllhpfp.exelpvlf.exevnnfn.exefjtfbr.exejvfblt.exetxxhprv.exevfrxxp.exetxnlxb.exeldxfbv.exeptnfh.exexnhlb.exexhrjf.exexxfnvp.exenhdtd.exehnlbr.exepid process 2152 lvnnht.exe 2908 xdtnr.exe 2528 ptbhj.exe 2488 rvpbrbd.exe 2576 fndbb.exe 2712 trlbdvd.exe 2200 dxlxth.exe 2344 xpfhrxl.exe 2856 xdbpnl.exe 1236 xtdjhrp.exe 1240 tbjxtjd.exe 652 jhbtb.exe 2700 vjxvpt.exe 1888 bhdnl.exe 1952 xnfjd.exe 2156 hrxrbbh.exe 2656 xbxfd.exe 1164 rfrjx.exe 1104 jlnnb.exe 2256 tbnxhvx.exe 592 xxhhdrf.exe 2544 lhjlnh.exe 308 drjrfft.exe 1668 vdnpvxh.exe 628 dvjhhh.exe 1180 vnldd.exe 2036 tvrbdnn.exe 888 xlxnl.exe 2944 pdhdxx.exe 880 vljjx.exe 572 ppptvr.exe 1752 hjdrd.exe 1736 xnnxxj.exe 2300 vfhvfv.exe 2904 nhvbfh.exe 1564 jlxjfh.exe 2520 nrxvxdj.exe 2536 fdhhjt.exe 2992 drphbb.exe 2448 vrppxdh.exe 2672 bnfrxx.exe 2360 bpbdbhf.exe 2328 rhnnlrd.exe 2348 bbbxprt.exe 1884 fpxvvt.exe 2852 rpjdpbn.exe 556 rxhnvtt.exe 1724 fdrfdfh.exe 2684 ppjnp.exe 2808 pllhpfp.exe 2772 lpvlf.exe 2224 vnnfn.exe 2320 fjtfbr.exe 2692 jvfblt.exe 1896 txxhprv.exe 2628 vfrxxp.exe 768 txnlxb.exe 2236 ldxfbv.exe 1460 ptnfh.exe 584 xnhlb.exe 1996 xhrjf.exe 1728 xxfnvp.exe 2544 nhdtd.exe 3056 hnlbr.exe -
Processes:
resource yara_rule behavioral1/memory/2908-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-423-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/528-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-757-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exelvnnht.exexdtnr.exeptbhj.exervpbrbd.exefndbb.exetrlbdvd.exedxlxth.exexpfhrxl.exexdbpnl.exextdjhrp.exetbjxtjd.exejhbtb.exevjxvpt.exebhdnl.exexnfjd.exedescription pid process target process PID 1400 wrote to memory of 2152 1400 044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe lvnnht.exe PID 1400 wrote to memory of 2152 1400 044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe lvnnht.exe PID 1400 wrote to memory of 2152 1400 044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe lvnnht.exe PID 1400 wrote to memory of 2152 1400 044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe lvnnht.exe PID 2152 wrote to memory of 2908 2152 lvnnht.exe xdtnr.exe PID 2152 wrote to memory of 2908 2152 lvnnht.exe xdtnr.exe PID 2152 wrote to memory of 2908 2152 lvnnht.exe xdtnr.exe PID 2152 wrote to memory of 2908 2152 lvnnht.exe xdtnr.exe PID 2908 wrote to memory of 2528 2908 xdtnr.exe ptbhj.exe PID 2908 wrote to memory of 2528 2908 xdtnr.exe ptbhj.exe PID 2908 wrote to memory of 2528 2908 xdtnr.exe ptbhj.exe PID 2908 wrote to memory of 2528 2908 xdtnr.exe ptbhj.exe PID 2528 wrote to memory of 2488 2528 ptbhj.exe rvpbrbd.exe PID 2528 wrote to memory of 2488 2528 ptbhj.exe rvpbrbd.exe PID 2528 wrote to memory of 2488 2528 ptbhj.exe rvpbrbd.exe PID 2528 wrote to memory of 2488 2528 ptbhj.exe rvpbrbd.exe PID 2488 wrote to memory of 2576 2488 rvpbrbd.exe fndbb.exe PID 2488 wrote to memory of 2576 2488 rvpbrbd.exe fndbb.exe PID 2488 wrote to memory of 2576 2488 rvpbrbd.exe fndbb.exe PID 2488 wrote to memory of 2576 2488 rvpbrbd.exe fndbb.exe PID 2576 wrote to memory of 2712 2576 fndbb.exe trlbdvd.exe PID 2576 wrote to memory of 2712 2576 fndbb.exe trlbdvd.exe PID 2576 wrote to memory of 2712 2576 fndbb.exe trlbdvd.exe PID 2576 wrote to memory of 2712 2576 fndbb.exe trlbdvd.exe PID 2712 wrote to memory of 2200 2712 trlbdvd.exe dxlxth.exe PID 2712 wrote to memory of 2200 2712 trlbdvd.exe dxlxth.exe PID 2712 wrote to memory of 2200 2712 trlbdvd.exe dxlxth.exe PID 2712 wrote to memory of 2200 2712 trlbdvd.exe dxlxth.exe PID 2200 wrote to memory of 2344 2200 dxlxth.exe xpfhrxl.exe PID 2200 wrote to memory of 2344 2200 dxlxth.exe xpfhrxl.exe PID 2200 wrote to memory of 2344 2200 dxlxth.exe xpfhrxl.exe PID 2200 wrote to memory of 2344 2200 dxlxth.exe xpfhrxl.exe PID 2344 wrote to memory of 2856 2344 xpfhrxl.exe xdbpnl.exe PID 2344 wrote to memory of 2856 2344 xpfhrxl.exe xdbpnl.exe PID 2344 wrote to memory of 2856 2344 xpfhrxl.exe xdbpnl.exe PID 2344 wrote to memory of 2856 2344 xpfhrxl.exe xdbpnl.exe PID 2856 wrote to memory of 1236 2856 xdbpnl.exe xtdjhrp.exe PID 2856 wrote to memory of 1236 2856 xdbpnl.exe xtdjhrp.exe PID 2856 wrote to memory of 1236 2856 xdbpnl.exe xtdjhrp.exe PID 2856 wrote to memory of 1236 2856 xdbpnl.exe xtdjhrp.exe PID 1236 wrote to memory of 1240 1236 xtdjhrp.exe tbjxtjd.exe PID 1236 wrote to memory of 1240 1236 xtdjhrp.exe tbjxtjd.exe PID 1236 wrote to memory of 1240 1236 xtdjhrp.exe tbjxtjd.exe PID 1236 wrote to memory of 1240 1236 xtdjhrp.exe tbjxtjd.exe PID 1240 wrote to memory of 652 1240 tbjxtjd.exe jhbtb.exe PID 1240 wrote to memory of 652 1240 tbjxtjd.exe jhbtb.exe PID 1240 wrote to memory of 652 1240 tbjxtjd.exe jhbtb.exe PID 1240 wrote to memory of 652 1240 tbjxtjd.exe jhbtb.exe PID 652 wrote to memory of 2700 652 jhbtb.exe vjxvpt.exe PID 652 wrote to memory of 2700 652 jhbtb.exe vjxvpt.exe PID 652 wrote to memory of 2700 652 jhbtb.exe vjxvpt.exe PID 652 wrote to memory of 2700 652 jhbtb.exe vjxvpt.exe PID 2700 wrote to memory of 1888 2700 vjxvpt.exe bhdnl.exe PID 2700 wrote to memory of 1888 2700 vjxvpt.exe bhdnl.exe PID 2700 wrote to memory of 1888 2700 vjxvpt.exe bhdnl.exe PID 2700 wrote to memory of 1888 2700 vjxvpt.exe bhdnl.exe PID 1888 wrote to memory of 1952 1888 bhdnl.exe xnfjd.exe PID 1888 wrote to memory of 1952 1888 bhdnl.exe xnfjd.exe PID 1888 wrote to memory of 1952 1888 bhdnl.exe xnfjd.exe PID 1888 wrote to memory of 1952 1888 bhdnl.exe xnfjd.exe PID 1952 wrote to memory of 2156 1952 xnfjd.exe hrxrbbh.exe PID 1952 wrote to memory of 2156 1952 xnfjd.exe hrxrbbh.exe PID 1952 wrote to memory of 2156 1952 xnfjd.exe hrxrbbh.exe PID 1952 wrote to memory of 2156 1952 xnfjd.exe hrxrbbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lvnnht.exec:\lvnnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xdtnr.exec:\xdtnr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ptbhj.exec:\ptbhj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rvpbrbd.exec:\rvpbrbd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fndbb.exec:\fndbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\trlbdvd.exec:\trlbdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dxlxth.exec:\dxlxth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xpfhrxl.exec:\xpfhrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xdbpnl.exec:\xdbpnl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xtdjhrp.exec:\xtdjhrp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbjxtjd.exec:\tbjxtjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jhbtb.exec:\jhbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjxvpt.exec:\vjxvpt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhdnl.exec:\bhdnl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xnfjd.exec:\xnfjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hrxrbbh.exec:\hrxrbbh.exe17⤵
- Executes dropped EXE
-
\??\c:\xbxfd.exec:\xbxfd.exe18⤵
- Executes dropped EXE
-
\??\c:\rfrjx.exec:\rfrjx.exe19⤵
- Executes dropped EXE
-
\??\c:\jlnnb.exec:\jlnnb.exe20⤵
- Executes dropped EXE
-
\??\c:\tbnxhvx.exec:\tbnxhvx.exe21⤵
- Executes dropped EXE
-
\??\c:\xxhhdrf.exec:\xxhhdrf.exe22⤵
- Executes dropped EXE
-
\??\c:\lhjlnh.exec:\lhjlnh.exe23⤵
- Executes dropped EXE
-
\??\c:\drjrfft.exec:\drjrfft.exe24⤵
- Executes dropped EXE
-
\??\c:\vdnpvxh.exec:\vdnpvxh.exe25⤵
- Executes dropped EXE
-
\??\c:\dvjhhh.exec:\dvjhhh.exe26⤵
- Executes dropped EXE
-
\??\c:\vnldd.exec:\vnldd.exe27⤵
- Executes dropped EXE
-
\??\c:\tvrbdnn.exec:\tvrbdnn.exe28⤵
- Executes dropped EXE
-
\??\c:\xlxnl.exec:\xlxnl.exe29⤵
- Executes dropped EXE
-
\??\c:\pdhdxx.exec:\pdhdxx.exe30⤵
- Executes dropped EXE
-
\??\c:\vljjx.exec:\vljjx.exe31⤵
- Executes dropped EXE
-
\??\c:\ppptvr.exec:\ppptvr.exe32⤵
- Executes dropped EXE
-
\??\c:\hjdrd.exec:\hjdrd.exe33⤵
- Executes dropped EXE
-
\??\c:\xnnxxj.exec:\xnnxxj.exe34⤵
- Executes dropped EXE
-
\??\c:\vfhvfv.exec:\vfhvfv.exe35⤵
- Executes dropped EXE
-
\??\c:\nhvbfh.exec:\nhvbfh.exe36⤵
- Executes dropped EXE
-
\??\c:\jlxjfh.exec:\jlxjfh.exe37⤵
- Executes dropped EXE
-
\??\c:\nrxvxdj.exec:\nrxvxdj.exe38⤵
- Executes dropped EXE
-
\??\c:\fdhhjt.exec:\fdhhjt.exe39⤵
- Executes dropped EXE
-
\??\c:\drphbb.exec:\drphbb.exe40⤵
- Executes dropped EXE
-
\??\c:\vrppxdh.exec:\vrppxdh.exe41⤵
- Executes dropped EXE
-
\??\c:\bnfrxx.exec:\bnfrxx.exe42⤵
- Executes dropped EXE
-
\??\c:\bpbdbhf.exec:\bpbdbhf.exe43⤵
- Executes dropped EXE
-
\??\c:\rhnnlrd.exec:\rhnnlrd.exe44⤵
- Executes dropped EXE
-
\??\c:\bbbxprt.exec:\bbbxprt.exe45⤵
- Executes dropped EXE
-
\??\c:\fpxvvt.exec:\fpxvvt.exe46⤵
- Executes dropped EXE
-
\??\c:\rpjdpbn.exec:\rpjdpbn.exe47⤵
- Executes dropped EXE
-
\??\c:\rxhnvtt.exec:\rxhnvtt.exe48⤵
- Executes dropped EXE
-
\??\c:\fdrfdfh.exec:\fdrfdfh.exe49⤵
- Executes dropped EXE
-
\??\c:\ppjnp.exec:\ppjnp.exe50⤵
- Executes dropped EXE
-
\??\c:\pllhpfp.exec:\pllhpfp.exe51⤵
- Executes dropped EXE
-
\??\c:\lpvlf.exec:\lpvlf.exe52⤵
- Executes dropped EXE
-
\??\c:\vnnfn.exec:\vnnfn.exe53⤵
- Executes dropped EXE
-
\??\c:\fjtfbr.exec:\fjtfbr.exe54⤵
- Executes dropped EXE
-
\??\c:\jvfblt.exec:\jvfblt.exe55⤵
- Executes dropped EXE
-
\??\c:\txxhprv.exec:\txxhprv.exe56⤵
- Executes dropped EXE
-
\??\c:\vfrxxp.exec:\vfrxxp.exe57⤵
- Executes dropped EXE
-
\??\c:\txnlxb.exec:\txnlxb.exe58⤵
- Executes dropped EXE
-
\??\c:\ldxfbv.exec:\ldxfbv.exe59⤵
- Executes dropped EXE
-
\??\c:\ptnfh.exec:\ptnfh.exe60⤵
- Executes dropped EXE
-
\??\c:\xnhlb.exec:\xnhlb.exe61⤵
- Executes dropped EXE
-
\??\c:\xhrjf.exec:\xhrjf.exe62⤵
- Executes dropped EXE
-
\??\c:\xxfnvp.exec:\xxfnvp.exe63⤵
- Executes dropped EXE
-
\??\c:\nhdtd.exec:\nhdtd.exe64⤵
- Executes dropped EXE
-
\??\c:\hnlbr.exec:\hnlbr.exe65⤵
- Executes dropped EXE
-
\??\c:\jfxrndf.exec:\jfxrndf.exe66⤵
-
\??\c:\hflth.exec:\hflth.exe67⤵
-
\??\c:\thdthpd.exec:\thdthpd.exe68⤵
-
\??\c:\vvvfdj.exec:\vvvfdj.exe69⤵
-
\??\c:\ljhhr.exec:\ljhhr.exe70⤵
-
\??\c:\thhjnhx.exec:\thhjnhx.exe71⤵
-
\??\c:\bbnppfv.exec:\bbnppfv.exe72⤵
-
\??\c:\ntddj.exec:\ntddj.exe73⤵
-
\??\c:\dnbfnj.exec:\dnbfnj.exe74⤵
-
\??\c:\lxhvxlt.exec:\lxhvxlt.exe75⤵
-
\??\c:\rllrhpx.exec:\rllrhpx.exe76⤵
-
\??\c:\nphdvp.exec:\nphdvp.exe77⤵
-
\??\c:\dhjdb.exec:\dhjdb.exe78⤵
-
\??\c:\jpdpl.exec:\jpdpl.exe79⤵
-
\??\c:\hdhrd.exec:\hdhrd.exe80⤵
-
\??\c:\dtfdddv.exec:\dtfdddv.exe81⤵
-
\??\c:\dlrhj.exec:\dlrhj.exe82⤵
-
\??\c:\drtjl.exec:\drtjl.exe83⤵
-
\??\c:\vplpp.exec:\vplpp.exe84⤵
-
\??\c:\frlrdbh.exec:\frlrdbh.exe85⤵
-
\??\c:\hhxbxdl.exec:\hhxbxdl.exe86⤵
-
\??\c:\jvlpp.exec:\jvlpp.exe87⤵
-
\??\c:\xlljbpb.exec:\xlljbpb.exe88⤵
-
\??\c:\ndxrrbb.exec:\ndxrrbb.exe89⤵
-
\??\c:\pfxnfn.exec:\pfxnfn.exe90⤵
-
\??\c:\pvhvd.exec:\pvhvd.exe91⤵
-
\??\c:\hbfptbb.exec:\hbfptbb.exe92⤵
-
\??\c:\hvjbnxh.exec:\hvjbnxh.exe93⤵
-
\??\c:\ptvjhj.exec:\ptvjhj.exe94⤵
-
\??\c:\fdbfd.exec:\fdbfd.exe95⤵
-
\??\c:\thndb.exec:\thndb.exe96⤵
-
\??\c:\djjfdtt.exec:\djjfdtt.exe97⤵
-
\??\c:\ntlrbbb.exec:\ntlrbbb.exe98⤵
-
\??\c:\vnxjdlt.exec:\vnxjdlt.exe99⤵
-
\??\c:\htntf.exec:\htntf.exe100⤵
-
\??\c:\rdrddh.exec:\rdrddh.exe101⤵
-
\??\c:\dhnttpf.exec:\dhnttpf.exe102⤵
-
\??\c:\fhnrn.exec:\fhnrn.exe103⤵
-
\??\c:\llhlrrd.exec:\llhlrrd.exe104⤵
-
\??\c:\hdtfrvr.exec:\hdtfrvr.exe105⤵
-
\??\c:\bnhnv.exec:\bnhnv.exe106⤵
-
\??\c:\rvljxr.exec:\rvljxr.exe107⤵
-
\??\c:\vbxxlh.exec:\vbxxlh.exe108⤵
-
\??\c:\fdrtrbp.exec:\fdrtrbp.exe109⤵
-
\??\c:\rvptrl.exec:\rvptrl.exe110⤵
-
\??\c:\brblb.exec:\brblb.exe111⤵
-
\??\c:\hrtdnpl.exec:\hrtdnpl.exe112⤵
-
\??\c:\dnvbx.exec:\dnvbx.exe113⤵
-
\??\c:\bjjffl.exec:\bjjffl.exe114⤵
-
\??\c:\hhdtlhx.exec:\hhdtlhx.exe115⤵
-
\??\c:\txhhpx.exec:\txhhpx.exe116⤵
-
\??\c:\pfldnht.exec:\pfldnht.exe117⤵
-
\??\c:\tbvfnr.exec:\tbvfnr.exe118⤵
-
\??\c:\hpdrvr.exec:\hpdrvr.exe119⤵
-
\??\c:\flnfpx.exec:\flnfpx.exe120⤵
-
\??\c:\dndlxrl.exec:\dndlxrl.exe121⤵
-
\??\c:\bvvxx.exec:\bvvxx.exe122⤵
-
\??\c:\nvfrn.exec:\nvfrn.exe123⤵
-
\??\c:\ffjxvf.exec:\ffjxvf.exe124⤵
-
\??\c:\lnxttb.exec:\lnxttb.exe125⤵
-
\??\c:\vjdrlf.exec:\vjdrlf.exe126⤵
-
\??\c:\hnnvn.exec:\hnnvn.exe127⤵
-
\??\c:\rpnhx.exec:\rpnhx.exe128⤵
-
\??\c:\nvjvx.exec:\nvjvx.exe129⤵
-
\??\c:\vtxnrv.exec:\vtxnrv.exe130⤵
-
\??\c:\hvjptjt.exec:\hvjptjt.exe131⤵
-
\??\c:\vhnfl.exec:\vhnfl.exe132⤵
-
\??\c:\dfpfdh.exec:\dfpfdh.exe133⤵
-
\??\c:\hpnhlv.exec:\hpnhlv.exe134⤵
-
\??\c:\bxfpp.exec:\bxfpp.exe135⤵
-
\??\c:\phtxf.exec:\phtxf.exe136⤵
-
\??\c:\rjrdrjh.exec:\rjrdrjh.exe137⤵
-
\??\c:\dxrdjn.exec:\dxrdjn.exe138⤵
-
\??\c:\phhfj.exec:\phhfj.exe139⤵
-
\??\c:\nrrddl.exec:\nrrddl.exe140⤵
-
\??\c:\ttjrpdr.exec:\ttjrpdr.exe141⤵
-
\??\c:\tprvfnv.exec:\tprvfnv.exe142⤵
-
\??\c:\nnbjnt.exec:\nnbjnt.exe143⤵
-
\??\c:\tllvnr.exec:\tllvnr.exe144⤵
-
\??\c:\dvvnb.exec:\dvvnb.exe145⤵
-
\??\c:\hxltnj.exec:\hxltnj.exe146⤵
-
\??\c:\hnlrvj.exec:\hnlrvj.exe147⤵
-
\??\c:\plxjrrt.exec:\plxjrrt.exe148⤵
-
\??\c:\jjnhf.exec:\jjnhf.exe149⤵
-
\??\c:\nrjxxjr.exec:\nrjxxjr.exe150⤵
-
\??\c:\phpnlx.exec:\phpnlx.exe151⤵
-
\??\c:\hvhvfx.exec:\hvhvfx.exe152⤵
-
\??\c:\vnnjldp.exec:\vnnjldp.exe153⤵
-
\??\c:\jrvjjbt.exec:\jrvjjbt.exe154⤵
-
\??\c:\xbpxbl.exec:\xbpxbl.exe155⤵
-
\??\c:\xljbl.exec:\xljbl.exe156⤵
-
\??\c:\pdpnp.exec:\pdpnp.exe157⤵
-
\??\c:\rnthdxd.exec:\rnthdxd.exe158⤵
-
\??\c:\nrbvjd.exec:\nrbvjd.exe159⤵
-
\??\c:\jdvlt.exec:\jdvlt.exe160⤵
-
\??\c:\bpfjltd.exec:\bpfjltd.exe161⤵
-
\??\c:\ftjjtx.exec:\ftjjtx.exe162⤵
-
\??\c:\fltdhr.exec:\fltdhr.exe163⤵
-
\??\c:\tpbdh.exec:\tpbdh.exe164⤵
-
\??\c:\lvtplvl.exec:\lvtplvl.exe165⤵
-
\??\c:\nbvrrjd.exec:\nbvrrjd.exe166⤵
-
\??\c:\dvxrfx.exec:\dvxrfx.exe167⤵
-
\??\c:\bljhx.exec:\bljhx.exe168⤵
-
\??\c:\tdnlr.exec:\tdnlr.exe169⤵
-
\??\c:\rdjrfd.exec:\rdjrfd.exe170⤵
-
\??\c:\jhffjlx.exec:\jhffjlx.exe171⤵
-
\??\c:\bfthrhj.exec:\bfthrhj.exe172⤵
-
\??\c:\dtdvd.exec:\dtdvd.exe173⤵
-
\??\c:\dppvh.exec:\dppvh.exe174⤵
-
\??\c:\drhjxx.exec:\drhjxx.exe175⤵
-
\??\c:\ldfbl.exec:\ldfbl.exe176⤵
-
\??\c:\xxdbjn.exec:\xxdbjn.exe177⤵
-
\??\c:\xthfpn.exec:\xthfpn.exe178⤵
-
\??\c:\xnxppd.exec:\xnxppd.exe179⤵
-
\??\c:\jfbxhj.exec:\jfbxhj.exe180⤵
-
\??\c:\dvdxxlj.exec:\dvdxxlj.exe181⤵
-
\??\c:\rlvbf.exec:\rlvbf.exe182⤵
-
\??\c:\flhpp.exec:\flhpp.exe183⤵
-
\??\c:\dfhvhl.exec:\dfhvhl.exe184⤵
-
\??\c:\xnhdp.exec:\xnhdp.exe185⤵
-
\??\c:\dtrtpb.exec:\dtrtpb.exe186⤵
-
\??\c:\nbxxlf.exec:\nbxxlf.exe187⤵
-
\??\c:\tfrhdnp.exec:\tfrhdnp.exe188⤵
-
\??\c:\xdxjdnv.exec:\xdxjdnv.exe189⤵
-
\??\c:\xlvrr.exec:\xlvrr.exe190⤵
-
\??\c:\hdjrdf.exec:\hdjrdf.exe191⤵
-
\??\c:\plrpvl.exec:\plrpvl.exe192⤵
-
\??\c:\nlrrnbn.exec:\nlrrnbn.exe193⤵
-
\??\c:\dvfrd.exec:\dvfrd.exe194⤵
-
\??\c:\jtttl.exec:\jtttl.exe195⤵
-
\??\c:\bbprn.exec:\bbprn.exe196⤵
-
\??\c:\brtpb.exec:\brtpb.exe197⤵
-
\??\c:\xdjlr.exec:\xdjlr.exe198⤵
-
\??\c:\dllpp.exec:\dllpp.exe199⤵
-
\??\c:\tjdpxdb.exec:\tjdpxdb.exe200⤵
-
\??\c:\bjpxnh.exec:\bjpxnh.exe201⤵
-
\??\c:\txhndpp.exec:\txhndpp.exe202⤵
-
\??\c:\vxfxlp.exec:\vxfxlp.exe203⤵
-
\??\c:\tttljhh.exec:\tttljhh.exe204⤵
-
\??\c:\tbnxp.exec:\tbnxp.exe205⤵
-
\??\c:\dftrtpd.exec:\dftrtpd.exe206⤵
-
\??\c:\lbhddt.exec:\lbhddt.exe207⤵
-
\??\c:\llrbj.exec:\llrbj.exe208⤵
-
\??\c:\dtblnbf.exec:\dtblnbf.exe209⤵
-
\??\c:\hvjbnrb.exec:\hvjbnrb.exe210⤵
-
\??\c:\pfrvxf.exec:\pfrvxf.exe211⤵
-
\??\c:\ljfhn.exec:\ljfhn.exe212⤵
-
\??\c:\nblnhxv.exec:\nblnhxv.exe213⤵
-
\??\c:\fvrbn.exec:\fvrbn.exe214⤵
-
\??\c:\vllldn.exec:\vllldn.exe215⤵
-
\??\c:\xtlvxp.exec:\xtlvxp.exe216⤵
-
\??\c:\dtxhjl.exec:\dtxhjl.exe217⤵
-
\??\c:\tpjtn.exec:\tpjtn.exe218⤵
-
\??\c:\vxvxnx.exec:\vxvxnx.exe219⤵
-
\??\c:\ppjvdl.exec:\ppjvdl.exe220⤵
-
\??\c:\dvhtl.exec:\dvhtl.exe221⤵
-
\??\c:\rxllpp.exec:\rxllpp.exe222⤵
-
\??\c:\vrddhn.exec:\vrddhn.exe223⤵
-
\??\c:\xprtnt.exec:\xprtnt.exe224⤵
-
\??\c:\xhhlr.exec:\xhhlr.exe225⤵
-
\??\c:\plbln.exec:\plbln.exe226⤵
-
\??\c:\dlnjlbl.exec:\dlnjlbl.exe227⤵
-
\??\c:\jddlvlr.exec:\jddlvlr.exe228⤵
-
\??\c:\xbjdh.exec:\xbjdh.exe229⤵
-
\??\c:\dvrdx.exec:\dvrdx.exe230⤵
-
\??\c:\jtlnhd.exec:\jtlnhd.exe231⤵
-
\??\c:\xpfvb.exec:\xpfvb.exe232⤵
-
\??\c:\vjjhjjj.exec:\vjjhjjj.exe233⤵
-
\??\c:\dfbrtdl.exec:\dfbrtdl.exe234⤵
-
\??\c:\pvpdprn.exec:\pvpdprn.exe235⤵
-
\??\c:\fnrfrh.exec:\fnrfrh.exe236⤵
-
\??\c:\vxxld.exec:\vxxld.exe237⤵
-
\??\c:\vrnhtdn.exec:\vrnhtdn.exe238⤵
-
\??\c:\hpdbpxh.exec:\hpdbpxh.exe239⤵
-
\??\c:\ntxjjt.exec:\ntxjjt.exe240⤵
-
\??\c:\dvnrp.exec:\dvnrp.exe241⤵