Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe
-
Size
211KB
-
MD5
10d4a15bca794b6ef16152907fa0ab9d
-
SHA1
d78da5933b9c51cc1c2cef17914a0e4663cc1712
-
SHA256
f05ad4441a6258ae559e1e6a499bd2a10d68ace224372e82322e6ac5fde4bb07
-
SHA512
622fc9034f68fcd7667812b677442f9d348f96b3de41ca0bd5715abd6550ead6cf17f6552abb8c5d432e72cdb8caffd7e9555766c8dc2d75886329f2642eec8a
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAQ5lpBoGs:Pcm7ImGddXtWrXF5lpKGs
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2056-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-62-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2556-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-73-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2412-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-96-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1012-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-170-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2924-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-215-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/400-234-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1848-244-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1648-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-306-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2084-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-348-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2500-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-424-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2496-439-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2004-453-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2284-507-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2964-529-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/436-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/436-546-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2580-544-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/436-573-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1668-579-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1792-588-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2252-597-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-596-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2796-618-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-642-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 nbnxdd.exe 2828 jhnjdlx.exe 2608 ldhtb.exe 2552 jhftpdr.exe 2644 tjvdh.exe 2556 lnlpxlr.exe 3040 dnlnhnb.exe 2412 pljxt.exe 2876 rxppnh.exe 1012 fvtdnd.exe 844 blltvj.exe 2384 xnpll.exe 2188 vjnfff.exe 1916 jplxb.exe 1204 rnhrj.exe 1704 dfrvfp.exe 2312 fhbdb.exe 1088 fppbx.exe 1656 vjhff.exe 2240 lhnxnxr.exe 2280 bhbrhj.exe 2924 rtrxxh.exe 380 tnlvr.exe 400 dxtdrlr.exe 1848 nfxxjjn.exe 1380 bfnjdb.exe 684 pvxjrxx.exe 1648 tvthf.exe 1020 vbjlbx.exe 1544 jhlnd.exe 2040 bvhlxp.exe 2948 ndjnndx.exe 880 lxftt.exe 2084 hbtxvht.exe 2888 fjndb.exe 1608 rrbxv.exe 2276 vxlnxv.exe 2932 xnjpdn.exe 3004 vnpldlx.exe 2500 ppxptx.exe 2564 fdffvb.exe 2756 thnlbvj.exe 2560 nhdrr.exe 2484 ttllp.exe 2364 pbbddnp.exe 2292 tvjhfx.exe 2876 ptlhnd.exe 1480 lfnrhl.exe 2348 xfdfl.exe 840 rxffvjn.exe 2496 jfxrj.exe 1780 rrbpn.exe 2004 prbxtt.exe 1504 nfbjf.exe 1920 fvhpldn.exe 1100 tjvppxh.exe 1744 frbnnxr.exe 2704 hjfhdlf.exe 2816 xtnvx.exe 1656 hrbjhfl.exe 2284 lplhj.exe 2580 xrthpbr.exe 792 jrbxdn.exe 2964 bxhfpx.exe -
resource yara_rule behavioral1/memory/2172-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-508-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-529-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-597-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-611-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-618-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2056 2172 10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2056 2172 10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2056 2172 10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2056 2172 10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe 28 PID 2056 wrote to memory of 2828 2056 nbnxdd.exe 29 PID 2056 wrote to memory of 2828 2056 nbnxdd.exe 29 PID 2056 wrote to memory of 2828 2056 nbnxdd.exe 29 PID 2056 wrote to memory of 2828 2056 nbnxdd.exe 29 PID 2828 wrote to memory of 2608 2828 jhnjdlx.exe 30 PID 2828 wrote to memory of 2608 2828 jhnjdlx.exe 30 PID 2828 wrote to memory of 2608 2828 jhnjdlx.exe 30 PID 2828 wrote to memory of 2608 2828 jhnjdlx.exe 30 PID 2608 wrote to memory of 2552 2608 ldhtb.exe 31 PID 2608 wrote to memory of 2552 2608 ldhtb.exe 31 PID 2608 wrote to memory of 2552 2608 ldhtb.exe 31 PID 2608 wrote to memory of 2552 2608 ldhtb.exe 31 PID 2552 wrote to memory of 2644 2552 jhftpdr.exe 32 PID 2552 wrote to memory of 2644 2552 jhftpdr.exe 32 PID 2552 wrote to memory of 2644 2552 jhftpdr.exe 32 PID 2552 wrote to memory of 2644 2552 jhftpdr.exe 32 PID 2644 wrote to memory of 2556 2644 tjvdh.exe 33 PID 2644 wrote to memory of 2556 2644 tjvdh.exe 33 PID 2644 wrote to memory of 2556 2644 tjvdh.exe 33 PID 2644 wrote to memory of 2556 2644 tjvdh.exe 33 PID 2556 wrote to memory of 3040 2556 lnlpxlr.exe 34 PID 2556 wrote to memory of 3040 2556 lnlpxlr.exe 34 PID 2556 wrote to memory of 3040 2556 lnlpxlr.exe 34 PID 2556 wrote to memory of 3040 2556 lnlpxlr.exe 34 PID 3040 wrote to memory of 2412 3040 dnlnhnb.exe 35 PID 3040 wrote to memory of 2412 3040 dnlnhnb.exe 35 PID 3040 wrote to memory of 2412 3040 dnlnhnb.exe 35 PID 3040 wrote to memory of 2412 3040 dnlnhnb.exe 35 PID 2412 wrote to memory of 2876 2412 pljxt.exe 36 PID 2412 wrote to memory of 2876 2412 pljxt.exe 36 PID 2412 wrote to memory of 2876 2412 pljxt.exe 36 PID 2412 wrote to memory of 2876 2412 pljxt.exe 36 PID 2876 wrote to memory of 1012 2876 rxppnh.exe 37 PID 2876 wrote to memory of 1012 2876 rxppnh.exe 37 PID 2876 wrote to memory of 1012 2876 rxppnh.exe 37 PID 2876 wrote to memory of 1012 2876 rxppnh.exe 37 PID 1012 wrote to memory of 844 1012 fvtdnd.exe 38 PID 1012 wrote to memory of 844 1012 fvtdnd.exe 38 PID 1012 wrote to memory of 844 1012 fvtdnd.exe 38 PID 1012 wrote to memory of 844 1012 fvtdnd.exe 38 PID 844 wrote to memory of 2384 844 blltvj.exe 39 PID 844 wrote to memory of 2384 844 blltvj.exe 39 PID 844 wrote to memory of 2384 844 blltvj.exe 39 PID 844 wrote to memory of 2384 844 blltvj.exe 39 PID 2384 wrote to memory of 2188 2384 xnpll.exe 40 PID 2384 wrote to memory of 2188 2384 xnpll.exe 40 PID 2384 wrote to memory of 2188 2384 xnpll.exe 40 PID 2384 wrote to memory of 2188 2384 xnpll.exe 40 PID 2188 wrote to memory of 1916 2188 vjnfff.exe 41 PID 2188 wrote to memory of 1916 2188 vjnfff.exe 41 PID 2188 wrote to memory of 1916 2188 vjnfff.exe 41 PID 2188 wrote to memory of 1916 2188 vjnfff.exe 41 PID 1916 wrote to memory of 1204 1916 jplxb.exe 42 PID 1916 wrote to memory of 1204 1916 jplxb.exe 42 PID 1916 wrote to memory of 1204 1916 jplxb.exe 42 PID 1916 wrote to memory of 1204 1916 jplxb.exe 42 PID 1204 wrote to memory of 1704 1204 rnhrj.exe 43 PID 1204 wrote to memory of 1704 1204 rnhrj.exe 43 PID 1204 wrote to memory of 1704 1204 rnhrj.exe 43 PID 1204 wrote to memory of 1704 1204 rnhrj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\nbnxdd.exec:\nbnxdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\jhnjdlx.exec:\jhnjdlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ldhtb.exec:\ldhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jhftpdr.exec:\jhftpdr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tjvdh.exec:\tjvdh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\lnlpxlr.exec:\lnlpxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\dnlnhnb.exec:\dnlnhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pljxt.exec:\pljxt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rxppnh.exec:\rxppnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fvtdnd.exec:\fvtdnd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\blltvj.exec:\blltvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\xnpll.exec:\xnpll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vjnfff.exec:\vjnfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jplxb.exec:\jplxb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rnhrj.exec:\rnhrj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\dfrvfp.exec:\dfrvfp.exe17⤵
- Executes dropped EXE
PID:1704 -
\??\c:\fhbdb.exec:\fhbdb.exe18⤵
- Executes dropped EXE
PID:2312 -
\??\c:\fppbx.exec:\fppbx.exe19⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vjhff.exec:\vjhff.exe20⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lhnxnxr.exec:\lhnxnxr.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bhbrhj.exec:\bhbrhj.exe22⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rtrxxh.exec:\rtrxxh.exe23⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tnlvr.exec:\tnlvr.exe24⤵
- Executes dropped EXE
PID:380 -
\??\c:\dxtdrlr.exec:\dxtdrlr.exe25⤵
- Executes dropped EXE
PID:400 -
\??\c:\nfxxjjn.exec:\nfxxjjn.exe26⤵
- Executes dropped EXE
PID:1848 -
\??\c:\bfnjdb.exec:\bfnjdb.exe27⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pvxjrxx.exec:\pvxjrxx.exe28⤵
- Executes dropped EXE
PID:684 -
\??\c:\tvthf.exec:\tvthf.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vbjlbx.exec:\vbjlbx.exe30⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jhlnd.exec:\jhlnd.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\bvhlxp.exec:\bvhlxp.exe32⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ndjnndx.exec:\ndjnndx.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lxftt.exec:\lxftt.exe34⤵
- Executes dropped EXE
PID:880 -
\??\c:\hbtxvht.exec:\hbtxvht.exe35⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fjndb.exec:\fjndb.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rrbxv.exec:\rrbxv.exe37⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vxlnxv.exec:\vxlnxv.exe38⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xnjpdn.exec:\xnjpdn.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vnpldlx.exec:\vnpldlx.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\ppxptx.exec:\ppxptx.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fdffvb.exec:\fdffvb.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\thnlbvj.exec:\thnlbvj.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nhdrr.exec:\nhdrr.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ttllp.exec:\ttllp.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pbbddnp.exec:\pbbddnp.exe46⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tvjhfx.exec:\tvjhfx.exe47⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ptlhnd.exec:\ptlhnd.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lfnrhl.exec:\lfnrhl.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xfdfl.exec:\xfdfl.exe50⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rxffvjn.exec:\rxffvjn.exe51⤵
- Executes dropped EXE
PID:840 -
\??\c:\jfxrj.exec:\jfxrj.exe52⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rrbpn.exec:\rrbpn.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\prbxtt.exec:\prbxtt.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nfbjf.exec:\nfbjf.exe55⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fvhpldn.exec:\fvhpldn.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tjvppxh.exec:\tjvppxh.exe57⤵
- Executes dropped EXE
PID:1100 -
\??\c:\frbnnxr.exec:\frbnnxr.exe58⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hjfhdlf.exec:\hjfhdlf.exe59⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xtnvx.exec:\xtnvx.exe60⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hrbjhfl.exec:\hrbjhfl.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lplhj.exec:\lplhj.exe62⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xrthpbr.exec:\xrthpbr.exe63⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jrbxdn.exec:\jrbxdn.exe64⤵
- Executes dropped EXE
PID:792 -
\??\c:\bxhfpx.exec:\bxhfpx.exe65⤵
- Executes dropped EXE
PID:2964 -
\??\c:\trfbj.exec:\trfbj.exe66⤵PID:2140
-
\??\c:\rvjfl.exec:\rvjfl.exe67⤵PID:436
-
\??\c:\dhrljt.exec:\dhrljt.exe68⤵PID:2328
-
\??\c:\vxdjxl.exec:\vxdjxl.exe69⤵PID:1792
-
\??\c:\dvbprh.exec:\dvbprh.exe70⤵PID:1428
-
\??\c:\xhfrbjt.exec:\xhfrbjt.exe71⤵PID:2136
-
\??\c:\rhbhn.exec:\rhbhn.exe72⤵PID:1668
-
\??\c:\nxvjptp.exec:\nxvjptp.exe73⤵PID:568
-
\??\c:\ldtfl.exec:\ldtfl.exe74⤵PID:2252
-
\??\c:\ftxrnp.exec:\ftxrnp.exe75⤵PID:1388
-
\??\c:\bjvnh.exec:\bjvnh.exe76⤵PID:1508
-
\??\c:\trbrfx.exec:\trbrfx.exe77⤵PID:2796
-
\??\c:\xrnhnx.exec:\xrnhnx.exe78⤵PID:2160
-
\??\c:\fjfbrvp.exec:\fjfbrvp.exe79⤵PID:2900
-
\??\c:\xhbtrh.exec:\xhbtrh.exe80⤵PID:1612
-
\??\c:\dxnrx.exec:\dxnrx.exe81⤵PID:1608
-
\??\c:\tfbbrbt.exec:\tfbbrbt.exe82⤵PID:2916
-
\??\c:\txnpfx.exec:\txnpfx.exe83⤵PID:2668
-
\??\c:\ljvdt.exec:\ljvdt.exe84⤵PID:2248
-
\??\c:\tbflnvv.exec:\tbflnvv.exe85⤵PID:2404
-
\??\c:\tdtvhxl.exec:\tdtvhxl.exe86⤵PID:2908
-
\??\c:\tbxdf.exec:\tbxdf.exe87⤵PID:2872
-
\??\c:\fdjnfp.exec:\fdjnfp.exe88⤵PID:2440
-
\??\c:\xbrjd.exec:\xbrjd.exe89⤵PID:2460
-
\??\c:\rrrbrr.exec:\rrrbrr.exe90⤵PID:2516
-
\??\c:\nrjrfb.exec:\nrjrfb.exe91⤵PID:2904
-
\??\c:\hnfvdf.exec:\hnfvdf.exe92⤵PID:1348
-
\??\c:\pvtfv.exec:\pvtfv.exe93⤵PID:392
-
\??\c:\jpthrd.exec:\jpthrd.exe94⤵PID:848
-
\??\c:\rxfprb.exec:\rxfprb.exe95⤵PID:1688
-
\??\c:\htfjldl.exec:\htfjldl.exe96⤵PID:1592
-
\??\c:\lhlfb.exec:\lhlfb.exe97⤵PID:1184
-
\??\c:\trnljfl.exec:\trnljfl.exe98⤵PID:2008
-
\??\c:\dbrpfj.exec:\dbrpfj.exe99⤵PID:1916
-
\??\c:\ftxlpd.exec:\ftxlpd.exe100⤵PID:1172
-
\??\c:\nbbhjb.exec:\nbbhjb.exe101⤵PID:2232
-
\??\c:\dhljpv.exec:\dhljpv.exe102⤵PID:1180
-
\??\c:\ntjnrhd.exec:\ntjnrhd.exe103⤵PID:2312
-
\??\c:\nhxtd.exec:\nhxtd.exe104⤵PID:1536
-
\??\c:\xbblb.exec:\xbblb.exe105⤵PID:3052
-
\??\c:\plbvjf.exec:\plbvjf.exe106⤵PID:2736
-
\??\c:\hvvnbxl.exec:\hvvnbxl.exe107⤵PID:2776
-
\??\c:\vnjjd.exec:\vnjjd.exe108⤵PID:756
-
\??\c:\jndnnr.exec:\jndnnr.exe109⤵PID:672
-
\??\c:\vxlnn.exec:\vxlnn.exe110⤵PID:792
-
\??\c:\npntv.exec:\npntv.exe111⤵PID:3068
-
\??\c:\lldtx.exec:\lldtx.exe112⤵PID:2140
-
\??\c:\ppptvt.exec:\ppptvt.exe113⤵PID:1052
-
\??\c:\xjnfvr.exec:\xjnfvr.exe114⤵PID:1848
-
\??\c:\hhrvnr.exec:\hhrvnr.exe115⤵PID:2328
-
\??\c:\vnthldh.exec:\vnthldh.exe116⤵PID:1792
-
\??\c:\djrbf.exec:\djrbf.exe117⤵PID:1428
-
\??\c:\rjbdnr.exec:\rjbdnr.exe118⤵PID:2136
-
\??\c:\vhldvl.exec:\vhldvl.exe119⤵PID:1344
-
\??\c:\xjxfh.exec:\xjxfh.exe120⤵PID:568
-
\??\c:\lfxllr.exec:\lfxllr.exe121⤵PID:2492
-
\??\c:\lprdf.exec:\lprdf.exe122⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-