Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe
-
Size
377KB
-
MD5
25d9cbbdbb52b1c236b517884fae28ef
-
SHA1
c8274516ccc464203f1541cd3a25c2c4e9e96482
-
SHA256
2af3b94af46618ff14c9597e22f42a8b75a7dccbb5e0a7ca6eb5bb156e9bffb4
-
SHA512
e905854181fba867fedb6445221fe29fcf4d5a718015936ab9599f5bbe4b7dfb0aa04261027b914653cac2b6066a86b05a803c9ae5cc264e6ba61c6d7e4d2b31
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFw8TCK:8cm7ImGddXmNt251UriZFwGCK
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2288-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-235-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1240-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-632-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2080-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-993-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1352-1096-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-1199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-1212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-1237-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2600 flflfxl.exe 2144 rlfrllx.exe 2624 hbtbhn.exe 2948 rxlrffl.exe 2800 9nhtnt.exe 2556 jdjpd.exe 2656 rxrxlrf.exe 2516 bthhtb.exe 3028 1djvj.exe 3044 llllllr.exe 2868 jjvjp.exe 2888 3lfflrx.exe 2588 1dvvj.exe 2424 fxlrllx.exe 1520 nnhtbb.exe 1052 jvpdj.exe 2776 ttttnh.exe 836 bnhntt.exe 1316 ppjjp.exe 2128 rlxflrf.exe 2848 lfrxflx.exe 2492 3ffxffl.exe 668 pjjvj.exe 1484 nnbhhh.exe 1392 vvjpd.exe 1352 lfrrflr.exe 980 5jppd.exe 1240 1frrffx.exe 928 ppppv.exe 2076 7lflxxf.exe 2072 tnbbbb.exe 1264 dvdjv.exe 3000 tnhtbn.exe 2604 vvpvv.exe 1704 jvjdp.exe 2700 lxxfrlx.exe 2140 nhbhtb.exe 2728 pvpvp.exe 2788 dvpjp.exe 1740 lllrllf.exe 2820 btbbhn.exe 2796 1hbbtb.exe 2556 vpdjp.exe 2540 5xrxxxl.exe 316 btnbth.exe 2156 tthnnt.exe 2772 5vdpv.exe 3044 lfxfrfx.exe 2904 tnbhnh.exe 1456 hbbbnh.exe 1524 7ddjv.exe 1672 rxrrffl.exe 1300 xfrxlrr.exe 744 hhthtn.exe 296 jddjp.exe 2608 5vpdp.exe 2776 fffrxxf.exe 288 fxrxlrr.exe 2096 1hbtnt.exe 2036 1vjjv.exe 2092 3fxfrrf.exe 1844 1tntnb.exe 1088 hbttbh.exe 740 jddpd.exe -
resource yara_rule behavioral1/memory/2288-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-192-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2848-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-548-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1852-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-878-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2368-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1076-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-1115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2600 2288 25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2600 2288 25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2600 2288 25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2600 2288 25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe 28 PID 2600 wrote to memory of 2144 2600 flflfxl.exe 29 PID 2600 wrote to memory of 2144 2600 flflfxl.exe 29 PID 2600 wrote to memory of 2144 2600 flflfxl.exe 29 PID 2600 wrote to memory of 2144 2600 flflfxl.exe 29 PID 2144 wrote to memory of 2624 2144 rlfrllx.exe 30 PID 2144 wrote to memory of 2624 2144 rlfrllx.exe 30 PID 2144 wrote to memory of 2624 2144 rlfrllx.exe 30 PID 2144 wrote to memory of 2624 2144 rlfrllx.exe 30 PID 2624 wrote to memory of 2948 2624 hbtbhn.exe 31 PID 2624 wrote to memory of 2948 2624 hbtbhn.exe 31 PID 2624 wrote to memory of 2948 2624 hbtbhn.exe 31 PID 2624 wrote to memory of 2948 2624 hbtbhn.exe 31 PID 2948 wrote to memory of 2800 2948 rxlrffl.exe 32 PID 2948 wrote to memory of 2800 2948 rxlrffl.exe 32 PID 2948 wrote to memory of 2800 2948 rxlrffl.exe 32 PID 2948 wrote to memory of 2800 2948 rxlrffl.exe 32 PID 2800 wrote to memory of 2556 2800 9nhtnt.exe 33 PID 2800 wrote to memory of 2556 2800 9nhtnt.exe 33 PID 2800 wrote to memory of 2556 2800 9nhtnt.exe 33 PID 2800 wrote to memory of 2556 2800 9nhtnt.exe 33 PID 2556 wrote to memory of 2656 2556 jdjpd.exe 34 PID 2556 wrote to memory of 2656 2556 jdjpd.exe 34 PID 2556 wrote to memory of 2656 2556 jdjpd.exe 34 PID 2556 wrote to memory of 2656 2556 jdjpd.exe 34 PID 2656 wrote to memory of 2516 2656 rxrxlrf.exe 35 PID 2656 wrote to memory of 2516 2656 rxrxlrf.exe 35 PID 2656 wrote to memory of 2516 2656 rxrxlrf.exe 35 PID 2656 wrote to memory of 2516 2656 rxrxlrf.exe 35 PID 2516 wrote to memory of 3028 2516 bthhtb.exe 36 PID 2516 wrote to memory of 3028 2516 bthhtb.exe 36 PID 2516 wrote to memory of 3028 2516 bthhtb.exe 36 PID 2516 wrote to memory of 3028 2516 bthhtb.exe 36 PID 3028 wrote to memory of 3044 3028 1djvj.exe 37 PID 3028 wrote to memory of 3044 3028 1djvj.exe 37 PID 3028 wrote to memory of 3044 3028 1djvj.exe 37 PID 3028 wrote to memory of 3044 3028 1djvj.exe 37 PID 3044 wrote to memory of 2868 3044 llllllr.exe 38 PID 3044 wrote to memory of 2868 3044 llllllr.exe 38 PID 3044 wrote to memory of 2868 3044 llllllr.exe 38 PID 3044 wrote to memory of 2868 3044 llllllr.exe 38 PID 2868 wrote to memory of 2888 2868 jjvjp.exe 39 PID 2868 wrote to memory of 2888 2868 jjvjp.exe 39 PID 2868 wrote to memory of 2888 2868 jjvjp.exe 39 PID 2868 wrote to memory of 2888 2868 jjvjp.exe 39 PID 2888 wrote to memory of 2588 2888 3lfflrx.exe 40 PID 2888 wrote to memory of 2588 2888 3lfflrx.exe 40 PID 2888 wrote to memory of 2588 2888 3lfflrx.exe 40 PID 2888 wrote to memory of 2588 2888 3lfflrx.exe 40 PID 2588 wrote to memory of 2424 2588 1dvvj.exe 41 PID 2588 wrote to memory of 2424 2588 1dvvj.exe 41 PID 2588 wrote to memory of 2424 2588 1dvvj.exe 41 PID 2588 wrote to memory of 2424 2588 1dvvj.exe 41 PID 2424 wrote to memory of 1520 2424 fxlrllx.exe 42 PID 2424 wrote to memory of 1520 2424 fxlrllx.exe 42 PID 2424 wrote to memory of 1520 2424 fxlrllx.exe 42 PID 2424 wrote to memory of 1520 2424 fxlrllx.exe 42 PID 1520 wrote to memory of 1052 1520 nnhtbb.exe 43 PID 1520 wrote to memory of 1052 1520 nnhtbb.exe 43 PID 1520 wrote to memory of 1052 1520 nnhtbb.exe 43 PID 1520 wrote to memory of 1052 1520 nnhtbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\flflfxl.exec:\flflfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rlfrllx.exec:\rlfrllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\hbtbhn.exec:\hbtbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\rxlrffl.exec:\rxlrffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9nhtnt.exec:\9nhtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jdjpd.exec:\jdjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bthhtb.exec:\bthhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\1djvj.exec:\1djvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\llllllr.exec:\llllllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\jjvjp.exec:\jjvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\3lfflrx.exec:\3lfflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1dvvj.exec:\1dvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\fxlrllx.exec:\fxlrllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\nnhtbb.exec:\nnhtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\jvpdj.exec:\jvpdj.exe17⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ttttnh.exec:\ttttnh.exe18⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bnhntt.exec:\bnhntt.exe19⤵
- Executes dropped EXE
PID:836 -
\??\c:\ppjjp.exec:\ppjjp.exe20⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rlxflrf.exec:\rlxflrf.exe21⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lfrxflx.exec:\lfrxflx.exe22⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3ffxffl.exec:\3ffxffl.exe23⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjjvj.exec:\pjjvj.exe24⤵
- Executes dropped EXE
PID:668 -
\??\c:\nnbhhh.exec:\nnbhhh.exe25⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vvjpd.exec:\vvjpd.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lfrrflr.exec:\lfrrflr.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5jppd.exec:\5jppd.exe28⤵
- Executes dropped EXE
PID:980 -
\??\c:\1frrffx.exec:\1frrffx.exe29⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ppppv.exec:\ppppv.exe30⤵
- Executes dropped EXE
PID:928 -
\??\c:\7lflxxf.exec:\7lflxxf.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tnbbbb.exec:\tnbbbb.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dvdjv.exec:\dvdjv.exe33⤵
- Executes dropped EXE
PID:1264 -
\??\c:\tnhtbn.exec:\tnhtbn.exe34⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vvpvv.exec:\vvpvv.exe35⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jvjdp.exec:\jvjdp.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lxxfrlx.exec:\lxxfrlx.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhbhtb.exec:\nhbhtb.exe38⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pvpvp.exec:\pvpvp.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvpjp.exec:\dvpjp.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lllrllf.exec:\lllrllf.exe41⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btbbhn.exec:\btbbhn.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1hbbtb.exec:\1hbbtb.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpdjp.exec:\vpdjp.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\5xrxxxl.exec:\5xrxxxl.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\btnbth.exec:\btnbth.exe46⤵
- Executes dropped EXE
PID:316 -
\??\c:\tthnnt.exec:\tthnnt.exe47⤵
- Executes dropped EXE
PID:2156 -
\??\c:\5vdpv.exec:\5vdpv.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tnbhnh.exec:\tnbhnh.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hbbbnh.exec:\hbbbnh.exe51⤵
- Executes dropped EXE
PID:1456 -
\??\c:\7ddjv.exec:\7ddjv.exe52⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rxrrffl.exec:\rxrrffl.exe53⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xfrxlrr.exec:\xfrxlrr.exe54⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hhthtn.exec:\hhthtn.exe55⤵
- Executes dropped EXE
PID:744 -
\??\c:\jddjp.exec:\jddjp.exe56⤵
- Executes dropped EXE
PID:296 -
\??\c:\5vpdp.exec:\5vpdp.exe57⤵
- Executes dropped EXE
PID:2608 -
\??\c:\fffrxxf.exec:\fffrxxf.exe58⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe59⤵
- Executes dropped EXE
PID:288 -
\??\c:\1hbtnt.exec:\1hbtnt.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1vjjv.exec:\1vjjv.exe61⤵
- Executes dropped EXE
PID:2036 -
\??\c:\3fxfrrf.exec:\3fxfrrf.exe62⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1tntnb.exec:\1tntnb.exe63⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hbttbh.exec:\hbttbh.exe64⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jddpd.exec:\jddpd.exe65⤵
- Executes dropped EXE
PID:740 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe66⤵PID:1096
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe67⤵PID:3004
-
\??\c:\bttthh.exec:\bttthh.exe68⤵PID:2276
-
\??\c:\vddvv.exec:\vddvv.exe69⤵PID:1540
-
\??\c:\3frxllx.exec:\3frxllx.exe70⤵PID:1616
-
\??\c:\rxffrrl.exec:\rxffrrl.exe71⤵PID:1056
-
\??\c:\nhbnbn.exec:\nhbnbn.exe72⤵PID:352
-
\??\c:\ppdjp.exec:\ppdjp.exe73⤵PID:1852
-
\??\c:\3xrlllr.exec:\3xrlllr.exe74⤵PID:1664
-
\??\c:\lllrxlr.exec:\lllrxlr.exe75⤵PID:1372
-
\??\c:\tnntbb.exec:\tnntbb.exe76⤵PID:2972
-
\??\c:\7pjvj.exec:\7pjvj.exe77⤵PID:1828
-
\??\c:\xrffllx.exec:\xrffllx.exe78⤵PID:1180
-
\??\c:\fxrrffx.exec:\fxrrffx.exe79⤵PID:1600
-
\??\c:\ntbbnt.exec:\ntbbnt.exe80⤵PID:2828
-
\??\c:\7ttnhn.exec:\7ttnhn.exe81⤵PID:2600
-
\??\c:\vvpvd.exec:\vvpvd.exe82⤵PID:2352
-
\??\c:\llflffl.exec:\llflffl.exe83⤵PID:2140
-
\??\c:\tnhhnt.exec:\tnhhnt.exe84⤵PID:2736
-
\??\c:\3ntbth.exec:\3ntbth.exe85⤵PID:2788
-
\??\c:\vvvjv.exec:\vvvjv.exe86⤵PID:2812
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe87⤵PID:2820
-
\??\c:\hnhtnh.exec:\hnhtnh.exe88⤵PID:2576
-
\??\c:\tnhtbh.exec:\tnhtbh.exe89⤵PID:2568
-
\??\c:\vjdvd.exec:\vjdvd.exe90⤵PID:2640
-
\??\c:\rlrfrxx.exec:\rlrfrxx.exe91⤵PID:2564
-
\??\c:\9rlfrlx.exec:\9rlfrlx.exe92⤵PID:3028
-
\??\c:\nbtbhn.exec:\nbtbhn.exe93⤵PID:2876
-
\??\c:\vpjpd.exec:\vpjpd.exe94⤵PID:2916
-
\??\c:\ppjpp.exec:\ppjpp.exe95⤵PID:3020
-
\??\c:\3xxfxrf.exec:\3xxfxrf.exe96⤵PID:1512
-
\??\c:\btnbnn.exec:\btnbnn.exe97⤵PID:1684
-
\??\c:\dvjpd.exec:\dvjpd.exe98⤵PID:1588
-
\??\c:\dvpvd.exec:\dvpvd.exe99⤵PID:1752
-
\??\c:\9lfrrlf.exec:\9lfrrlf.exe100⤵PID:1976
-
\??\c:\lxrxffr.exec:\lxrxffr.exe101⤵PID:2756
-
\??\c:\7btbbb.exec:\7btbbb.exe102⤵PID:820
-
\??\c:\jdddd.exec:\jdddd.exe103⤵PID:1284
-
\??\c:\pjvdp.exec:\pjvdp.exe104⤵PID:1420
-
\??\c:\ffxffrl.exec:\ffxffrl.exe105⤵PID:2240
-
\??\c:\3bntbh.exec:\3bntbh.exe106⤵PID:2096
-
\??\c:\btnttb.exec:\btnttb.exe107⤵PID:2956
-
\??\c:\vpdjj.exec:\vpdjj.exe108⤵PID:2080
-
\??\c:\rfxfrlx.exec:\rfxfrlx.exe109⤵PID:532
-
\??\c:\nhbhbn.exec:\nhbhbn.exe110⤵PID:688
-
\??\c:\hbbhnn.exec:\hbbhnn.exe111⤵PID:572
-
\??\c:\ppjvd.exec:\ppjvd.exe112⤵PID:1484
-
\??\c:\xrflrrf.exec:\xrflrrf.exe113⤵PID:1536
-
\??\c:\nhbbnb.exec:\nhbbnb.exe114⤵PID:1028
-
\??\c:\9jdjv.exec:\9jdjv.exe115⤵PID:1616
-
\??\c:\jvppp.exec:\jvppp.exe116⤵PID:1892
-
\??\c:\1fxflrl.exec:\1fxflrl.exe117⤵PID:352
-
\??\c:\bthhnt.exec:\bthhnt.exe118⤵PID:928
-
\??\c:\nhtbtb.exec:\nhtbtb.exe119⤵PID:568
-
\??\c:\vppvp.exec:\vppvp.exe120⤵PID:2056
-
\??\c:\jvjdp.exec:\jvjdp.exe121⤵PID:888
-
\??\c:\rlffrxr.exec:\rlffrxr.exe122⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-