Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 08:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe
-
Size
372KB
-
MD5
005f60af1ad9167ea24c61a4532d007f
-
SHA1
2a93056d9ec4f99897f363013d9f8b74354a1041
-
SHA256
0bbc0a39084dfd5d42b29846fad0598355461116c8cd1437cd47123757b8e1f7
-
SHA512
d34ac72f2291854dba8606f2ee6228187e05112dc0276716056c943a4d06a842153c7beee4b56a1d8cb39899643883c6ec4442a3819fa0d4ebbd481523f7cf1c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QOhsJ4BCW6EX8t:n3C9BRo7MlrWKo+lBhI
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral1/memory/2924-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1176-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-493-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-599-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-629-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-645-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2996 jpddp.exe 2976 1bbhnt.exe 2616 thbhbb.exe 2652 ddvjv.exe 2500 tnhhtb.exe 2476 3nhntb.exe 2352 fxflrlx.exe 2800 vjjvv.exe 1556 ttthbn.exe 1360 rrllxfl.exe 1348 3bnttt.exe 2304 xrfrxxx.exe 352 jjjvp.exe 2104 7vjjj.exe 1740 bnhhtb.exe 1224 xxrfrrf.exe 1952 vpjjj.exe 2776 hhnnnn.exe 528 frxfrfx.exe 980 tnhnbb.exe 812 ppjvp.exe 3028 9frrffr.exe 1176 pdjpp.exe 1204 btnttb.exe 1536 ffxxflr.exe 660 bbtbtt.exe 3060 ffrrxlf.exe 2196 hhtbbh.exe 2908 hhntnt.exe 1428 xrlrfrf.exe 1964 vddpp.exe 1520 5nbhnn.exe 2448 3lfxrfx.exe 2540 djvdv.exe 2432 7xrxlrx.exe 2612 vpdpd.exe 2376 ffxfrrl.exe 2812 tnhhtb.exe 2452 9lxfflx.exe 2404 btntnb.exe 2060 xfllxfr.exe 2272 hbhntt.exe 2228 ddppd.exe 1580 btnhnh.exe 1060 vdvjv.exe 2260 fxlxlrx.exe 1348 1hbhnt.exe 2304 rrlxlrf.exe 2256 dvjjp.exe 1560 7lllrlr.exe 1256 ppdjp.exe 2044 flflflx.exe 2148 vpdpj.exe 2200 llrxrxr.exe 672 bttbnt.exe 2084 vvjpd.exe 936 lllxrxf.exe 1624 thntnt.exe 2960 rffffrl.exe 2312 dddvj.exe 1976 nnbtnn.exe 1912 dvdpd.exe 1232 1bttth.exe 332 pvjdd.exe -
resource yara_rule behavioral1/memory/2924-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1176-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/660-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-478-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-493-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-523-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-531-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-554-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-583-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-599-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-598-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-629-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-628-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-644-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-645-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-660-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2996 2924 005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe 28 PID 2924 wrote to memory of 2996 2924 005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe 28 PID 2924 wrote to memory of 2996 2924 005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe 28 PID 2924 wrote to memory of 2996 2924 005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe 28 PID 2996 wrote to memory of 2976 2996 jpddp.exe 29 PID 2996 wrote to memory of 2976 2996 jpddp.exe 29 PID 2996 wrote to memory of 2976 2996 jpddp.exe 29 PID 2996 wrote to memory of 2976 2996 jpddp.exe 29 PID 2976 wrote to memory of 2616 2976 1bbhnt.exe 30 PID 2976 wrote to memory of 2616 2976 1bbhnt.exe 30 PID 2976 wrote to memory of 2616 2976 1bbhnt.exe 30 PID 2976 wrote to memory of 2616 2976 1bbhnt.exe 30 PID 2616 wrote to memory of 2652 2616 thbhbb.exe 31 PID 2616 wrote to memory of 2652 2616 thbhbb.exe 31 PID 2616 wrote to memory of 2652 2616 thbhbb.exe 31 PID 2616 wrote to memory of 2652 2616 thbhbb.exe 31 PID 2652 wrote to memory of 2500 2652 ddvjv.exe 32 PID 2652 wrote to memory of 2500 2652 ddvjv.exe 32 PID 2652 wrote to memory of 2500 2652 ddvjv.exe 32 PID 2652 wrote to memory of 2500 2652 ddvjv.exe 32 PID 2500 wrote to memory of 2476 2500 tnhhtb.exe 33 PID 2500 wrote to memory of 2476 2500 tnhhtb.exe 33 PID 2500 wrote to memory of 2476 2500 tnhhtb.exe 33 PID 2500 wrote to memory of 2476 2500 tnhhtb.exe 33 PID 2476 wrote to memory of 2352 2476 3nhntb.exe 34 PID 2476 wrote to memory of 2352 2476 3nhntb.exe 34 PID 2476 wrote to memory of 2352 2476 3nhntb.exe 34 PID 2476 wrote to memory of 2352 2476 3nhntb.exe 34 PID 2352 wrote to memory of 2800 2352 fxflrlx.exe 35 PID 2352 wrote to memory of 2800 2352 fxflrlx.exe 35 PID 2352 wrote to memory of 2800 2352 fxflrlx.exe 35 PID 2352 wrote to memory of 2800 2352 fxflrlx.exe 35 PID 2800 wrote to memory of 1556 2800 vjjvv.exe 36 PID 2800 wrote to memory of 1556 2800 vjjvv.exe 36 PID 2800 wrote to memory of 1556 2800 vjjvv.exe 36 PID 2800 wrote to memory of 1556 2800 vjjvv.exe 36 PID 1556 wrote to memory of 1360 1556 ttthbn.exe 37 PID 1556 wrote to memory of 1360 1556 ttthbn.exe 37 PID 1556 wrote to memory of 1360 1556 ttthbn.exe 37 PID 1556 wrote to memory of 1360 1556 ttthbn.exe 37 PID 1360 wrote to memory of 1348 1360 rrllxfl.exe 38 PID 1360 wrote to memory of 1348 1360 rrllxfl.exe 38 PID 1360 wrote to memory of 1348 1360 rrllxfl.exe 38 PID 1360 wrote to memory of 1348 1360 rrllxfl.exe 38 PID 1348 wrote to memory of 2304 1348 3bnttt.exe 39 PID 1348 wrote to memory of 2304 1348 3bnttt.exe 39 PID 1348 wrote to memory of 2304 1348 3bnttt.exe 39 PID 1348 wrote to memory of 2304 1348 3bnttt.exe 39 PID 2304 wrote to memory of 352 2304 xrfrxxx.exe 40 PID 2304 wrote to memory of 352 2304 xrfrxxx.exe 40 PID 2304 wrote to memory of 352 2304 xrfrxxx.exe 40 PID 2304 wrote to memory of 352 2304 xrfrxxx.exe 40 PID 352 wrote to memory of 2104 352 jjjvp.exe 41 PID 352 wrote to memory of 2104 352 jjjvp.exe 41 PID 352 wrote to memory of 2104 352 jjjvp.exe 41 PID 352 wrote to memory of 2104 352 jjjvp.exe 41 PID 2104 wrote to memory of 1740 2104 7vjjj.exe 42 PID 2104 wrote to memory of 1740 2104 7vjjj.exe 42 PID 2104 wrote to memory of 1740 2104 7vjjj.exe 42 PID 2104 wrote to memory of 1740 2104 7vjjj.exe 42 PID 1740 wrote to memory of 1224 1740 bnhhtb.exe 43 PID 1740 wrote to memory of 1224 1740 bnhhtb.exe 43 PID 1740 wrote to memory of 1224 1740 bnhhtb.exe 43 PID 1740 wrote to memory of 1224 1740 bnhhtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\jpddp.exec:\jpddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\1bbhnt.exec:\1bbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\thbhbb.exec:\thbhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ddvjv.exec:\ddvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\tnhhtb.exec:\tnhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\3nhntb.exec:\3nhntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\fxflrlx.exec:\fxflrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vjjvv.exec:\vjjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ttthbn.exec:\ttthbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\rrllxfl.exec:\rrllxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\3bnttt.exec:\3bnttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\xrfrxxx.exec:\xrfrxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\jjjvp.exec:\jjjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\7vjjj.exec:\7vjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bnhhtb.exec:\bnhhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe17⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vpjjj.exec:\vpjjj.exe18⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hhnnnn.exec:\hhnnnn.exe19⤵
- Executes dropped EXE
PID:2776 -
\??\c:\frxfrfx.exec:\frxfrfx.exe20⤵
- Executes dropped EXE
PID:528 -
\??\c:\tnhnbb.exec:\tnhnbb.exe21⤵
- Executes dropped EXE
PID:980 -
\??\c:\ppjvp.exec:\ppjvp.exe22⤵
- Executes dropped EXE
PID:812 -
\??\c:\9frrffr.exec:\9frrffr.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pdjpp.exec:\pdjpp.exe24⤵
- Executes dropped EXE
PID:1176 -
\??\c:\btnttb.exec:\btnttb.exe25⤵
- Executes dropped EXE
PID:1204 -
\??\c:\ffxxflr.exec:\ffxxflr.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bbtbtt.exec:\bbtbtt.exe27⤵
- Executes dropped EXE
PID:660 -
\??\c:\ffrrxlf.exec:\ffrrxlf.exe28⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhtbbh.exec:\hhtbbh.exe29⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hhntnt.exec:\hhntnt.exe30⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe31⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vddpp.exec:\vddpp.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5nbhnn.exec:\5nbhnn.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3lfxrfx.exec:\3lfxrfx.exe34⤵
- Executes dropped EXE
PID:2448 -
\??\c:\djvdv.exec:\djvdv.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7xrxlrx.exec:\7xrxlrx.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpdpd.exec:\vpdpd.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe38⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tnhhtb.exec:\tnhhtb.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\9lxfflx.exec:\9lxfflx.exe40⤵
- Executes dropped EXE
PID:2452 -
\??\c:\btntnb.exec:\btntnb.exe41⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xfllxfr.exec:\xfllxfr.exe42⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbhntt.exec:\hbhntt.exe43⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ddppd.exec:\ddppd.exe44⤵
- Executes dropped EXE
PID:2228 -
\??\c:\btnhnh.exec:\btnhnh.exe45⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vdvjv.exec:\vdvjv.exe46⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fxlxlrx.exec:\fxlxlrx.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1hbhnt.exec:\1hbhnt.exe48⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe49⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dvjjp.exec:\dvjjp.exe50⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7lllrlr.exec:\7lllrlr.exe51⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ppdjp.exec:\ppdjp.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\flflflx.exec:\flflflx.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vpdpj.exec:\vpdpj.exe54⤵
- Executes dropped EXE
PID:2148 -
\??\c:\llrxrxr.exec:\llrxrxr.exe55⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bttbnt.exec:\bttbnt.exe56⤵
- Executes dropped EXE
PID:672 -
\??\c:\vvjpd.exec:\vvjpd.exe57⤵
- Executes dropped EXE
PID:2084 -
\??\c:\lllxrxf.exec:\lllxrxf.exe58⤵
- Executes dropped EXE
PID:936 -
\??\c:\thntnt.exec:\thntnt.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rffffrl.exec:\rffffrl.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dddvj.exec:\dddvj.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nnbtnn.exec:\nnbtnn.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvdpd.exec:\dvdpd.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1bttth.exec:\1bttth.exe64⤵
- Executes dropped EXE
PID:1232 -
\??\c:\pvjdd.exec:\pvjdd.exe65⤵
- Executes dropped EXE
PID:332 -
\??\c:\rfxffrx.exec:\rfxffrx.exe66⤵PID:1564
-
\??\c:\dvdpd.exec:\dvdpd.exe67⤵PID:2140
-
\??\c:\9tbnbn.exec:\9tbnbn.exe68⤵PID:1688
-
\??\c:\xfrfxxl.exec:\xfrfxxl.exe69⤵PID:2176
-
\??\c:\9htthh.exec:\9htthh.exe70⤵PID:884
-
\??\c:\hbhntt.exec:\hbhntt.exe71⤵PID:2032
-
\??\c:\vpjjp.exec:\vpjjp.exe72⤵PID:2704
-
\??\c:\1tbttt.exec:\1tbttt.exe73⤵PID:1496
-
\??\c:\dpjdp.exec:\dpjdp.exe74⤵PID:2996
-
\??\c:\5hnnnt.exec:\5hnnnt.exe75⤵PID:2976
-
\??\c:\pjvpv.exec:\pjvpv.exe76⤵PID:2548
-
\??\c:\bthhnn.exec:\bthhnn.exe77⤵PID:2616
-
\??\c:\dvpjj.exec:\dvpjj.exe78⤵PID:2368
-
\??\c:\frfflll.exec:\frfflll.exe79⤵PID:2528
-
\??\c:\pjdpv.exec:\pjdpv.exe80⤵PID:2812
-
\??\c:\rfxxllx.exec:\rfxxllx.exe81⤵PID:2792
-
\??\c:\9vppd.exec:\9vppd.exe82⤵PID:2404
-
\??\c:\bbttnh.exec:\bbttnh.exe83⤵PID:2412
-
\??\c:\xxrllxr.exec:\xxrllxr.exe84⤵PID:1792
-
\??\c:\bbhntt.exec:\bbhntt.exe85⤵PID:296
-
\??\c:\7dvvj.exec:\7dvvj.exe86⤵PID:1800
-
\??\c:\xxxllrl.exec:\xxxllrl.exe87⤵PID:2328
-
\??\c:\btntbh.exec:\btntbh.exe88⤵PID:2260
-
\??\c:\rlxfllx.exec:\rlxfllx.exe89⤵PID:2124
-
\??\c:\tnbtht.exec:\tnbtht.exe90⤵PID:1788
-
\??\c:\fxrrrll.exec:\fxrrrll.exe91⤵PID:1768
-
\??\c:\pdppv.exec:\pdppv.exe92⤵PID:1652
-
\??\c:\lxlrffl.exec:\lxlrffl.exe93⤵PID:2040
-
\??\c:\hnbhtb.exec:\hnbhtb.exe94⤵PID:1200
-
\??\c:\rlflxfl.exec:\rlflxfl.exe95⤵PID:536
-
\??\c:\pppdv.exec:\pppdv.exe96⤵PID:1408
-
\??\c:\lrflrll.exec:\lrflrll.exe97⤵PID:2944
-
\??\c:\vdvpd.exec:\vdvpd.exe98⤵PID:1456
-
\??\c:\5dppv.exec:\5dppv.exe99⤵PID:1480
-
\??\c:\3bhtnb.exec:\3bhtnb.exe100⤵PID:2840
-
\??\c:\7dpjp.exec:\7dpjp.exe101⤵PID:1660
-
\??\c:\nhhhbh.exec:\nhhhbh.exe102⤵PID:2960
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe103⤵PID:2748
-
\??\c:\5bbnbh.exec:\5bbnbh.exe104⤵PID:1460
-
\??\c:\pdvvd.exec:\pdvvd.exe105⤵PID:2016
-
\??\c:\hhbbbn.exec:\hhbbbn.exe106⤵PID:948
-
\??\c:\ppjpv.exec:\ppjpv.exe107⤵PID:2772
-
\??\c:\hhbnht.exec:\hhbnht.exe108⤵PID:2076
-
\??\c:\7jvjd.exec:\7jvjd.exe109⤵PID:1968
-
\??\c:\1lfrxfl.exec:\1lfrxfl.exe110⤵PID:988
-
\??\c:\jdjpp.exec:\jdjpp.exe111⤵PID:840
-
\??\c:\tnbntb.exec:\tnbntb.exe112⤵PID:2168
-
\??\c:\vdvdd.exec:\vdvdd.exe113⤵PID:1428
-
\??\c:\tnbbhh.exec:\tnbbhh.exe114⤵PID:2980
-
\??\c:\dvjdv.exec:\dvjdv.exe115⤵PID:3048
-
\??\c:\7tnbbh.exec:\7tnbbh.exe116⤵PID:2888
-
\??\c:\flfffff.exec:\flfffff.exe117⤵PID:2492
-
\??\c:\jdjpd.exec:\jdjpd.exe118⤵PID:2496
-
\??\c:\fxflflx.exec:\fxflflx.exe119⤵PID:2484
-
\??\c:\hhbnbh.exec:\hhbnbh.exe120⤵PID:2612
-
\??\c:\rfxrllx.exec:\rfxrllx.exe121⤵PID:2220
-
\??\c:\thtthh.exec:\thtthh.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-