Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 14:13
Behavioral task
behavioral1
Sample
00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe
-
Size
72KB
-
MD5
00f2c6a78798d12bb2d055da1c65005b
-
SHA1
735ba26f46e939f1b68d454e37e7c11f7ef790c6
-
SHA256
9c2b763cf8f2d0d3db267ddb00851fa4abe8a815eb43a85995d95e31ddcd2fe8
-
SHA512
7305bf5a144e1bc35e689781008304a4cf56ae229c4d0a9205278348f2d9ccfa61832edf5e410483712323f7adbe1d1b53d2d9bd15264c4565e926fb5662d9c1
-
SSDEEP
1536:TvQBeOGtrYS3srx93UBWfwC6Ggnouy80vU2r1vERckymCeF:ThOmTsF93UYfwC6GIout0vH1AQmL
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4724-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1268-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/988-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-557-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-651-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4676 ntttnn.exe 1884 jppjv.exe 2712 lfxlrrf.exe 1936 1tnnbt.exe 1848 9hnnbt.exe 3524 djppd.exe 4956 fffrfxl.exe 4072 htthtn.exe 1112 nttnhb.exe 3584 3pppd.exe 5092 7rxrffl.exe 832 9nnhtt.exe 4896 bbthbb.exe 996 dvjdp.exe 1628 1ffrlfx.exe 664 3tbtnb.exe 3216 bnnhbt.exe 3956 jddpd.exe 2476 1llxllx.exe 2420 hnnnhh.exe 3780 pdpjj.exe 4540 1rrfrrl.exe 4120 5bbnbh.exe 3796 5vvjp.exe 3628 5pppd.exe 2244 lrlxrrl.exe 428 3rxxffl.exe 3544 bhhbnb.exe 4716 9vvjv.exe 2376 1rlfrlf.exe 3600 lfffrrx.exe 4660 tbbthb.exe 2748 hhnbth.exe 3124 pdpjp.exe 3200 1lrllff.exe 1468 rxlfxrl.exe 968 tnhhbt.exe 2148 hbtnbt.exe 4964 3vvpd.exe 1268 djdvd.exe 5052 lxfffrr.exe 4856 bntnhh.exe 448 nbnbtn.exe 212 dpvjj.exe 4384 vvpdv.exe 3848 xffxfxr.exe 1416 bttnht.exe 1852 nnhbtt.exe 3108 pvpjv.exe 1884 xllffxx.exe 3968 nnnnbt.exe 1136 bhnhtb.exe 4840 ppvvp.exe 1848 rrrlxrl.exe 5040 3htthh.exe 4492 9vvpv.exe 4828 ddpjd.exe 4268 rffxrlf.exe 3928 bnnnhb.exe 3056 dvddd.exe 3964 9xlxlfr.exe 3568 xffxrll.exe 1412 nthhbt.exe 3424 bhntbt.exe -
resource yara_rule behavioral2/memory/4724-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a0000000226f0-3.dat upx behavioral2/memory/4676-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4724-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b89-9.dat upx behavioral2/memory/1884-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-11.dat upx behavioral2/files/0x000a000000023b96-18.dat upx behavioral2/memory/1936-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-23.dat upx behavioral2/files/0x000a000000023b98-27.dat upx behavioral2/memory/3524-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-32.dat upx behavioral2/memory/3524-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9a-38.dat upx behavioral2/files/0x000a000000023b9b-44.dat upx behavioral2/memory/1112-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-49.dat upx behavioral2/memory/4072-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4956-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3584-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-53.dat upx behavioral2/files/0x000a000000023b9f-57.dat upx behavioral2/memory/5092-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-62.dat upx behavioral2/memory/832-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba1-67.dat upx behavioral2/memory/4896-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/996-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-73.dat upx behavioral2/memory/996-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-78.dat upx behavioral2/memory/1628-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba4-83.dat upx behavioral2/files/0x000a000000023ba5-87.dat upx behavioral2/memory/3216-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba6-92.dat upx behavioral2/memory/3956-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2476-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2476-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba7-100.dat upx behavioral2/files/0x000a000000023ba8-103.dat upx behavioral2/memory/3780-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba9-107.dat upx behavioral2/files/0x000a000000023baa-113.dat upx behavioral2/memory/4540-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bab-117.dat upx behavioral2/memory/3796-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-121.dat upx behavioral2/files/0x000a000000023bad-126.dat upx behavioral2/memory/2244-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bae-131.dat upx behavioral2/files/0x000a000000023baf-135.dat upx behavioral2/files/0x000a000000023bb0-139.dat upx behavioral2/files/0x000c000000023b8a-143.dat upx behavioral2/memory/2376-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb1-148.dat upx behavioral2/files/0x000a000000023bb2-152.dat upx behavioral2/memory/3600-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4660-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2748-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3124-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1468-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/968-171-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 4676 4724 00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe 83 PID 4724 wrote to memory of 4676 4724 00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe 83 PID 4724 wrote to memory of 4676 4724 00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe 83 PID 4676 wrote to memory of 1884 4676 ntttnn.exe 84 PID 4676 wrote to memory of 1884 4676 ntttnn.exe 84 PID 4676 wrote to memory of 1884 4676 ntttnn.exe 84 PID 1884 wrote to memory of 2712 1884 jppjv.exe 85 PID 1884 wrote to memory of 2712 1884 jppjv.exe 85 PID 1884 wrote to memory of 2712 1884 jppjv.exe 85 PID 2712 wrote to memory of 1936 2712 lfxlrrf.exe 86 PID 2712 wrote to memory of 1936 2712 lfxlrrf.exe 86 PID 2712 wrote to memory of 1936 2712 lfxlrrf.exe 86 PID 1936 wrote to memory of 1848 1936 1tnnbt.exe 87 PID 1936 wrote to memory of 1848 1936 1tnnbt.exe 87 PID 1936 wrote to memory of 1848 1936 1tnnbt.exe 87 PID 1848 wrote to memory of 3524 1848 9hnnbt.exe 88 PID 1848 wrote to memory of 3524 1848 9hnnbt.exe 88 PID 1848 wrote to memory of 3524 1848 9hnnbt.exe 88 PID 3524 wrote to memory of 4956 3524 djppd.exe 89 PID 3524 wrote to memory of 4956 3524 djppd.exe 89 PID 3524 wrote to memory of 4956 3524 djppd.exe 89 PID 4956 wrote to memory of 4072 4956 fffrfxl.exe 90 PID 4956 wrote to memory of 4072 4956 fffrfxl.exe 90 PID 4956 wrote to memory of 4072 4956 fffrfxl.exe 90 PID 4072 wrote to memory of 1112 4072 htthtn.exe 91 PID 4072 wrote to memory of 1112 4072 htthtn.exe 91 PID 4072 wrote to memory of 1112 4072 htthtn.exe 91 PID 1112 wrote to memory of 3584 1112 nttnhb.exe 92 PID 1112 wrote to memory of 3584 1112 nttnhb.exe 92 PID 1112 wrote to memory of 3584 1112 nttnhb.exe 92 PID 3584 wrote to memory of 5092 3584 3pppd.exe 93 PID 3584 wrote to memory of 5092 3584 3pppd.exe 93 PID 3584 wrote to memory of 5092 3584 3pppd.exe 93 PID 5092 wrote to memory of 832 5092 7rxrffl.exe 94 PID 5092 wrote to memory of 832 5092 7rxrffl.exe 94 PID 5092 wrote to memory of 832 5092 7rxrffl.exe 94 PID 832 wrote to memory of 4896 832 9nnhtt.exe 95 PID 832 wrote to memory of 4896 832 9nnhtt.exe 95 PID 832 wrote to memory of 4896 832 9nnhtt.exe 95 PID 4896 wrote to memory of 996 4896 bbthbb.exe 96 PID 4896 wrote to memory of 996 4896 bbthbb.exe 96 PID 4896 wrote to memory of 996 4896 bbthbb.exe 96 PID 996 wrote to memory of 1628 996 dvjdp.exe 97 PID 996 wrote to memory of 1628 996 dvjdp.exe 97 PID 996 wrote to memory of 1628 996 dvjdp.exe 97 PID 1628 wrote to memory of 664 1628 1ffrlfx.exe 98 PID 1628 wrote to memory of 664 1628 1ffrlfx.exe 98 PID 1628 wrote to memory of 664 1628 1ffrlfx.exe 98 PID 664 wrote to memory of 3216 664 3tbtnb.exe 99 PID 664 wrote to memory of 3216 664 3tbtnb.exe 99 PID 664 wrote to memory of 3216 664 3tbtnb.exe 99 PID 3216 wrote to memory of 3956 3216 bnnhbt.exe 101 PID 3216 wrote to memory of 3956 3216 bnnhbt.exe 101 PID 3216 wrote to memory of 3956 3216 bnnhbt.exe 101 PID 3956 wrote to memory of 2476 3956 jddpd.exe 102 PID 3956 wrote to memory of 2476 3956 jddpd.exe 102 PID 3956 wrote to memory of 2476 3956 jddpd.exe 102 PID 2476 wrote to memory of 2420 2476 1llxllx.exe 103 PID 2476 wrote to memory of 2420 2476 1llxllx.exe 103 PID 2476 wrote to memory of 2420 2476 1llxllx.exe 103 PID 2420 wrote to memory of 3780 2420 hnnnhh.exe 105 PID 2420 wrote to memory of 3780 2420 hnnnhh.exe 105 PID 2420 wrote to memory of 3780 2420 hnnnhh.exe 105 PID 3780 wrote to memory of 4540 3780 pdpjj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00f2c6a78798d12bb2d055da1c65005b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\ntttnn.exec:\ntttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\jppjv.exec:\jppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1tnnbt.exec:\1tnnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\9hnnbt.exec:\9hnnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\djppd.exec:\djppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\fffrfxl.exec:\fffrfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\htthtn.exec:\htthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\nttnhb.exec:\nttnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\3pppd.exec:\3pppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\7rxrffl.exec:\7rxrffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\9nnhtt.exec:\9nnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\bbthbb.exec:\bbthbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\dvjdp.exec:\dvjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\1ffrlfx.exec:\1ffrlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\3tbtnb.exec:\3tbtnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\bnnhbt.exec:\bnnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\jddpd.exec:\jddpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\1llxllx.exec:\1llxllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\hnnnhh.exec:\hnnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\pdpjj.exec:\pdpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\1rrfrrl.exec:\1rrfrrl.exe23⤵
- Executes dropped EXE
PID:4540 -
\??\c:\5bbnbh.exec:\5bbnbh.exe24⤵
- Executes dropped EXE
PID:4120 -
\??\c:\5vvjp.exec:\5vvjp.exe25⤵
- Executes dropped EXE
PID:3796 -
\??\c:\5pppd.exec:\5pppd.exe26⤵
- Executes dropped EXE
PID:3628 -
\??\c:\lrlxrrl.exec:\lrlxrrl.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3rxxffl.exec:\3rxxffl.exe28⤵
- Executes dropped EXE
PID:428 -
\??\c:\bhhbnb.exec:\bhhbnb.exe29⤵
- Executes dropped EXE
PID:3544 -
\??\c:\9vvjv.exec:\9vvjv.exe30⤵
- Executes dropped EXE
PID:4716 -
\??\c:\1rlfrlf.exec:\1rlfrlf.exe31⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lfffrrx.exec:\lfffrrx.exe32⤵
- Executes dropped EXE
PID:3600 -
\??\c:\tbbthb.exec:\tbbthb.exe33⤵
- Executes dropped EXE
PID:4660 -
\??\c:\hhnbth.exec:\hhnbth.exe34⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdpjp.exec:\pdpjp.exe35⤵
- Executes dropped EXE
PID:3124 -
\??\c:\1lrllff.exec:\1lrllff.exe36⤵
- Executes dropped EXE
PID:3200 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe37⤵
- Executes dropped EXE
PID:1468 -
\??\c:\tnhhbt.exec:\tnhhbt.exe38⤵
- Executes dropped EXE
PID:968 -
\??\c:\hbtnbt.exec:\hbtnbt.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3vvpd.exec:\3vvpd.exe40⤵
- Executes dropped EXE
PID:4964 -
\??\c:\djdvd.exec:\djdvd.exe41⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lxfffrr.exec:\lxfffrr.exe42⤵
- Executes dropped EXE
PID:5052 -
\??\c:\bntnhh.exec:\bntnhh.exe43⤵
- Executes dropped EXE
PID:4856 -
\??\c:\nbnbtn.exec:\nbnbtn.exe44⤵
- Executes dropped EXE
PID:448 -
\??\c:\dpvjj.exec:\dpvjj.exe45⤵
- Executes dropped EXE
PID:212 -
\??\c:\vvpdv.exec:\vvpdv.exe46⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xffxfxr.exec:\xffxfxr.exe47⤵
- Executes dropped EXE
PID:3848 -
\??\c:\bttnht.exec:\bttnht.exe48⤵
- Executes dropped EXE
PID:1416 -
\??\c:\nnhbtt.exec:\nnhbtt.exe49⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pvpjv.exec:\pvpjv.exe50⤵
- Executes dropped EXE
PID:3108 -
\??\c:\xllffxx.exec:\xllffxx.exe51⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nnnnbt.exec:\nnnnbt.exe52⤵
- Executes dropped EXE
PID:3968 -
\??\c:\bhnhtb.exec:\bhnhtb.exe53⤵
- Executes dropped EXE
PID:1136 -
\??\c:\ppvvp.exec:\ppvvp.exe54⤵
- Executes dropped EXE
PID:4840 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3htthh.exec:\3htthh.exe56⤵
- Executes dropped EXE
PID:5040 -
\??\c:\9vvpv.exec:\9vvpv.exe57⤵
- Executes dropped EXE
PID:4492 -
\??\c:\ddpjd.exec:\ddpjd.exe58⤵
- Executes dropped EXE
PID:4828 -
\??\c:\rffxrlf.exec:\rffxrlf.exe59⤵
- Executes dropped EXE
PID:4268 -
\??\c:\bnnnhb.exec:\bnnnhb.exe60⤵
- Executes dropped EXE
PID:3928 -
\??\c:\dvddd.exec:\dvddd.exe61⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9xlxlfr.exec:\9xlxlfr.exe62⤵
- Executes dropped EXE
PID:3964 -
\??\c:\xffxrll.exec:\xffxrll.exe63⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nthhbt.exec:\nthhbt.exe64⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bhntbt.exec:\bhntbt.exe65⤵
- Executes dropped EXE
PID:3424 -
\??\c:\pvjpj.exec:\pvjpj.exe66⤵PID:2800
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe67⤵PID:1612
-
\??\c:\1rlfrlx.exec:\1rlfrlx.exe68⤵PID:8
-
\??\c:\3hnhbt.exec:\3hnhbt.exe69⤵PID:736
-
\??\c:\pvdvd.exec:\pvdvd.exe70⤵PID:1628
-
\??\c:\xrxlrlf.exec:\xrxlrlf.exe71⤵PID:2584
-
\??\c:\5lrlxrl.exec:\5lrlxrl.exe72⤵PID:3048
-
\??\c:\hhhbnn.exec:\hhhbnn.exe73⤵PID:4132
-
\??\c:\vvvpd.exec:\vvvpd.exe74⤵PID:3836
-
\??\c:\fxrlxrx.exec:\fxrlxrx.exe75⤵PID:3688
-
\??\c:\xrllfxr.exec:\xrllfxr.exe76⤵PID:2984
-
\??\c:\fllfxxl.exec:\fllfxxl.exe77⤵PID:1012
-
\??\c:\jvvpj.exec:\jvvpj.exe78⤵PID:3116
-
\??\c:\9ddpd.exec:\9ddpd.exe79⤵PID:2740
-
\??\c:\frrlxrl.exec:\frrlxrl.exe80⤵PID:2620
-
\??\c:\nhntnn.exec:\nhntnn.exe81⤵PID:3948
-
\??\c:\jjpjv.exec:\jjpjv.exe82⤵PID:1400
-
\??\c:\ffllfff.exec:\ffllfff.exe83⤵PID:4524
-
\??\c:\hbnbhh.exec:\hbnbhh.exe84⤵PID:2568
-
\??\c:\dddvd.exec:\dddvd.exe85⤵PID:3796
-
\??\c:\flfrfxr.exec:\flfrfxr.exe86⤵PID:1032
-
\??\c:\lflfrlx.exec:\lflfrlx.exe87⤵PID:4320
-
\??\c:\9djjv.exec:\9djjv.exe88⤵PID:4288
-
\??\c:\rxffxxx.exec:\rxffxxx.exe89⤵PID:2292
-
\??\c:\5xffflf.exec:\5xffflf.exe90⤵PID:428
-
\??\c:\nnnbtb.exec:\nnnbtb.exe91⤵PID:4148
-
\??\c:\dpvvp.exec:\dpvvp.exe92⤵PID:988
-
\??\c:\5vvjj.exec:\5vvjj.exe93⤵PID:2708
-
\??\c:\lfrffxx.exec:\lfrffxx.exe94⤵PID:4160
-
\??\c:\lrrrffx.exec:\lrrrffx.exe95⤵PID:2200
-
\??\c:\tbbbbt.exec:\tbbbbt.exe96⤵PID:4552
-
\??\c:\bbtnhh.exec:\bbtnhh.exe97⤵PID:4660
-
\??\c:\jddvd.exec:\jddvd.exe98⤵PID:3696
-
\??\c:\lflxlll.exec:\lflxlll.exe99⤵PID:1252
-
\??\c:\3lrlxlx.exec:\3lrlxlx.exe100⤵PID:4428
-
\??\c:\bttbtb.exec:\bttbtb.exe101⤵PID:3484
-
\??\c:\tbbthb.exec:\tbbthb.exe102⤵PID:2400
-
\??\c:\jjddj.exec:\jjddj.exe103⤵PID:3208
-
\??\c:\ddvjv.exec:\ddvjv.exe104⤵PID:4168
-
\??\c:\fxrrfxl.exec:\fxrrfxl.exe105⤵PID:1396
-
\??\c:\xxrrrlf.exec:\xxrrrlf.exe106⤵PID:4000
-
\??\c:\hhnntt.exec:\hhnntt.exe107⤵PID:1584
-
\??\c:\dpvpd.exec:\dpvpd.exe108⤵PID:528
-
\??\c:\djjpd.exec:\djjpd.exe109⤵PID:2676
-
\??\c:\flfrffr.exec:\flfrffr.exe110⤵PID:3980
-
\??\c:\xfrfrrl.exec:\xfrfrrl.exe111⤵PID:4392
-
\??\c:\hnbbtt.exec:\hnbbtt.exe112⤵PID:4372
-
\??\c:\hhhbnh.exec:\hhhbnh.exe113⤵PID:752
-
\??\c:\vjjdj.exec:\vjjdj.exe114⤵PID:4676
-
\??\c:\7pvjp.exec:\7pvjp.exe115⤵PID:1292
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe116⤵PID:3108
-
\??\c:\9xxrfxr.exec:\9xxrfxr.exe117⤵PID:1884
-
\??\c:\5ttnbt.exec:\5ttnbt.exe118⤵PID:916
-
\??\c:\bnnbbt.exec:\bnnbbt.exe119⤵PID:928
-
\??\c:\1ddvp.exec:\1ddvp.exe120⤵PID:740
-
\??\c:\flllxxr.exec:\flllxxr.exe121⤵PID:2656
-
\??\c:\3rrrfxr.exec:\3rrrfxr.exe122⤵PID:1904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-