Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 14:13
Behavioral task
behavioral1
Sample
00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe
-
Size
72KB
-
MD5
00f2c6a78798d12bb2d055da1c65005b
-
SHA1
735ba26f46e939f1b68d454e37e7c11f7ef790c6
-
SHA256
9c2b763cf8f2d0d3db267ddb00851fa4abe8a815eb43a85995d95e31ddcd2fe8
-
SHA512
7305bf5a144e1bc35e689781008304a4cf56ae229c4d0a9205278348f2d9ccfa61832edf5e410483712323f7adbe1d1b53d2d9bd15264c4565e926fb5662d9c1
-
SSDEEP
1536:TvQBeOGtrYS3srx93UBWfwC6Ggnouy80vU2r1vERckymCeF:ThOmTsF93UYfwC6GIout0vH1AQmL
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1312-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-263-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1712-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-373-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1884-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/880-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-718-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2312-824-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2700-867-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/308-950-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-1016-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1888-1029-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1256-1069-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon behavioral1/memory/2488-1087-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1732-1223-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1256-6908-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon behavioral1/memory/1256-12692-0x0000000077930000-0x0000000077A2A000-memory.dmp family_blackmoon behavioral1/memory/1256-14477-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon behavioral1/memory/1256-14994-0x0000000077930000-0x0000000077A2A000-memory.dmp family_blackmoon behavioral1/memory/1256-15252-0x0000000077930000-0x0000000077A2A000-memory.dmp family_blackmoon behavioral1/memory/1256-18597-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon behavioral1/memory/1256-28095-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2488 7nbttn.exe 2416 pjppd.exe 2680 xlffrrx.exe 2760 nthhhn.exe 2288 jvpdd.exe 2820 ddpdd.exe 2396 lfxlrrf.exe 2812 9thbhn.exe 2588 thhntt.exe 3032 1pvvd.exe 1624 xrlrrxf.exe 2784 nhtbnh.exe 2860 tnhntb.exe 1816 jvjjv.exe 2008 lfxrffr.exe 2172 lxlxffl.exe 1864 btntbb.exe 2216 5dpjp.exe 324 xlrrxxx.exe 1700 3lxlfrr.exe 1264 nhbhtn.exe 1272 jdppj.exe 2520 lfxxlrx.exe 2140 xfrrfxl.exe 484 nbnttt.exe 1156 jdppd.exe 1892 1fxrlrx.exe 1784 tnbntb.exe 1936 vpddp.exe 2920 pjdpv.exe 920 lxrxrxf.exe 2076 ththtt.exe 1100 hhttbh.exe 2268 dvdpp.exe 2132 lfxfrxx.exe 3048 htbbnt.exe 2312 1dvvp.exe 2188 jdvjv.exe 1712 3frxxrx.exe 2476 7llrxxl.exe 2684 htnnbt.exe 2744 3bntbb.exe 2664 9ddvj.exe 2760 1xxrrxl.exe 2288 fxfrfxf.exe 3028 xlflxfl.exe 2584 tnbntt.exe 2532 btnbnt.exe 2656 ppdjj.exe 2388 1vpvd.exe 2456 9rflllr.exe 2512 frrxrlr.exe 2604 nbnntt.exe 2856 5tthtt.exe 2972 pjdvv.exe 2336 9xxfrfl.exe 2012 1ffrllr.exe 2016 nhtbtb.exe 2424 bhnntn.exe 2172 nhtbnb.exe 300 pjdjj.exe 2180 vpdvd.exe 1668 xxrxllx.exe 1732 rlffrlr.exe -
resource yara_rule behavioral1/memory/1312-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001227b-6.dat upx behavioral1/memory/1312-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1312-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00310000000144d6-17.dat upx behavioral1/memory/2488-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000145d4-24.dat upx behavioral1/files/0x00080000000146a7-33.dat upx behavioral1/memory/2680-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001474b-41.dat upx behavioral1/files/0x000700000001475f-49.dat upx behavioral1/memory/2288-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000148af-56.dat upx behavioral1/memory/2820-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c9b-64.dat upx behavioral1/memory/2812-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ca9-71.dat upx behavioral1/files/0x0006000000015cc2-79.dat upx behavioral1/memory/3032-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cca-86.dat upx behavioral1/memory/1624-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cd8-95.dat upx behavioral1/files/0x0006000000015ce1-103.dat upx behavioral1/memory/2784-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ced-113.dat upx behavioral1/files/0x0006000000015cf5-120.dat upx behavioral1/files/0x0006000000015d02-127.dat upx behavioral1/memory/2172-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d13-133.dat upx behavioral1/files/0x0006000000015d1e-142.dat upx behavioral1/memory/1864-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d28-150.dat upx behavioral1/files/0x0006000000015d89-158.dat upx behavioral1/memory/324-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d99-167.dat upx behavioral1/memory/1700-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f40-175.dat upx behavioral1/memory/1264-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015fbb-183.dat upx behavioral1/memory/1272-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016020-193.dat upx behavioral1/memory/2520-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016126-200.dat upx behavioral1/memory/2140-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/484-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016228-209.dat upx behavioral1/files/0x000600000001640f-216.dat upx behavioral1/files/0x000600000001650f-223.dat upx behavioral1/memory/1784-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003000000001451d-231.dat upx behavioral1/files/0x0006000000016591-239.dat upx behavioral1/memory/1936-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167e8-247.dat upx behavioral1/files/0x0006000000016a3a-254.dat upx behavioral1/memory/3048-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-301-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 2488 1312 00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe 28 PID 1312 wrote to memory of 2488 1312 00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe 28 PID 1312 wrote to memory of 2488 1312 00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe 28 PID 1312 wrote to memory of 2488 1312 00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe 28 PID 2488 wrote to memory of 2416 2488 7nbttn.exe 29 PID 2488 wrote to memory of 2416 2488 7nbttn.exe 29 PID 2488 wrote to memory of 2416 2488 7nbttn.exe 29 PID 2488 wrote to memory of 2416 2488 7nbttn.exe 29 PID 2416 wrote to memory of 2680 2416 pjppd.exe 30 PID 2416 wrote to memory of 2680 2416 pjppd.exe 30 PID 2416 wrote to memory of 2680 2416 pjppd.exe 30 PID 2416 wrote to memory of 2680 2416 pjppd.exe 30 PID 2680 wrote to memory of 2760 2680 xlffrrx.exe 31 PID 2680 wrote to memory of 2760 2680 xlffrrx.exe 31 PID 2680 wrote to memory of 2760 2680 xlffrrx.exe 31 PID 2680 wrote to memory of 2760 2680 xlffrrx.exe 31 PID 2760 wrote to memory of 2288 2760 nthhhn.exe 32 PID 2760 wrote to memory of 2288 2760 nthhhn.exe 32 PID 2760 wrote to memory of 2288 2760 nthhhn.exe 32 PID 2760 wrote to memory of 2288 2760 nthhhn.exe 32 PID 2288 wrote to memory of 2820 2288 jvpdd.exe 33 PID 2288 wrote to memory of 2820 2288 jvpdd.exe 33 PID 2288 wrote to memory of 2820 2288 jvpdd.exe 33 PID 2288 wrote to memory of 2820 2288 jvpdd.exe 33 PID 2820 wrote to memory of 2396 2820 ddpdd.exe 34 PID 2820 wrote to memory of 2396 2820 ddpdd.exe 34 PID 2820 wrote to memory of 2396 2820 ddpdd.exe 34 PID 2820 wrote to memory of 2396 2820 ddpdd.exe 34 PID 2396 wrote to memory of 2812 2396 lfxlrrf.exe 35 PID 2396 wrote to memory of 2812 2396 lfxlrrf.exe 35 PID 2396 wrote to memory of 2812 2396 lfxlrrf.exe 35 PID 2396 wrote to memory of 2812 2396 lfxlrrf.exe 35 PID 2812 wrote to memory of 2588 2812 9thbhn.exe 36 PID 2812 wrote to memory of 2588 2812 9thbhn.exe 36 PID 2812 wrote to memory of 2588 2812 9thbhn.exe 36 PID 2812 wrote to memory of 2588 2812 9thbhn.exe 36 PID 2588 wrote to memory of 3032 2588 thhntt.exe 37 PID 2588 wrote to memory of 3032 2588 thhntt.exe 37 PID 2588 wrote to memory of 3032 2588 thhntt.exe 37 PID 2588 wrote to memory of 3032 2588 thhntt.exe 37 PID 3032 wrote to memory of 1624 3032 1pvvd.exe 38 PID 3032 wrote to memory of 1624 3032 1pvvd.exe 38 PID 3032 wrote to memory of 1624 3032 1pvvd.exe 38 PID 3032 wrote to memory of 1624 3032 1pvvd.exe 38 PID 1624 wrote to memory of 2784 1624 xrlrrxf.exe 39 PID 1624 wrote to memory of 2784 1624 xrlrrxf.exe 39 PID 1624 wrote to memory of 2784 1624 xrlrrxf.exe 39 PID 1624 wrote to memory of 2784 1624 xrlrrxf.exe 39 PID 2784 wrote to memory of 2860 2784 nhtbnh.exe 40 PID 2784 wrote to memory of 2860 2784 nhtbnh.exe 40 PID 2784 wrote to memory of 2860 2784 nhtbnh.exe 40 PID 2784 wrote to memory of 2860 2784 nhtbnh.exe 40 PID 2860 wrote to memory of 1816 2860 tnhntb.exe 41 PID 2860 wrote to memory of 1816 2860 tnhntb.exe 41 PID 2860 wrote to memory of 1816 2860 tnhntb.exe 41 PID 2860 wrote to memory of 1816 2860 tnhntb.exe 41 PID 1816 wrote to memory of 2008 1816 jvjjv.exe 42 PID 1816 wrote to memory of 2008 1816 jvjjv.exe 42 PID 1816 wrote to memory of 2008 1816 jvjjv.exe 42 PID 1816 wrote to memory of 2008 1816 jvjjv.exe 42 PID 2008 wrote to memory of 2172 2008 lfxrffr.exe 43 PID 2008 wrote to memory of 2172 2008 lfxrffr.exe 43 PID 2008 wrote to memory of 2172 2008 lfxrffr.exe 43 PID 2008 wrote to memory of 2172 2008 lfxrffr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\7nbttn.exec:\7nbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pjppd.exec:\pjppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xlffrrx.exec:\xlffrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nthhhn.exec:\nthhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jvpdd.exec:\jvpdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\ddpdd.exec:\ddpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\9thbhn.exec:\9thbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\thhntt.exec:\thhntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\1pvvd.exec:\1pvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xrlrrxf.exec:\xrlrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\nhtbnh.exec:\nhtbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tnhntb.exec:\tnhntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jvjjv.exec:\jvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\lfxrffr.exec:\lfxrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\lxlxffl.exec:\lxlxffl.exe17⤵
- Executes dropped EXE
PID:2172 -
\??\c:\btntbb.exec:\btntbb.exe18⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5dpjp.exec:\5dpjp.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe20⤵
- Executes dropped EXE
PID:324 -
\??\c:\3lxlfrr.exec:\3lxlfrr.exe21⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nhbhtn.exec:\nhbhtn.exe22⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jdppj.exec:\jdppj.exe23⤵
- Executes dropped EXE
PID:1272 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe24⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xfrrfxl.exec:\xfrrfxl.exe25⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nbnttt.exec:\nbnttt.exe26⤵
- Executes dropped EXE
PID:484 -
\??\c:\jdppd.exec:\jdppd.exe27⤵
- Executes dropped EXE
PID:1156 -
\??\c:\1fxrlrx.exec:\1fxrlrx.exe28⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tnbntb.exec:\tnbntb.exe29⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vpddp.exec:\vpddp.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjdpv.exec:\pjdpv.exe31⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxrxrxf.exec:\lxrxrxf.exe32⤵
- Executes dropped EXE
PID:920 -
\??\c:\ththtt.exec:\ththtt.exe33⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hhttbh.exec:\hhttbh.exe34⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dvdpp.exec:\dvdpp.exe35⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\htbbnt.exec:\htbbnt.exe37⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1dvvp.exec:\1dvvp.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jdvjv.exec:\jdvjv.exe39⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3frxxrx.exec:\3frxxrx.exe40⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7llrxxl.exec:\7llrxxl.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\htnnbt.exec:\htnnbt.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3bntbb.exec:\3bntbb.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9ddvj.exec:\9ddvj.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1xxrrxl.exec:\1xxrrxl.exe45⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fxfrfxf.exec:\fxfrfxf.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xlflxfl.exec:\xlflxfl.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tnbntt.exec:\tnbntt.exe48⤵
- Executes dropped EXE
PID:2584 -
\??\c:\btnbnt.exec:\btnbnt.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ppdjj.exec:\ppdjj.exe50⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1vpvd.exec:\1vpvd.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9rflllr.exec:\9rflllr.exe52⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frrxrlr.exec:\frrxrlr.exe53⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nbnntt.exec:\nbnntt.exe54⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5tthtt.exec:\5tthtt.exe55⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pjdvv.exec:\pjdvv.exe56⤵
- Executes dropped EXE
PID:2972 -
\??\c:\9xxfrfl.exec:\9xxfrfl.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\1ffrllr.exec:\1ffrllr.exe58⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhtbtb.exec:\nhtbtb.exe59⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bhnntn.exec:\bhnntn.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nhtbnb.exec:\nhtbnb.exe61⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pjdjj.exec:\pjdjj.exe62⤵
- Executes dropped EXE
PID:300 -
\??\c:\vpdvd.exec:\vpdvd.exe63⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxrxllx.exec:\xxrxllx.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rlffrlr.exec:\rlffrlr.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbnbtt.exec:\hbnbtt.exe66⤵PID:1604
-
\??\c:\hthnbb.exec:\hthnbb.exe67⤵PID:2112
-
\??\c:\dvjpv.exec:\dvjpv.exe68⤵PID:1776
-
\??\c:\pdvdd.exec:\pdvdd.exe69⤵PID:2916
-
\??\c:\1xxlrrl.exec:\1xxlrrl.exe70⤵PID:3064
-
\??\c:\frffrrf.exec:\frffrrf.exe71⤵PID:3044
-
\??\c:\hbtnhn.exec:\hbtnhn.exe72⤵PID:264
-
\??\c:\tnbthh.exec:\tnbthh.exe73⤵PID:744
-
\??\c:\jdddd.exec:\jdddd.exe74⤵PID:2412
-
\??\c:\9jdjj.exec:\9jdjj.exe75⤵PID:688
-
\??\c:\xlflxfx.exec:\xlflxfx.exe76⤵PID:1600
-
\??\c:\lfrxlfl.exec:\lfrxlfl.exe77⤵PID:940
-
\??\c:\7bnhtt.exec:\7bnhtt.exe78⤵PID:2364
-
\??\c:\3nbbhn.exec:\3nbbhn.exe79⤵PID:2936
-
\??\c:\dvppp.exec:\dvppp.exe80⤵PID:1884
-
\??\c:\5ppdd.exec:\5ppdd.exe81⤵PID:3040
-
\??\c:\7rrxfxr.exec:\7rrxfxr.exe82⤵PID:1148
-
\??\c:\rlrlrlx.exec:\rlrlrlx.exe83⤵PID:1180
-
\??\c:\nbnntt.exec:\nbnntt.exe84⤵PID:2108
-
\??\c:\jvpvd.exec:\jvpvd.exe85⤵PID:1512
-
\??\c:\vpjvv.exec:\vpjvv.exe86⤵PID:880
-
\??\c:\rlxxrrf.exec:\rlxxrrf.exe87⤵PID:2236
-
\??\c:\fxrfrrr.exec:\fxrfrrr.exe88⤵PID:1344
-
\??\c:\hthnbt.exec:\hthnbt.exe89⤵PID:844
-
\??\c:\htbnnn.exec:\htbnnn.exe90⤵PID:2184
-
\??\c:\9jjdp.exec:\9jjdp.exe91⤵PID:2380
-
\??\c:\jdjpp.exec:\jdjpp.exe92⤵PID:2740
-
\??\c:\9xxxlxx.exec:\9xxxlxx.exe93⤵PID:2736
-
\??\c:\7lxxfrx.exec:\7lxxfrx.exe94⤵PID:2744
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe95⤵PID:2836
-
\??\c:\nbtnnh.exec:\nbtnnh.exe96⤵PID:2776
-
\??\c:\hbnntb.exec:\hbnntb.exe97⤵PID:2820
-
\??\c:\1pdpp.exec:\1pdpp.exe98⤵PID:2540
-
\??\c:\5pppp.exec:\5pppp.exe99⤵PID:2552
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe100⤵PID:2548
-
\??\c:\xlrxfll.exec:\xlrxfll.exe101⤵PID:2980
-
\??\c:\tnbhtt.exec:\tnbhtt.exe102⤵PID:1660
-
\??\c:\bthhbh.exec:\bthhbh.exe103⤵PID:1060
-
\??\c:\jjjdv.exec:\jjjdv.exe104⤵PID:2512
-
\??\c:\pdjdv.exec:\pdjdv.exe105⤵PID:2784
-
\??\c:\xlxxxxl.exec:\xlxxxxl.exe106⤵PID:3000
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe107⤵PID:2860
-
\??\c:\9bhhtt.exec:\9bhhtt.exe108⤵PID:2004
-
\??\c:\7nbhhb.exec:\7nbhhb.exe109⤵PID:2024
-
\??\c:\dppvj.exec:\dppvj.exe110⤵PID:1808
-
\??\c:\jvddv.exec:\jvddv.exe111⤵PID:2448
-
\??\c:\5ffrrrr.exec:\5ffrrrr.exe112⤵PID:1064
-
\??\c:\frllllr.exec:\frllllr.exe113⤵PID:812
-
\??\c:\thnhhh.exec:\thnhhh.exe114⤵PID:2200
-
\??\c:\bnttnt.exec:\bnttnt.exe115⤵PID:1452
-
\??\c:\jvdpv.exec:\jvdpv.exe116⤵PID:1544
-
\??\c:\dvpvj.exec:\dvpvj.exe117⤵PID:1636
-
\??\c:\pjvjv.exec:\pjvjv.exe118⤵PID:1192
-
\??\c:\xfllrxf.exec:\xfllrxf.exe119⤵PID:1776
-
\??\c:\nbbhbt.exec:\nbbhbt.exe120⤵PID:2916
-
\??\c:\thbthh.exec:\thbthh.exe121⤵PID:2460
-
\??\c:\jdddp.exec:\jdddp.exe122⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-