Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe
-
Size
375KB
-
MD5
0b93ed3db386dc4c80abd7848470eccc
-
SHA1
bcd9b96ea3b7e56f23e9a2796d4dd9f9b3df072f
-
SHA256
c8b665a23514bc5142d09154b5e25b670ec1b1042b9c19d7a85b1c7f6d9a3aa2
-
SHA512
bcd8eec141ed3cfb1d3b89edf535ee7627f920dcecd2ef62fa07e739c0ad0e0baba797825c7550cfd792a969c3066ed19fcfce8840d8a52cd2e8a73c0604d3be
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwCFz7:8cm7ImGddXmNt251UriZFwCFz7
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1688-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-134-0x00000000002F0000-0x000000000031A000-memory.dmp family_blackmoon behavioral1/memory/1524-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-162-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2544-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-940-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2792-967-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2200 frflxxf.exe 2724 vpdjv.exe 2556 xrrrrfl.exe 2672 1tbhhh.exe 2572 jvddj.exe 2564 3frlrrx.exe 2264 nhtbnn.exe 2620 pjpvd.exe 2508 fxlxllx.exe 1728 tnbntn.exe 2324 vpdjp.exe 2812 3bnhnh.exe 3064 1pdjv.exe 2100 5dppp.exe 1524 hnntbn.exe 1968 nnhbbh.exe 1196 9vjdj.exe 1532 frfrrff.exe 2088 hbnntt.exe 2544 frxfrxx.exe 2236 btbbnn.exe 932 9djjj.exe 1808 lflfllx.exe 1744 3ththb.exe 2272 dpvjv.exe 1820 fxllllr.exe 900 bhtttn.exe 2368 vvjpv.exe 2148 9flflxx.exe 1872 xrrxfff.exe 2220 9hthnn.exe 1520 vpvdp.exe 2308 fxllxrx.exe 1604 htbttb.exe 1052 ttnhnt.exe 2024 9jppv.exe 2996 jddvv.exe 2592 xrlfllr.exe 2648 tnthbt.exe 3004 vvvpp.exe 2572 tntbnt.exe 2684 9jvvv.exe 2584 rllrxrr.exe 2264 nhtbnn.exe 2496 pjddj.exe 2104 ddvjd.exe 2512 rlxlrxx.exe 1940 1bnbtb.exe 2824 jdjpv.exe 2816 rrllfxr.exe 1592 1htntb.exe 1944 1tntht.exe 1700 vvppd.exe 1624 llfrllx.exe 2748 xlxrrrf.exe 2284 nhtnbb.exe 1324 jjvjd.exe 2632 1xlrrxf.exe 2268 hbnthh.exe 1784 tnhhtn.exe 712 1pvvp.exe 2236 5jdvd.exe 3044 1rxlxxf.exe 632 1hnnnn.exe -
resource yara_rule behavioral1/memory/1688-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-677-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2776-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-960-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-1055-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-1126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-1145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-1182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-1237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-1256-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2200 1688 0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2200 1688 0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2200 1688 0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2200 1688 0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe 28 PID 2200 wrote to memory of 2724 2200 frflxxf.exe 29 PID 2200 wrote to memory of 2724 2200 frflxxf.exe 29 PID 2200 wrote to memory of 2724 2200 frflxxf.exe 29 PID 2200 wrote to memory of 2724 2200 frflxxf.exe 29 PID 2724 wrote to memory of 2556 2724 vpdjv.exe 30 PID 2724 wrote to memory of 2556 2724 vpdjv.exe 30 PID 2724 wrote to memory of 2556 2724 vpdjv.exe 30 PID 2724 wrote to memory of 2556 2724 vpdjv.exe 30 PID 2556 wrote to memory of 2672 2556 xrrrrfl.exe 31 PID 2556 wrote to memory of 2672 2556 xrrrrfl.exe 31 PID 2556 wrote to memory of 2672 2556 xrrrrfl.exe 31 PID 2556 wrote to memory of 2672 2556 xrrrrfl.exe 31 PID 2672 wrote to memory of 2572 2672 1tbhhh.exe 32 PID 2672 wrote to memory of 2572 2672 1tbhhh.exe 32 PID 2672 wrote to memory of 2572 2672 1tbhhh.exe 32 PID 2672 wrote to memory of 2572 2672 1tbhhh.exe 32 PID 2572 wrote to memory of 2564 2572 jvddj.exe 33 PID 2572 wrote to memory of 2564 2572 jvddj.exe 33 PID 2572 wrote to memory of 2564 2572 jvddj.exe 33 PID 2572 wrote to memory of 2564 2572 jvddj.exe 33 PID 2564 wrote to memory of 2264 2564 3frlrrx.exe 34 PID 2564 wrote to memory of 2264 2564 3frlrrx.exe 34 PID 2564 wrote to memory of 2264 2564 3frlrrx.exe 34 PID 2564 wrote to memory of 2264 2564 3frlrrx.exe 34 PID 2264 wrote to memory of 2620 2264 nhtbnn.exe 35 PID 2264 wrote to memory of 2620 2264 nhtbnn.exe 35 PID 2264 wrote to memory of 2620 2264 nhtbnn.exe 35 PID 2264 wrote to memory of 2620 2264 nhtbnn.exe 35 PID 2620 wrote to memory of 2508 2620 pjpvd.exe 36 PID 2620 wrote to memory of 2508 2620 pjpvd.exe 36 PID 2620 wrote to memory of 2508 2620 pjpvd.exe 36 PID 2620 wrote to memory of 2508 2620 pjpvd.exe 36 PID 2508 wrote to memory of 1728 2508 fxlxllx.exe 37 PID 2508 wrote to memory of 1728 2508 fxlxllx.exe 37 PID 2508 wrote to memory of 1728 2508 fxlxllx.exe 37 PID 2508 wrote to memory of 1728 2508 fxlxllx.exe 37 PID 1728 wrote to memory of 2324 1728 tnbntn.exe 38 PID 1728 wrote to memory of 2324 1728 tnbntn.exe 38 PID 1728 wrote to memory of 2324 1728 tnbntn.exe 38 PID 1728 wrote to memory of 2324 1728 tnbntn.exe 38 PID 2324 wrote to memory of 2812 2324 vpdjp.exe 39 PID 2324 wrote to memory of 2812 2324 vpdjp.exe 39 PID 2324 wrote to memory of 2812 2324 vpdjp.exe 39 PID 2324 wrote to memory of 2812 2324 vpdjp.exe 39 PID 2812 wrote to memory of 3064 2812 3bnhnh.exe 40 PID 2812 wrote to memory of 3064 2812 3bnhnh.exe 40 PID 2812 wrote to memory of 3064 2812 3bnhnh.exe 40 PID 2812 wrote to memory of 3064 2812 3bnhnh.exe 40 PID 3064 wrote to memory of 2100 3064 1pdjv.exe 41 PID 3064 wrote to memory of 2100 3064 1pdjv.exe 41 PID 3064 wrote to memory of 2100 3064 1pdjv.exe 41 PID 3064 wrote to memory of 2100 3064 1pdjv.exe 41 PID 2100 wrote to memory of 1524 2100 5dppp.exe 42 PID 2100 wrote to memory of 1524 2100 5dppp.exe 42 PID 2100 wrote to memory of 1524 2100 5dppp.exe 42 PID 2100 wrote to memory of 1524 2100 5dppp.exe 42 PID 1524 wrote to memory of 1968 1524 hnntbn.exe 43 PID 1524 wrote to memory of 1968 1524 hnntbn.exe 43 PID 1524 wrote to memory of 1968 1524 hnntbn.exe 43 PID 1524 wrote to memory of 1968 1524 hnntbn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b93ed3db386dc4c80abd7848470eccc_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\frflxxf.exec:\frflxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vpdjv.exec:\vpdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xrrrrfl.exec:\xrrrrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\1tbhhh.exec:\1tbhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\jvddj.exec:\jvddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\3frlrrx.exec:\3frlrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nhtbnn.exec:\nhtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\pjpvd.exec:\pjpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fxlxllx.exec:\fxlxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\tnbntn.exec:\tnbntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\vpdjp.exec:\vpdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3bnhnh.exec:\3bnhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\1pdjv.exec:\1pdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\5dppp.exec:\5dppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hnntbn.exec:\hnntbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nnhbbh.exec:\nnhbbh.exe17⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9vjdj.exec:\9vjdj.exe18⤵
- Executes dropped EXE
PID:1196 -
\??\c:\frfrrff.exec:\frfrrff.exe19⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hbnntt.exec:\hbnntt.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\frxfrxx.exec:\frxfrxx.exe21⤵
- Executes dropped EXE
PID:2544 -
\??\c:\btbbnn.exec:\btbbnn.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\9djjj.exec:\9djjj.exe23⤵
- Executes dropped EXE
PID:932 -
\??\c:\lflfllx.exec:\lflfllx.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3ththb.exec:\3ththb.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dpvjv.exec:\dpvjv.exe26⤵
- Executes dropped EXE
PID:2272 -
\??\c:\fxllllr.exec:\fxllllr.exe27⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bhtttn.exec:\bhtttn.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\vvjpv.exec:\vvjpv.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9flflxx.exec:\9flflxx.exe30⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrrxfff.exec:\xrrxfff.exe31⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9hthnn.exec:\9hthnn.exe32⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpvdp.exec:\vpvdp.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\fxllxrx.exec:\fxllxrx.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\htbttb.exec:\htbttb.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ttnhnt.exec:\ttnhnt.exe36⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9jppv.exec:\9jppv.exe37⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jddvv.exec:\jddvv.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xrlfllr.exec:\xrlfllr.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnthbt.exec:\tnthbt.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvvpp.exec:\vvvpp.exe41⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tntbnt.exec:\tntbnt.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9jvvv.exec:\9jvvv.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rllrxrr.exec:\rllrxrr.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhtbnn.exec:\nhtbnn.exe45⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pjddj.exec:\pjddj.exe46⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ddvjd.exec:\ddvjd.exe47⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlxlrxx.exec:\rlxlrxx.exe48⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1bnbtb.exec:\1bnbtb.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jdjpv.exec:\jdjpv.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rrllfxr.exec:\rrllfxr.exe51⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1htntb.exec:\1htntb.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1tntht.exec:\1tntht.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vvppd.exec:\vvppd.exe54⤵
- Executes dropped EXE
PID:1700 -
\??\c:\llfrllx.exec:\llfrllx.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xlxrrrf.exec:\xlxrrrf.exe56⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nhtnbb.exec:\nhtnbb.exe57⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jjvjd.exec:\jjvjd.exe58⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1xlrrxf.exec:\1xlrrxf.exe59⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbnthh.exec:\hbnthh.exe60⤵
- Executes dropped EXE
PID:2268 -
\??\c:\tnhhtn.exec:\tnhhtn.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1pvvp.exec:\1pvvp.exe62⤵
- Executes dropped EXE
PID:712 -
\??\c:\5jdvd.exec:\5jdvd.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1rxlxxf.exec:\1rxlxxf.exe64⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1hnnnn.exec:\1hnnnn.exe65⤵
- Executes dropped EXE
PID:632 -
\??\c:\ddpvj.exec:\ddpvj.exe66⤵PID:1984
-
\??\c:\dvjvp.exec:\dvjvp.exe67⤵PID:1744
-
\??\c:\rlrxxrf.exec:\rlrxxrf.exe68⤵PID:2272
-
\??\c:\3hhbhh.exec:\3hhbhh.exe69⤵PID:1660
-
\??\c:\1nbtbb.exec:\1nbtbb.exe70⤵PID:328
-
\??\c:\jvdpp.exec:\jvdpp.exe71⤵PID:1380
-
\??\c:\llllxfx.exec:\llllxfx.exe72⤵PID:2356
-
\??\c:\7xlrfrr.exec:\7xlrfrr.exe73⤵PID:836
-
\??\c:\btbbnn.exec:\btbbnn.exe74⤵PID:1672
-
\??\c:\7vpdj.exec:\7vpdj.exe75⤵PID:2188
-
\??\c:\vjppv.exec:\vjppv.exe76⤵PID:2948
-
\??\c:\rfrxfxl.exec:\rfrxfxl.exe77⤵PID:2376
-
\??\c:\hbhnnn.exec:\hbhnnn.exe78⤵PID:1712
-
\??\c:\7ntbhh.exec:\7ntbhh.exe79⤵PID:1788
-
\??\c:\3pjpv.exec:\3pjpv.exe80⤵PID:2200
-
\??\c:\7fxxffl.exec:\7fxxffl.exe81⤵PID:2372
-
\??\c:\9rflxxl.exec:\9rflxxl.exe82⤵PID:2724
-
\??\c:\nhnnnn.exec:\nhnnnn.exe83⤵PID:2556
-
\??\c:\bhtttb.exec:\bhtttb.exe84⤵PID:2844
-
\??\c:\pdvvj.exec:\pdvvj.exe85⤵PID:2064
-
\??\c:\7flrxxf.exec:\7flrxxf.exe86⤵PID:2720
-
\??\c:\lxlrxrf.exec:\lxlrxrf.exe87⤵PID:2800
-
\??\c:\3tbbbt.exec:\3tbbbt.exe88⤵PID:2560
-
\??\c:\3bnthb.exec:\3bnthb.exe89⤵PID:2500
-
\??\c:\jvddd.exec:\jvddd.exe90⤵PID:2920
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe91⤵PID:2940
-
\??\c:\lflxxxr.exec:\lflxxxr.exe92⤵PID:2524
-
\??\c:\thtbhh.exec:\thtbhh.exe93⤵PID:2776
-
\??\c:\5tnntt.exec:\5tnntt.exe94⤵PID:2740
-
\??\c:\5dvjd.exec:\5dvjd.exe95⤵PID:2704
-
\??\c:\lxlrxxl.exec:\lxlrxxl.exe96⤵PID:2044
-
\??\c:\lllllfl.exec:\lllllfl.exe97⤵PID:764
-
\??\c:\nhbbhn.exec:\nhbbhn.exe98⤵PID:1812
-
\??\c:\dpjpv.exec:\dpjpv.exe99⤵PID:1640
-
\??\c:\vjppv.exec:\vjppv.exe100⤵PID:1600
-
\??\c:\lfxxxrr.exec:\lfxxxrr.exe101⤵PID:2736
-
\??\c:\xrrxfrl.exec:\xrrxfrl.exe102⤵PID:876
-
\??\c:\nhtbth.exec:\nhtbth.exe103⤵PID:2288
-
\??\c:\nhhhnb.exec:\nhhhnb.exe104⤵PID:2084
-
\??\c:\9dddj.exec:\9dddj.exe105⤵PID:336
-
\??\c:\flfrxxl.exec:\flfrxxl.exe106⤵PID:1708
-
\??\c:\llfflxr.exec:\llfflxr.exe107⤵PID:1484
-
\??\c:\tnntbt.exec:\tnntbt.exe108⤵PID:552
-
\??\c:\dvpjv.exec:\dvpjv.exe109⤵PID:1856
-
\??\c:\jvpjj.exec:\jvpjj.exe110⤵PID:2020
-
\??\c:\rlflxxl.exec:\rlflxxl.exe111⤵PID:684
-
\??\c:\1bhbhb.exec:\1bhbhb.exe112⤵PID:1344
-
\??\c:\nnhbhn.exec:\nnhbhn.exe113⤵PID:1744
-
\??\c:\ppjjd.exec:\ppjjd.exe114⤵PID:964
-
\??\c:\rfrxfff.exec:\rfrxfff.exe115⤵PID:1660
-
\??\c:\3xlffff.exec:\3xlffff.exe116⤵PID:1792
-
\??\c:\3htbbb.exec:\3htbbb.exe117⤵PID:1380
-
\??\c:\ddppp.exec:\ddppp.exe118⤵PID:3040
-
\??\c:\vvvpv.exec:\vvvpv.exe119⤵PID:1872
-
\??\c:\3rlxflx.exec:\3rlxflx.exe120⤵PID:1656
-
\??\c:\bbttbh.exec:\bbttbh.exe121⤵PID:2128
-
\??\c:\1bhbbb.exec:\1bhbbb.exe122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-