Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe
-
Size
190KB
-
MD5
06287fa228425e823150ed4af3bebd11
-
SHA1
0995123376c401338ad81e3721f3dff77624b50c
-
SHA256
00772b2f101126e1d227af508946b205f166332dcd14e047ff5d1e7d862f6148
-
SHA512
43356483e92d36eff32e8ff4fe85f442f924a738c8e51bed515c26a20fb6414395c8b9652fe639c0acb1654aa25c67d696685e1e743830b06b7d17649d757a72
-
SSDEEP
1536:EvQBeOGtrYSSsrc93UBIfdC67m6AJiqjt3ufT/FRxZOYCqc:EhOm2sI93UufdC67ciyt3ujFf73c
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1912-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-27-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/404-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-1029-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2788-1084-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-1174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2576 3htthb.exe 2492 vpddv.exe 2600 lxlxlfl.exe 2480 frlrrrr.exe 2608 5thtnh.exe 2536 pdvvj.exe 2376 3lffxxf.exe 2804 9xfflll.exe 1552 htbhhh.exe 2340 pdvpp.exe 2680 5frrfff.exe 2108 lfrrxxf.exe 884 1tnbnt.exe 1628 jvvvv.exe 404 frxrlff.exe 1456 xrffffl.exe 2284 hthbtn.exe 3028 pdppd.exe 1144 djvjj.exe 1252 7xfffxf.exe 2744 bnttbt.exe 2208 tnttht.exe 812 jjvdv.exe 1576 7ffxrlr.exe 560 thtbhh.exe 1512 9vvvd.exe 1544 xllxrll.exe 1672 9htbhh.exe 1048 htbbbt.exe 2032 pdjdv.exe 996 frrrlll.exe 1540 xrxxfxr.exe 1280 1tbbbh.exe 1736 pjvvd.exe 1532 frlffrx.exe 2648 9ffxxrl.exe 2468 hthbhh.exe 2896 nbhbnh.exe 2560 pdjjv.exe 2656 1pjjj.exe 2664 rlllxlf.exe 2488 3hnnnh.exe 2476 hbnhnb.exe 2532 dpppd.exe 1712 5dpvv.exe 2484 xlfflff.exe 1572 rlfrrlr.exe 2352 nhhhtt.exe 2660 1nbhbb.exe 2692 1pvdv.exe 2776 rlfxfxx.exe 1612 lxfxrxx.exe 1016 htttnn.exe 1508 bntttt.exe 1684 dpppp.exe 404 5pdvj.exe 1688 nhntnt.exe 2284 nhnnbt.exe 2008 pjvjp.exe 2176 pdpvd.exe 1888 frxxxrr.exe 2452 nhhhnn.exe 796 1hhhnn.exe 2188 dvvvd.exe -
resource yara_rule behavioral1/memory/1912-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-522-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/556-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-1034-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-1116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-1129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-1174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-1211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-1225-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2576 1912 06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe 28 PID 1912 wrote to memory of 2576 1912 06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe 28 PID 1912 wrote to memory of 2576 1912 06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe 28 PID 1912 wrote to memory of 2576 1912 06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe 28 PID 2576 wrote to memory of 2492 2576 3htthb.exe 29 PID 2576 wrote to memory of 2492 2576 3htthb.exe 29 PID 2576 wrote to memory of 2492 2576 3htthb.exe 29 PID 2576 wrote to memory of 2492 2576 3htthb.exe 29 PID 2492 wrote to memory of 2600 2492 vpddv.exe 30 PID 2492 wrote to memory of 2600 2492 vpddv.exe 30 PID 2492 wrote to memory of 2600 2492 vpddv.exe 30 PID 2492 wrote to memory of 2600 2492 vpddv.exe 30 PID 2600 wrote to memory of 2480 2600 lxlxlfl.exe 31 PID 2600 wrote to memory of 2480 2600 lxlxlfl.exe 31 PID 2600 wrote to memory of 2480 2600 lxlxlfl.exe 31 PID 2600 wrote to memory of 2480 2600 lxlxlfl.exe 31 PID 2480 wrote to memory of 2608 2480 frlrrrr.exe 32 PID 2480 wrote to memory of 2608 2480 frlrrrr.exe 32 PID 2480 wrote to memory of 2608 2480 frlrrrr.exe 32 PID 2480 wrote to memory of 2608 2480 frlrrrr.exe 32 PID 2608 wrote to memory of 2536 2608 5thtnh.exe 33 PID 2608 wrote to memory of 2536 2608 5thtnh.exe 33 PID 2608 wrote to memory of 2536 2608 5thtnh.exe 33 PID 2608 wrote to memory of 2536 2608 5thtnh.exe 33 PID 2536 wrote to memory of 2376 2536 pdvvj.exe 34 PID 2536 wrote to memory of 2376 2536 pdvvj.exe 34 PID 2536 wrote to memory of 2376 2536 pdvvj.exe 34 PID 2536 wrote to memory of 2376 2536 pdvvj.exe 34 PID 2376 wrote to memory of 2804 2376 3lffxxf.exe 35 PID 2376 wrote to memory of 2804 2376 3lffxxf.exe 35 PID 2376 wrote to memory of 2804 2376 3lffxxf.exe 35 PID 2376 wrote to memory of 2804 2376 3lffxxf.exe 35 PID 2804 wrote to memory of 1552 2804 9xfflll.exe 36 PID 2804 wrote to memory of 1552 2804 9xfflll.exe 36 PID 2804 wrote to memory of 1552 2804 9xfflll.exe 36 PID 2804 wrote to memory of 1552 2804 9xfflll.exe 36 PID 1552 wrote to memory of 2340 1552 htbhhh.exe 37 PID 1552 wrote to memory of 2340 1552 htbhhh.exe 37 PID 1552 wrote to memory of 2340 1552 htbhhh.exe 37 PID 1552 wrote to memory of 2340 1552 htbhhh.exe 37 PID 2340 wrote to memory of 2680 2340 pdvpp.exe 38 PID 2340 wrote to memory of 2680 2340 pdvpp.exe 38 PID 2340 wrote to memory of 2680 2340 pdvpp.exe 38 PID 2340 wrote to memory of 2680 2340 pdvpp.exe 38 PID 2680 wrote to memory of 2108 2680 5frrfff.exe 39 PID 2680 wrote to memory of 2108 2680 5frrfff.exe 39 PID 2680 wrote to memory of 2108 2680 5frrfff.exe 39 PID 2680 wrote to memory of 2108 2680 5frrfff.exe 39 PID 2108 wrote to memory of 884 2108 lfrrxxf.exe 40 PID 2108 wrote to memory of 884 2108 lfrrxxf.exe 40 PID 2108 wrote to memory of 884 2108 lfrrxxf.exe 40 PID 2108 wrote to memory of 884 2108 lfrrxxf.exe 40 PID 884 wrote to memory of 1628 884 1tnbnt.exe 41 PID 884 wrote to memory of 1628 884 1tnbnt.exe 41 PID 884 wrote to memory of 1628 884 1tnbnt.exe 41 PID 884 wrote to memory of 1628 884 1tnbnt.exe 41 PID 1628 wrote to memory of 404 1628 jvvvv.exe 42 PID 1628 wrote to memory of 404 1628 jvvvv.exe 42 PID 1628 wrote to memory of 404 1628 jvvvv.exe 42 PID 1628 wrote to memory of 404 1628 jvvvv.exe 42 PID 404 wrote to memory of 1456 404 frxrlff.exe 43 PID 404 wrote to memory of 1456 404 frxrlff.exe 43 PID 404 wrote to memory of 1456 404 frxrlff.exe 43 PID 404 wrote to memory of 1456 404 frxrlff.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\3htthb.exec:\3htthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\vpddv.exec:\vpddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\lxlxlfl.exec:\lxlxlfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\frlrrrr.exec:\frlrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\5thtnh.exec:\5thtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pdvvj.exec:\pdvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3lffxxf.exec:\3lffxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\9xfflll.exec:\9xfflll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\htbhhh.exec:\htbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pdvpp.exec:\pdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\5frrfff.exec:\5frrfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\1tnbnt.exec:\1tnbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\jvvvv.exec:\jvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\frxrlff.exec:\frxrlff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\xrffffl.exec:\xrffffl.exe17⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hthbtn.exec:\hthbtn.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pdppd.exec:\pdppd.exe19⤵
- Executes dropped EXE
PID:3028 -
\??\c:\djvjj.exec:\djvjj.exe20⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7xfffxf.exec:\7xfffxf.exe21⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bnttbt.exec:\bnttbt.exe22⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tnttht.exec:\tnttht.exe23⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jjvdv.exec:\jjvdv.exe24⤵
- Executes dropped EXE
PID:812 -
\??\c:\7ffxrlr.exec:\7ffxrlr.exe25⤵
- Executes dropped EXE
PID:1576 -
\??\c:\thtbhh.exec:\thtbhh.exe26⤵
- Executes dropped EXE
PID:560 -
\??\c:\9vvvd.exec:\9vvvd.exe27⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xllxrll.exec:\xllxrll.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9htbhh.exec:\9htbhh.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\htbbbt.exec:\htbbbt.exe30⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pdjdv.exec:\pdjdv.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\frrrlll.exec:\frrrlll.exe32⤵
- Executes dropped EXE
PID:996 -
\??\c:\xrxxfxr.exec:\xrxxfxr.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1tbbbh.exec:\1tbbbh.exe34⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pjvvd.exec:\pjvvd.exe35⤵
- Executes dropped EXE
PID:1736 -
\??\c:\frlffrx.exec:\frlffrx.exe36⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9ffxxrl.exec:\9ffxxrl.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hthbhh.exec:\hthbhh.exe38⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nbhbnh.exec:\nbhbnh.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pdjjv.exec:\pdjjv.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1pjjj.exec:\1pjjj.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rlllxlf.exec:\rlllxlf.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3hnnnh.exec:\3hnnnh.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbnhnb.exec:\hbnhnb.exe44⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dpppd.exec:\dpppd.exe45⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5dpvv.exec:\5dpvv.exe46⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xlfflff.exec:\xlfflff.exe47⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rlfrrlr.exec:\rlfrrlr.exe48⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nhhhtt.exec:\nhhhtt.exe49⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1nbhbb.exec:\1nbhbb.exe50⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1pvdv.exec:\1pvdv.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rlfxfxx.exec:\rlfxfxx.exe52⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\htttnn.exec:\htttnn.exe54⤵
- Executes dropped EXE
PID:1016 -
\??\c:\bntttt.exec:\bntttt.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dpppp.exec:\dpppp.exe56⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5pdvj.exec:\5pdvj.exe57⤵
- Executes dropped EXE
PID:404 -
\??\c:\nhntnt.exec:\nhntnt.exe58⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nhnnbt.exec:\nhnnbt.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pjvjp.exec:\pjvjp.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pdpvd.exec:\pdpvd.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\frxxxrr.exec:\frxxxrr.exe62⤵
- Executes dropped EXE
PID:1888 -
\??\c:\nhhhnn.exec:\nhhhnn.exe63⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1hhhnn.exec:\1hhhnn.exe64⤵
- Executes dropped EXE
PID:796 -
\??\c:\dvvvd.exec:\dvvvd.exe65⤵
- Executes dropped EXE
PID:2188 -
\??\c:\pjjjj.exec:\pjjjj.exe66⤵PID:1408
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe67⤵PID:1808
-
\??\c:\1bnhhh.exec:\1bnhhh.exe68⤵PID:1768
-
\??\c:\hhbtbb.exec:\hhbtbb.exe69⤵PID:3060
-
\??\c:\pdjjd.exec:\pdjjd.exe70⤵PID:2332
-
\??\c:\xrfffll.exec:\xrfffll.exe71⤵PID:1656
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe72⤵PID:776
-
\??\c:\nhthtn.exec:\nhthtn.exe73⤵PID:1936
-
\??\c:\ppddp.exec:\ppddp.exe74⤵PID:2136
-
\??\c:\dvvpp.exec:\dvvpp.exe75⤵PID:556
-
\??\c:\1xllllf.exec:\1xllllf.exe76⤵PID:576
-
\??\c:\fxrrllx.exec:\fxrrllx.exe77⤵PID:2884
-
\??\c:\btbbbt.exec:\btbbbt.exe78⤵PID:2652
-
\??\c:\pvddd.exec:\pvddd.exe79⤵PID:1964
-
\??\c:\dvppv.exec:\dvppv.exe80⤵PID:1912
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe81⤵PID:2216
-
\??\c:\frxfrxf.exec:\frxfrxf.exe82⤵PID:2472
-
\??\c:\1bnnnb.exec:\1bnnnb.exe83⤵PID:2936
-
\??\c:\ddpjp.exec:\ddpjp.exe84⤵PID:2728
-
\??\c:\9vjdd.exec:\9vjdd.exe85⤵PID:2556
-
\??\c:\rrffllx.exec:\rrffllx.exe86⤵PID:2496
-
\??\c:\rxllllr.exec:\rxllllr.exe87⤵PID:2464
-
\??\c:\7hnttb.exec:\7hnttb.exe88⤵PID:2640
-
\??\c:\7tbbtt.exec:\7tbbtt.exe89⤵PID:2820
-
\??\c:\dpdjj.exec:\dpdjj.exe90⤵PID:2416
-
\??\c:\dpdjv.exec:\dpdjv.exe91⤵PID:2832
-
\??\c:\rfrrxrf.exec:\rfrrxrf.exe92⤵PID:2812
-
\??\c:\hbbhtb.exec:\hbbhtb.exe93⤵PID:1728
-
\??\c:\nhtbnn.exec:\nhtbnn.exe94⤵PID:1376
-
\??\c:\pjpvd.exec:\pjpvd.exe95⤵PID:2548
-
\??\c:\7ddvv.exec:\7ddvv.exe96⤵PID:2660
-
\??\c:\fxxfllr.exec:\fxxfllr.exe97⤵PID:332
-
\??\c:\frfflrr.exec:\frfflrr.exe98⤵PID:2776
-
\??\c:\bthnbn.exec:\bthnbn.exe99⤵PID:2292
-
\??\c:\1nnnnn.exec:\1nnnnn.exe100⤵PID:1800
-
\??\c:\1htbht.exec:\1htbht.exe101⤵PID:2104
-
\??\c:\pjddj.exec:\pjddj.exe102⤵PID:1812
-
\??\c:\9vdvj.exec:\9vdvj.exe103⤵PID:1516
-
\??\c:\frllllx.exec:\frllllx.exe104⤵PID:1136
-
\??\c:\3frlxrr.exec:\3frlxrr.exe105⤵PID:864
-
\??\c:\1bnhnn.exec:\1bnhnn.exe106⤵PID:2184
-
\??\c:\3jjdv.exec:\3jjdv.exe107⤵PID:2740
-
\??\c:\jvddv.exec:\jvddv.exe108⤵PID:2344
-
\??\c:\9rrxxxl.exec:\9rrxxxl.exe109⤵PID:2452
-
\??\c:\fxrfrxx.exec:\fxrfrxx.exe110⤵PID:672
-
\??\c:\nbnnnh.exec:\nbnnnh.exe111⤵PID:2188
-
\??\c:\ppjpd.exec:\ppjpd.exe112⤵PID:1412
-
\??\c:\1djdj.exec:\1djdj.exe113⤵PID:1808
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe114⤵PID:1604
-
\??\c:\3xlfrfl.exec:\3xlfrfl.exe115⤵PID:1480
-
\??\c:\3bnthn.exec:\3bnthn.exe116⤵PID:2332
-
\??\c:\dpjpv.exec:\dpjpv.exe117⤵PID:1656
-
\??\c:\dpvjp.exec:\dpvjp.exe118⤵PID:572
-
\??\c:\xlxxxxr.exec:\xlxxxxr.exe119⤵PID:1936
-
\??\c:\lfrrffr.exec:\lfrrffr.exe120⤵PID:1892
-
\??\c:\tnbhht.exec:\tnbhht.exe121⤵PID:556
-
\??\c:\vjdvj.exec:\vjdvj.exe122⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-