Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 08:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe
-
Size
215KB
-
MD5
16c404b1b2457e774eef9decec245e74
-
SHA1
2a941d253d0088f487f5838a585247ea84aaf8b6
-
SHA256
19c238f30458b392902f9bfe66d65ab0d72e6964ba648faca28902907ffddcb2
-
SHA512
a3d8019f0027813b144b88cb58ea3a7a365675bb0fca773fee66efa9be4c5c9621789b5485035470f4bc015dc2a98d9ba7250078149f6fc5a22d5ac6942e70cc
-
SSDEEP
1536:evQBeOGtrYSSsrc93UBIfdC67m6AJiqzgLrTKBk3IU39TeYmKH:ehOm2sI93UufdC67ciRLPvx3teYmS
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2776-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-19-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2272-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-60-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2416-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-119-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-304-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2888-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-336-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2728-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-417-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-459-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-486-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-664-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-686-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2272 vhrhfrt.exe 1616 lnddxld.exe 2920 xfxnd.exe 2688 bxddlv.exe 2416 dltjf.exe 2704 vtftv.exe 2600 rnptld.exe 2412 vvjfjtd.exe 2320 thrfptn.exe 2356 jphlp.exe 1372 pnttxr.exe 2396 vttfht.exe 2732 lbfhhj.exe 1996 dhttpjr.exe 1500 bhddth.exe 1780 dfptpr.exe 1820 trffjvf.exe 1796 rddrh.exe 1036 phlbhv.exe 2084 dhlfndv.exe 2248 jbjpdr.exe 1512 dtnff.exe 2112 hjjjt.exe 428 htptppx.exe 944 hpjnbp.exe 1544 xhrpv.exe 964 xrflth.exe 2328 hpbjx.exe 876 fjlprf.exe 2136 jfxvhh.exe 2888 ndlbrn.exe 1744 xjljpd.exe 1288 djnjf.exe 2828 jvldl.exe 2776 rxrjrd.exe 1532 hljnrl.exe 2728 ntrvtxf.exe 2556 hlhltt.exe 2716 bphdrpn.exe 2944 thrdr.exe 2540 vhpdf.exe 2436 pbbvlh.exe 2576 txxlbjv.exe 2520 rndtx.exe 2440 xdpnljl.exe 2484 fndht.exe 1048 hnxhlx.exe 704 hdtdb.exe 1644 vnrlb.exe 1372 brjdnvh.exe 840 tnbxhxp.exe 1968 prfdf.exe 1976 hbjbhbd.exe 1676 jxxjj.exe 1500 hjrrb.exe 604 hnttjfj.exe 1852 jldjf.exe 1700 fbvtvj.exe 932 ltbpvnl.exe 3048 lpdlllf.exe 768 xhnfpj.exe 2076 lvxlv.exe 744 dljtnp.exe 2188 xbbdl.exe -
resource yara_rule behavioral1/memory/2776-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-36-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2704-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-336-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2556-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-610-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1612-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-686-0x0000000000220000-0x000000000024A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2272 2776 16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe 28 PID 2776 wrote to memory of 2272 2776 16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe 28 PID 2776 wrote to memory of 2272 2776 16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe 28 PID 2776 wrote to memory of 2272 2776 16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe 28 PID 2272 wrote to memory of 1616 2272 vhrhfrt.exe 29 PID 2272 wrote to memory of 1616 2272 vhrhfrt.exe 29 PID 2272 wrote to memory of 1616 2272 vhrhfrt.exe 29 PID 2272 wrote to memory of 1616 2272 vhrhfrt.exe 29 PID 1616 wrote to memory of 2920 1616 lnddxld.exe 30 PID 1616 wrote to memory of 2920 1616 lnddxld.exe 30 PID 1616 wrote to memory of 2920 1616 lnddxld.exe 30 PID 1616 wrote to memory of 2920 1616 lnddxld.exe 30 PID 2920 wrote to memory of 2688 2920 xfxnd.exe 31 PID 2920 wrote to memory of 2688 2920 xfxnd.exe 31 PID 2920 wrote to memory of 2688 2920 xfxnd.exe 31 PID 2920 wrote to memory of 2688 2920 xfxnd.exe 31 PID 2688 wrote to memory of 2416 2688 bxddlv.exe 32 PID 2688 wrote to memory of 2416 2688 bxddlv.exe 32 PID 2688 wrote to memory of 2416 2688 bxddlv.exe 32 PID 2688 wrote to memory of 2416 2688 bxddlv.exe 32 PID 2416 wrote to memory of 2704 2416 dltjf.exe 33 PID 2416 wrote to memory of 2704 2416 dltjf.exe 33 PID 2416 wrote to memory of 2704 2416 dltjf.exe 33 PID 2416 wrote to memory of 2704 2416 dltjf.exe 33 PID 2704 wrote to memory of 2600 2704 vtftv.exe 34 PID 2704 wrote to memory of 2600 2704 vtftv.exe 34 PID 2704 wrote to memory of 2600 2704 vtftv.exe 34 PID 2704 wrote to memory of 2600 2704 vtftv.exe 34 PID 2600 wrote to memory of 2412 2600 rnptld.exe 35 PID 2600 wrote to memory of 2412 2600 rnptld.exe 35 PID 2600 wrote to memory of 2412 2600 rnptld.exe 35 PID 2600 wrote to memory of 2412 2600 rnptld.exe 35 PID 2412 wrote to memory of 2320 2412 vvjfjtd.exe 36 PID 2412 wrote to memory of 2320 2412 vvjfjtd.exe 36 PID 2412 wrote to memory of 2320 2412 vvjfjtd.exe 36 PID 2412 wrote to memory of 2320 2412 vvjfjtd.exe 36 PID 2320 wrote to memory of 2356 2320 thrfptn.exe 37 PID 2320 wrote to memory of 2356 2320 thrfptn.exe 37 PID 2320 wrote to memory of 2356 2320 thrfptn.exe 37 PID 2320 wrote to memory of 2356 2320 thrfptn.exe 37 PID 2356 wrote to memory of 1372 2356 jphlp.exe 38 PID 2356 wrote to memory of 1372 2356 jphlp.exe 38 PID 2356 wrote to memory of 1372 2356 jphlp.exe 38 PID 2356 wrote to memory of 1372 2356 jphlp.exe 38 PID 1372 wrote to memory of 2396 1372 pnttxr.exe 39 PID 1372 wrote to memory of 2396 1372 pnttxr.exe 39 PID 1372 wrote to memory of 2396 1372 pnttxr.exe 39 PID 1372 wrote to memory of 2396 1372 pnttxr.exe 39 PID 2396 wrote to memory of 2732 2396 vttfht.exe 40 PID 2396 wrote to memory of 2732 2396 vttfht.exe 40 PID 2396 wrote to memory of 2732 2396 vttfht.exe 40 PID 2396 wrote to memory of 2732 2396 vttfht.exe 40 PID 2732 wrote to memory of 1996 2732 lbfhhj.exe 41 PID 2732 wrote to memory of 1996 2732 lbfhhj.exe 41 PID 2732 wrote to memory of 1996 2732 lbfhhj.exe 41 PID 2732 wrote to memory of 1996 2732 lbfhhj.exe 41 PID 1996 wrote to memory of 1500 1996 dhttpjr.exe 42 PID 1996 wrote to memory of 1500 1996 dhttpjr.exe 42 PID 1996 wrote to memory of 1500 1996 dhttpjr.exe 42 PID 1996 wrote to memory of 1500 1996 dhttpjr.exe 42 PID 1500 wrote to memory of 1780 1500 bhddth.exe 43 PID 1500 wrote to memory of 1780 1500 bhddth.exe 43 PID 1500 wrote to memory of 1780 1500 bhddth.exe 43 PID 1500 wrote to memory of 1780 1500 bhddth.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vhrhfrt.exec:\vhrhfrt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\lnddxld.exec:\lnddxld.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\xfxnd.exec:\xfxnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\bxddlv.exec:\bxddlv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dltjf.exec:\dltjf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vtftv.exec:\vtftv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rnptld.exec:\rnptld.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vvjfjtd.exec:\vvjfjtd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\thrfptn.exec:\thrfptn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jphlp.exec:\jphlp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pnttxr.exec:\pnttxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\vttfht.exec:\vttfht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\lbfhhj.exec:\lbfhhj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dhttpjr.exec:\dhttpjr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\bhddth.exec:\bhddth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\dfptpr.exec:\dfptpr.exe17⤵
- Executes dropped EXE
PID:1780 -
\??\c:\trffjvf.exec:\trffjvf.exe18⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rddrh.exec:\rddrh.exe19⤵
- Executes dropped EXE
PID:1796 -
\??\c:\phlbhv.exec:\phlbhv.exe20⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dhlfndv.exec:\dhlfndv.exe21⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jbjpdr.exec:\jbjpdr.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dtnff.exec:\dtnff.exe23⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hjjjt.exec:\hjjjt.exe24⤵
- Executes dropped EXE
PID:2112 -
\??\c:\htptppx.exec:\htptppx.exe25⤵
- Executes dropped EXE
PID:428 -
\??\c:\hpjnbp.exec:\hpjnbp.exe26⤵
- Executes dropped EXE
PID:944 -
\??\c:\xhrpv.exec:\xhrpv.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xrflth.exec:\xrflth.exe28⤵
- Executes dropped EXE
PID:964 -
\??\c:\hpbjx.exec:\hpbjx.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fjlprf.exec:\fjlprf.exe30⤵
- Executes dropped EXE
PID:876 -
\??\c:\jfxvhh.exec:\jfxvhh.exe31⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ndlbrn.exec:\ndlbrn.exe32⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xjljpd.exec:\xjljpd.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djnjf.exec:\djnjf.exe34⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jvldl.exec:\jvldl.exe35⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rxrjrd.exec:\rxrjrd.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hljnrl.exec:\hljnrl.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ntrvtxf.exec:\ntrvtxf.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hlhltt.exec:\hlhltt.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bphdrpn.exec:\bphdrpn.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\thrdr.exec:\thrdr.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vhpdf.exec:\vhpdf.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pbbvlh.exec:\pbbvlh.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\txxlbjv.exec:\txxlbjv.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rndtx.exec:\rndtx.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xdpnljl.exec:\xdpnljl.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fndht.exec:\fndht.exe47⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hnxhlx.exec:\hnxhlx.exe48⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hdtdb.exec:\hdtdb.exe49⤵
- Executes dropped EXE
PID:704 -
\??\c:\vnrlb.exec:\vnrlb.exe50⤵
- Executes dropped EXE
PID:1644 -
\??\c:\brjdnvh.exec:\brjdnvh.exe51⤵
- Executes dropped EXE
PID:1372 -
\??\c:\tnbxhxp.exec:\tnbxhxp.exe52⤵
- Executes dropped EXE
PID:840 -
\??\c:\prfdf.exec:\prfdf.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hbjbhbd.exec:\hbjbhbd.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jxxjj.exec:\jxxjj.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hjrrb.exec:\hjrrb.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hnttjfj.exec:\hnttjfj.exe57⤵
- Executes dropped EXE
PID:604 -
\??\c:\jldjf.exec:\jldjf.exe58⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fbvtvj.exec:\fbvtvj.exe59⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ltbpvnl.exec:\ltbpvnl.exe60⤵
- Executes dropped EXE
PID:932 -
\??\c:\lpdlllf.exec:\lpdlllf.exe61⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xhnfpj.exec:\xhnfpj.exe62⤵
- Executes dropped EXE
PID:768 -
\??\c:\lvxlv.exec:\lvxlv.exe63⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dljtnp.exec:\dljtnp.exe64⤵
- Executes dropped EXE
PID:744 -
\??\c:\xbbdl.exec:\xbbdl.exe65⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lnbbjb.exec:\lnbbjb.exe66⤵PID:2132
-
\??\c:\nxvpddf.exec:\nxvpddf.exe67⤵PID:1328
-
\??\c:\vbbbdb.exec:\vbbbdb.exe68⤵PID:2020
-
\??\c:\hldjh.exec:\hldjh.exe69⤵PID:1336
-
\??\c:\ljfjp.exec:\ljfjp.exe70⤵PID:1604
-
\??\c:\lxpvrfv.exec:\lxpvrfv.exe71⤵PID:2036
-
\??\c:\lndjl.exec:\lndjl.exe72⤵PID:892
-
\??\c:\vdtnvd.exec:\vdtnvd.exe73⤵PID:624
-
\??\c:\tdnhdd.exec:\tdnhdd.exe74⤵PID:2220
-
\??\c:\rdvxb.exec:\rdvxb.exe75⤵PID:692
-
\??\c:\bndlf.exec:\bndlf.exe76⤵PID:1632
-
\??\c:\nhtfb.exec:\nhtfb.exe77⤵PID:1488
-
\??\c:\vdvdpl.exec:\vdvdpl.exe78⤵PID:2952
-
\??\c:\thrnrl.exec:\thrnrl.exe79⤵PID:2000
-
\??\c:\thftx.exec:\thftx.exe80⤵PID:2776
-
\??\c:\rtnvpd.exec:\rtnvpd.exe81⤵PID:2596
-
\??\c:\vhtlj.exec:\vhtlj.exe82⤵PID:1592
-
\??\c:\jjjxv.exec:\jjjxv.exe83⤵PID:1612
-
\??\c:\ntpjld.exec:\ntpjld.exe84⤵PID:2920
-
\??\c:\vrlbnhr.exec:\vrlbnhr.exe85⤵PID:2688
-
\??\c:\vnfhv.exec:\vnfhv.exe86⤵PID:2712
-
\??\c:\dnrlrf.exec:\dnrlrf.exe87⤵PID:2764
-
\??\c:\txbdjf.exec:\txbdjf.exe88⤵PID:2684
-
\??\c:\lnvdhtl.exec:\lnvdhtl.exe89⤵PID:2464
-
\??\c:\ptjll.exec:\ptjll.exe90⤵PID:2268
-
\??\c:\ppxxnl.exec:\ppxxnl.exe91⤵PID:2480
-
\??\c:\frjjfx.exec:\frjjfx.exe92⤵PID:3024
-
\??\c:\rbhtd.exec:\rbhtd.exe93⤵PID:1628
-
\??\c:\hpvhtnx.exec:\hpvhtnx.exe94⤵PID:572
-
\??\c:\vhdfll.exec:\vhdfll.exe95⤵PID:2648
-
\??\c:\xtxfdp.exec:\xtxfdp.exe96⤵PID:2624
-
\??\c:\xhfbhj.exec:\xhfbhj.exe97⤵PID:1932
-
\??\c:\xdlpx.exec:\xdlpx.exe98⤵PID:1804
-
\??\c:\jxjjbjj.exec:\jxjjbjj.exe99⤵PID:1300
-
\??\c:\nrxdp.exec:\nrxdp.exe100⤵PID:1264
-
\??\c:\fvnjrtj.exec:\fvnjrtj.exe101⤵PID:1296
-
\??\c:\dtpbpf.exec:\dtpbpf.exe102⤵PID:2240
-
\??\c:\dffnfb.exec:\dffnfb.exe103⤵PID:604
-
\??\c:\ntbvr.exec:\ntbvr.exe104⤵PID:1740
-
\??\c:\pnfjnbj.exec:\pnfjnbj.exe105⤵PID:2080
-
\??\c:\xnrvr.exec:\xnrvr.exe106⤵PID:1736
-
\??\c:\xlxjtt.exec:\xlxjtt.exe107⤵PID:660
-
\??\c:\btbprr.exec:\btbprr.exe108⤵PID:676
-
\??\c:\ltrjnhd.exec:\ltrjnhd.exe109⤵PID:2248
-
\??\c:\vtxhbl.exec:\vtxhbl.exe110⤵PID:2060
-
\??\c:\jlrlt.exec:\jlrlt.exe111⤵PID:2112
-
\??\c:\fllnlp.exec:\fllnlp.exe112⤵PID:440
-
\??\c:\xxbhbxb.exec:\xxbhbxb.exe113⤵PID:600
-
\??\c:\bphrvbh.exec:\bphrvbh.exe114⤵PID:968
-
\??\c:\lvnvx.exec:\lvnvx.exe115⤵PID:2128
-
\??\c:\jtvbrn.exec:\jtvbrn.exe116⤵PID:1316
-
\??\c:\bpdbdb.exec:\bpdbdb.exe117⤵PID:2328
-
\??\c:\nxbjjl.exec:\nxbjjl.exe118⤵PID:2164
-
\??\c:\jxbhtlb.exec:\jxbhtlb.exe119⤵PID:1668
-
\??\c:\xtjhlxt.exec:\xtjhlxt.exe120⤵PID:2880
-
\??\c:\ltxxb.exec:\ltxxb.exe121⤵PID:2888
-
\??\c:\hldpxf.exec:\hldpxf.exe122⤵PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-