Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 08:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
Errors
Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-26T08:28:46Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_11-dirty.qcow2\"}"
General
-
Target
005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe
-
Size
372KB
-
MD5
005f60af1ad9167ea24c61a4532d007f
-
SHA1
2a93056d9ec4f99897f363013d9f8b74354a1041
-
SHA256
0bbc0a39084dfd5d42b29846fad0598355461116c8cd1437cd47123757b8e1f7
-
SHA512
d34ac72f2291854dba8606f2ee6228187e05112dc0276716056c943a4d06a842153c7beee4b56a1d8cb39899643883c6ec4442a3819fa0d4ebbd481523f7cf1c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QOhsJ4BCW6EX8t:n3C9BRo7MlrWKo+lBhI
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral2/memory/4780-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-460-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-557-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4264 ddvpv.exe 4576 ddvvj.exe 1232 lxxrlfl.exe 4808 dpvvp.exe 8 vpddd.exe 1484 7tttbh.exe 2016 tbntth.exe 4656 hbbhhn.exe 2300 flrllll.exe 624 424006.exe 1768 20848.exe 4320 1hntnt.exe 5068 hthhbt.exe 1668 5fxrllf.exe 3256 848044.exe 4068 86842.exe 3060 04008.exe 1136 bthbbt.exe 4240 9lxrlxr.exe 3776 s6066.exe 4716 242222.exe 5064 llrfrfl.exe 3556 jdvpp.exe 4692 lffffxx.exe 3628 46808.exe 4152 4482660.exe 4056 622001h.exe 5080 280040.exe 3152 480400.exe 2480 nnbbbb.exe 4476 e48688.exe 4816 rxxxxxx.exe 4780 rllrllx.exe 1500 djjdj.exe 2380 0066666.exe 2032 tnnntb.exe 3236 jvddv.exe 2464 6026668.exe 3660 bthntn.exe 4024 48842.exe 5020 6460600.exe 2420 rlrrrrl.exe 3288 9htttn.exe 1780 rlxxlfl.exe 3252 tnnhbt.exe 916 60084.exe 4644 m0042.exe 3672 xxlrflr.exe 4844 hbhnnn.exe 712 402004.exe 4324 8882604.exe 4668 64266.exe 3172 4048822.exe 3516 xlllfff.exe 4240 bnhhbt.exe 2132 806604.exe 4936 4408282.exe 1404 djvpj.exe 1444 pjdvp.exe 3556 00600.exe 3240 24604.exe 3888 dpvpp.exe 1420 jdjpp.exe 4680 hhbbtb.exe -
resource yara_rule behavioral2/memory/4780-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-430-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-440-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-460-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-503-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-548-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-557-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 4264 4780 005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe 85 PID 4780 wrote to memory of 4264 4780 005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe 85 PID 4780 wrote to memory of 4264 4780 005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe 85 PID 4264 wrote to memory of 4576 4264 ddvpv.exe 86 PID 4264 wrote to memory of 4576 4264 ddvpv.exe 86 PID 4264 wrote to memory of 4576 4264 ddvpv.exe 86 PID 4576 wrote to memory of 1232 4576 ddvvj.exe 87 PID 4576 wrote to memory of 1232 4576 ddvvj.exe 87 PID 4576 wrote to memory of 1232 4576 ddvvj.exe 87 PID 1232 wrote to memory of 4808 1232 lxxrlfl.exe 88 PID 1232 wrote to memory of 4808 1232 lxxrlfl.exe 88 PID 1232 wrote to memory of 4808 1232 lxxrlfl.exe 88 PID 4808 wrote to memory of 8 4808 dpvvp.exe 89 PID 4808 wrote to memory of 8 4808 dpvvp.exe 89 PID 4808 wrote to memory of 8 4808 dpvvp.exe 89 PID 8 wrote to memory of 1484 8 vpddd.exe 90 PID 8 wrote to memory of 1484 8 vpddd.exe 90 PID 8 wrote to memory of 1484 8 vpddd.exe 90 PID 1484 wrote to memory of 2016 1484 7tttbh.exe 91 PID 1484 wrote to memory of 2016 1484 7tttbh.exe 91 PID 1484 wrote to memory of 2016 1484 7tttbh.exe 91 PID 2016 wrote to memory of 4656 2016 tbntth.exe 92 PID 2016 wrote to memory of 4656 2016 tbntth.exe 92 PID 2016 wrote to memory of 4656 2016 tbntth.exe 92 PID 4656 wrote to memory of 2300 4656 hbbhhn.exe 93 PID 4656 wrote to memory of 2300 4656 hbbhhn.exe 93 PID 4656 wrote to memory of 2300 4656 hbbhhn.exe 93 PID 2300 wrote to memory of 624 2300 flrllll.exe 94 PID 2300 wrote to memory of 624 2300 flrllll.exe 94 PID 2300 wrote to memory of 624 2300 flrllll.exe 94 PID 624 wrote to memory of 1768 624 424006.exe 95 PID 624 wrote to memory of 1768 624 424006.exe 95 PID 624 wrote to memory of 1768 624 424006.exe 95 PID 1768 wrote to memory of 4320 1768 20848.exe 96 PID 1768 wrote to memory of 4320 1768 20848.exe 96 PID 1768 wrote to memory of 4320 1768 20848.exe 96 PID 4320 wrote to memory of 5068 4320 1hntnt.exe 97 PID 4320 wrote to memory of 5068 4320 1hntnt.exe 97 PID 4320 wrote to memory of 5068 4320 1hntnt.exe 97 PID 5068 wrote to memory of 1668 5068 hthhbt.exe 98 PID 5068 wrote to memory of 1668 5068 hthhbt.exe 98 PID 5068 wrote to memory of 1668 5068 hthhbt.exe 98 PID 1668 wrote to memory of 3256 1668 5fxrllf.exe 99 PID 1668 wrote to memory of 3256 1668 5fxrllf.exe 99 PID 1668 wrote to memory of 3256 1668 5fxrllf.exe 99 PID 3256 wrote to memory of 4068 3256 848044.exe 100 PID 3256 wrote to memory of 4068 3256 848044.exe 100 PID 3256 wrote to memory of 4068 3256 848044.exe 100 PID 4068 wrote to memory of 3060 4068 86842.exe 101 PID 4068 wrote to memory of 3060 4068 86842.exe 101 PID 4068 wrote to memory of 3060 4068 86842.exe 101 PID 3060 wrote to memory of 1136 3060 04008.exe 102 PID 3060 wrote to memory of 1136 3060 04008.exe 102 PID 3060 wrote to memory of 1136 3060 04008.exe 102 PID 1136 wrote to memory of 4240 1136 bthbbt.exe 103 PID 1136 wrote to memory of 4240 1136 bthbbt.exe 103 PID 1136 wrote to memory of 4240 1136 bthbbt.exe 103 PID 4240 wrote to memory of 3776 4240 9lxrlxr.exe 104 PID 4240 wrote to memory of 3776 4240 9lxrlxr.exe 104 PID 4240 wrote to memory of 3776 4240 9lxrlxr.exe 104 PID 3776 wrote to memory of 4716 3776 s6066.exe 106 PID 3776 wrote to memory of 4716 3776 s6066.exe 106 PID 3776 wrote to memory of 4716 3776 s6066.exe 106 PID 4716 wrote to memory of 5064 4716 242222.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\005f60af1ad9167ea24c61a4532d007f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\ddvpv.exec:\ddvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\ddvvj.exec:\ddvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\lxxrlfl.exec:\lxxrlfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\dpvvp.exec:\dpvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\vpddd.exec:\vpddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\7tttbh.exec:\7tttbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\tbntth.exec:\tbntth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\hbbhhn.exec:\hbbhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\flrllll.exec:\flrllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\424006.exec:\424006.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\20848.exec:\20848.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\1hntnt.exec:\1hntnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hthhbt.exec:\hthhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\5fxrllf.exec:\5fxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\848044.exec:\848044.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\86842.exec:\86842.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\04008.exec:\04008.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\bthbbt.exec:\bthbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\9lxrlxr.exec:\9lxrlxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\s6066.exec:\s6066.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\242222.exec:\242222.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\llrfrfl.exec:\llrfrfl.exe23⤵
- Executes dropped EXE
PID:5064 -
\??\c:\jdvpp.exec:\jdvpp.exe24⤵
- Executes dropped EXE
PID:3556 -
\??\c:\lffffxx.exec:\lffffxx.exe25⤵
- Executes dropped EXE
PID:4692 -
\??\c:\46808.exec:\46808.exe26⤵
- Executes dropped EXE
PID:3628 -
\??\c:\4482660.exec:\4482660.exe27⤵
- Executes dropped EXE
PID:4152 -
\??\c:\622001h.exec:\622001h.exe28⤵
- Executes dropped EXE
PID:4056 -
\??\c:\280040.exec:\280040.exe29⤵
- Executes dropped EXE
PID:5080 -
\??\c:\480400.exec:\480400.exe30⤵
- Executes dropped EXE
PID:3152 -
\??\c:\nnbbbb.exec:\nnbbbb.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\e48688.exec:\e48688.exe32⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe33⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rllrllx.exec:\rllrllx.exe34⤵
- Executes dropped EXE
PID:4780 -
\??\c:\djjdj.exec:\djjdj.exe35⤵
- Executes dropped EXE
PID:1500 -
\??\c:\0066666.exec:\0066666.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tnnntb.exec:\tnnntb.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvddv.exec:\jvddv.exe38⤵
- Executes dropped EXE
PID:3236 -
\??\c:\6026668.exec:\6026668.exe39⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bthntn.exec:\bthntn.exe40⤵
- Executes dropped EXE
PID:3660 -
\??\c:\48842.exec:\48842.exe41⤵
- Executes dropped EXE
PID:4024 -
\??\c:\6460600.exec:\6460600.exe42⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9htttn.exec:\9htttn.exe44⤵
- Executes dropped EXE
PID:3288 -
\??\c:\rlxxlfl.exec:\rlxxlfl.exe45⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnnhbt.exec:\tnnhbt.exe46⤵
- Executes dropped EXE
PID:3252 -
\??\c:\60084.exec:\60084.exe47⤵
- Executes dropped EXE
PID:916 -
\??\c:\m0042.exec:\m0042.exe48⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xxlrflr.exec:\xxlrflr.exe49⤵
- Executes dropped EXE
PID:3672 -
\??\c:\hbhnnn.exec:\hbhnnn.exe50⤵
- Executes dropped EXE
PID:4844 -
\??\c:\402004.exec:\402004.exe51⤵
- Executes dropped EXE
PID:712 -
\??\c:\8882604.exec:\8882604.exe52⤵
- Executes dropped EXE
PID:4324 -
\??\c:\64266.exec:\64266.exe53⤵
- Executes dropped EXE
PID:4668 -
\??\c:\4048822.exec:\4048822.exe54⤵
- Executes dropped EXE
PID:3172 -
\??\c:\xlllfff.exec:\xlllfff.exe55⤵
- Executes dropped EXE
PID:3516 -
\??\c:\bnhhbt.exec:\bnhhbt.exe56⤵
- Executes dropped EXE
PID:4240 -
\??\c:\806604.exec:\806604.exe57⤵
- Executes dropped EXE
PID:2132 -
\??\c:\4408282.exec:\4408282.exe58⤵
- Executes dropped EXE
PID:4936 -
\??\c:\djvpj.exec:\djvpj.exe59⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pjdvp.exec:\pjdvp.exe60⤵
- Executes dropped EXE
PID:1444 -
\??\c:\00600.exec:\00600.exe61⤵
- Executes dropped EXE
PID:3556 -
\??\c:\24604.exec:\24604.exe62⤵
- Executes dropped EXE
PID:3240 -
\??\c:\dpvpp.exec:\dpvpp.exe63⤵
- Executes dropped EXE
PID:3888 -
\??\c:\jdjpp.exec:\jdjpp.exe64⤵
- Executes dropped EXE
PID:1420 -
\??\c:\hhbbtb.exec:\hhbbtb.exe65⤵
- Executes dropped EXE
PID:4680 -
\??\c:\4000044.exec:\4000044.exe66⤵PID:4536
-
\??\c:\ffffxxx.exec:\ffffxxx.exe67⤵PID:3896
-
\??\c:\bbhthn.exec:\bbhthn.exe68⤵PID:2480
-
\??\c:\84822.exec:\84822.exe69⤵PID:4476
-
\??\c:\48040.exec:\48040.exe70⤵PID:988
-
\??\c:\9ddvv.exec:\9ddvv.exe71⤵PID:4780
-
\??\c:\0448226.exec:\0448226.exe72⤵PID:1500
-
\??\c:\bbhbbb.exec:\bbhbbb.exe73⤵PID:3808
-
\??\c:\0482226.exec:\0482226.exe74⤵PID:1592
-
\??\c:\jddvv.exec:\jddvv.exe75⤵PID:1604
-
\??\c:\dvddd.exec:\dvddd.exe76⤵PID:4884
-
\??\c:\26882.exec:\26882.exe77⤵PID:3620
-
\??\c:\hbtnnn.exec:\hbtnnn.exe78⤵PID:4696
-
\??\c:\466600.exec:\466600.exe79⤵PID:4656
-
\??\c:\hbnhhh.exec:\hbnhhh.exe80⤵PID:4908
-
\??\c:\jvvpj.exec:\jvvpj.exe81⤵PID:1248
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe82⤵PID:4320
-
\??\c:\4882626.exec:\4882626.exe83⤵PID:4836
-
\??\c:\84448.exec:\84448.exe84⤵PID:1924
-
\??\c:\hbbthh.exec:\hbbthh.exe85⤵PID:2976
-
\??\c:\lxfxrll.exec:\lxfxrll.exe86⤵PID:1688
-
\??\c:\202262.exec:\202262.exe87⤵PID:3392
-
\??\c:\7jpjj.exec:\7jpjj.exe88⤵PID:1188
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe89⤵PID:2608
-
\??\c:\i420660.exec:\i420660.exe90⤵PID:2312
-
\??\c:\e00488.exec:\e00488.exe91⤵PID:4752
-
\??\c:\jpvjv.exec:\jpvjv.exe92⤵PID:1460
-
\??\c:\468826.exec:\468826.exe93⤵PID:940
-
\??\c:\646604.exec:\646604.exe94⤵PID:2092
-
\??\c:\68862.exec:\68862.exe95⤵PID:1812
-
\??\c:\06204.exec:\06204.exe96⤵PID:3192
-
\??\c:\jdjjp.exec:\jdjjp.exe97⤵PID:5112
-
\??\c:\thtnbt.exec:\thtnbt.exe98⤵PID:5072
-
\??\c:\4060826.exec:\4060826.exe99⤵PID:4152
-
\??\c:\3tthbt.exec:\3tthbt.exe100⤵PID:4704
-
\??\c:\8826048.exec:\8826048.exe101⤵PID:1440
-
\??\c:\28004.exec:\28004.exe102⤵PID:224
-
\??\c:\84664.exec:\84664.exe103⤵PID:3480
-
\??\c:\pjdpp.exec:\pjdpp.exe104⤵PID:4516
-
\??\c:\802666.exec:\802666.exe105⤵PID:4588
-
\??\c:\886200.exec:\886200.exe106⤵PID:3472
-
\??\c:\2404448.exec:\2404448.exe107⤵PID:4780
-
\??\c:\402246.exec:\402246.exe108⤵PID:4040
-
\??\c:\00608.exec:\00608.exe109⤵PID:4512
-
\??\c:\880462.exec:\880462.exe110⤵PID:3448
-
\??\c:\tthbhh.exec:\tthbhh.exe111⤵PID:452
-
\??\c:\u022282.exec:\u022282.exe112⤵PID:4884
-
\??\c:\jvdvp.exec:\jvdvp.exe113⤵PID:2016
-
\??\c:\nnbnhn.exec:\nnbnhn.exe114⤵PID:1400
-
\??\c:\nhhbbb.exec:\nhhbbb.exe115⤵PID:5032
-
\??\c:\k86040.exec:\k86040.exe116⤵PID:2568
-
\??\c:\rxxrllf.exec:\rxxrllf.exe117⤵PID:3252
-
\??\c:\022222.exec:\022222.exe118⤵PID:416
-
\??\c:\pjddv.exec:\pjddv.exe119⤵PID:1536
-
\??\c:\8682884.exec:\8682884.exe120⤵PID:4644
-
\??\c:\nttnhh.exec:\nttnhh.exe121⤵PID:2976
-
\??\c:\2440448.exec:\2440448.exe122⤵PID:1052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-