Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe
-
Size
200KB
-
MD5
49712d2fe62393d5668027667bc96d69
-
SHA1
e75b7299e81516497ddbfaff0837fb830e5f4bce
-
SHA256
815dc41b2ba930e22ec3087c84895096fc8e49831c2264df3aface8bee4a0f09
-
SHA512
26ec5f96c3fc60c2e05d59a481381369e720cd4ca3ca78f0f98a05a89e5e63af812242ddf9785e7d1d418f85b20899a46bd3f90ad44ad33857450adb964e6321
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltyjK:PhOm2sI93UufdC67cihvH1S/O
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2732-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-157-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2216-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-286-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1720-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-601-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-608-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-621-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-710-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2052-767-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-925-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2008-1121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 tnbhhn.exe 2776 vpvdj.exe 860 xfxlxlx.exe 2692 7bhntn.exe 2572 vpvpv.exe 2708 frxxffr.exe 2636 fxlllll.exe 2440 thhbbb.exe 2560 vjpdd.exe 2880 lrfxffr.exe 1532 hthnbh.exe 2628 vpvvd.exe 1820 fxfrxxl.exe 1020 lxrrxlr.exe 2324 nhhhnt.exe 2216 3vjdp.exe 1636 lxrllll.exe 1420 tnbhhn.exe 1388 pdpvv.exe 2264 dpddj.exe 1232 3htthb.exe 2808 5bntbh.exe 268 pdpjj.exe 580 5rfrrrr.exe 1864 hhhbtn.exe 1616 tnbnth.exe 1788 frrlrlx.exe 916 rlfllrx.exe 2304 3htnnb.exe 872 dvddj.exe 1500 9xxflrx.exe 3012 nbhhnh.exe 2528 nnhbhb.exe 1720 pdjjp.exe 2664 9lfxfrr.exe 2912 lffflff.exe 3004 1ntnbt.exe 2792 pdvjp.exe 1328 vpvvd.exe 2696 frxfxrx.exe 2728 lxlfllr.exe 2708 bhttbh.exe 2636 nhbthh.exe 2608 jpdjj.exe 2872 7vpvd.exe 1896 fxxfllr.exe 1428 5xfrxrr.exe 2740 bttbbb.exe 2624 vjvvv.exe 1824 dvdjv.exe 1872 rlrfffl.exe 272 rxrxffl.exe 2180 ntbtbb.exe 2196 7thntt.exe 1432 9dvdp.exe 636 vvdvv.exe 2260 xlffxfr.exe 1524 fxlllrr.exe 2076 bthnhh.exe 2272 nbtthb.exe 2800 jvdjj.exe 2620 vdppp.exe 2812 1xlllfl.exe 936 hhhtnb.exe -
resource yara_rule behavioral1/memory/2732-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1388-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-435-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/636-450-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-499-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-571-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-588-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-601-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-608-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-621-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-652-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-671-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-690-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-717-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-767-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-786-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-837-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-905-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-918-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-932-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-958-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-984-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-1033-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-1059-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-1073-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-1099-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2840 2732 49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe 28 PID 2732 wrote to memory of 2840 2732 49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe 28 PID 2732 wrote to memory of 2840 2732 49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe 28 PID 2732 wrote to memory of 2840 2732 49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe 28 PID 2840 wrote to memory of 2776 2840 tnbhhn.exe 29 PID 2840 wrote to memory of 2776 2840 tnbhhn.exe 29 PID 2840 wrote to memory of 2776 2840 tnbhhn.exe 29 PID 2840 wrote to memory of 2776 2840 tnbhhn.exe 29 PID 2776 wrote to memory of 860 2776 vpvdj.exe 30 PID 2776 wrote to memory of 860 2776 vpvdj.exe 30 PID 2776 wrote to memory of 860 2776 vpvdj.exe 30 PID 2776 wrote to memory of 860 2776 vpvdj.exe 30 PID 860 wrote to memory of 2692 860 xfxlxlx.exe 31 PID 860 wrote to memory of 2692 860 xfxlxlx.exe 31 PID 860 wrote to memory of 2692 860 xfxlxlx.exe 31 PID 860 wrote to memory of 2692 860 xfxlxlx.exe 31 PID 2692 wrote to memory of 2572 2692 7bhntn.exe 32 PID 2692 wrote to memory of 2572 2692 7bhntn.exe 32 PID 2692 wrote to memory of 2572 2692 7bhntn.exe 32 PID 2692 wrote to memory of 2572 2692 7bhntn.exe 32 PID 2572 wrote to memory of 2708 2572 vpvpv.exe 33 PID 2572 wrote to memory of 2708 2572 vpvpv.exe 33 PID 2572 wrote to memory of 2708 2572 vpvpv.exe 33 PID 2572 wrote to memory of 2708 2572 vpvpv.exe 33 PID 2708 wrote to memory of 2636 2708 frxxffr.exe 34 PID 2708 wrote to memory of 2636 2708 frxxffr.exe 34 PID 2708 wrote to memory of 2636 2708 frxxffr.exe 34 PID 2708 wrote to memory of 2636 2708 frxxffr.exe 34 PID 2636 wrote to memory of 2440 2636 fxlllll.exe 35 PID 2636 wrote to memory of 2440 2636 fxlllll.exe 35 PID 2636 wrote to memory of 2440 2636 fxlllll.exe 35 PID 2636 wrote to memory of 2440 2636 fxlllll.exe 35 PID 2440 wrote to memory of 2560 2440 thhbbb.exe 36 PID 2440 wrote to memory of 2560 2440 thhbbb.exe 36 PID 2440 wrote to memory of 2560 2440 thhbbb.exe 36 PID 2440 wrote to memory of 2560 2440 thhbbb.exe 36 PID 2560 wrote to memory of 2880 2560 vjpdd.exe 37 PID 2560 wrote to memory of 2880 2560 vjpdd.exe 37 PID 2560 wrote to memory of 2880 2560 vjpdd.exe 37 PID 2560 wrote to memory of 2880 2560 vjpdd.exe 37 PID 2880 wrote to memory of 1532 2880 lrfxffr.exe 38 PID 2880 wrote to memory of 1532 2880 lrfxffr.exe 38 PID 2880 wrote to memory of 1532 2880 lrfxffr.exe 38 PID 2880 wrote to memory of 1532 2880 lrfxffr.exe 38 PID 1532 wrote to memory of 2628 1532 hthnbh.exe 39 PID 1532 wrote to memory of 2628 1532 hthnbh.exe 39 PID 1532 wrote to memory of 2628 1532 hthnbh.exe 39 PID 1532 wrote to memory of 2628 1532 hthnbh.exe 39 PID 2628 wrote to memory of 1820 2628 vpvvd.exe 40 PID 2628 wrote to memory of 1820 2628 vpvvd.exe 40 PID 2628 wrote to memory of 1820 2628 vpvvd.exe 40 PID 2628 wrote to memory of 1820 2628 vpvvd.exe 40 PID 1820 wrote to memory of 1020 1820 fxfrxxl.exe 41 PID 1820 wrote to memory of 1020 1820 fxfrxxl.exe 41 PID 1820 wrote to memory of 1020 1820 fxfrxxl.exe 41 PID 1820 wrote to memory of 1020 1820 fxfrxxl.exe 41 PID 1020 wrote to memory of 2324 1020 lxrrxlr.exe 42 PID 1020 wrote to memory of 2324 1020 lxrrxlr.exe 42 PID 1020 wrote to memory of 2324 1020 lxrrxlr.exe 42 PID 1020 wrote to memory of 2324 1020 lxrrxlr.exe 42 PID 2324 wrote to memory of 2216 2324 nhhhnt.exe 43 PID 2324 wrote to memory of 2216 2324 nhhhnt.exe 43 PID 2324 wrote to memory of 2216 2324 nhhhnt.exe 43 PID 2324 wrote to memory of 2216 2324 nhhhnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tnbhhn.exec:\tnbhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vpvdj.exec:\vpvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xfxlxlx.exec:\xfxlxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\7bhntn.exec:\7bhntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vpvpv.exec:\vpvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\frxxffr.exec:\frxxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\fxlllll.exec:\fxlllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\thhbbb.exec:\thhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vjpdd.exec:\vjpdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\lrfxffr.exec:\lrfxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hthnbh.exec:\hthnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\vpvvd.exec:\vpvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\fxfrxxl.exec:\fxfrxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\lxrrxlr.exec:\lxrrxlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\nhhhnt.exec:\nhhhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3vjdp.exec:\3vjdp.exe17⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lxrllll.exec:\lxrllll.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tnbhhn.exec:\tnbhhn.exe19⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pdpvv.exec:\pdpvv.exe20⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dpddj.exec:\dpddj.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3htthb.exec:\3htthb.exe22⤵
- Executes dropped EXE
PID:1232 -
\??\c:\5bntbh.exec:\5bntbh.exe23⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pdpjj.exec:\pdpjj.exe24⤵
- Executes dropped EXE
PID:268 -
\??\c:\5rfrrrr.exec:\5rfrrrr.exe25⤵
- Executes dropped EXE
PID:580 -
\??\c:\hhhbtn.exec:\hhhbtn.exe26⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tnbnth.exec:\tnbnth.exe27⤵
- Executes dropped EXE
PID:1616 -
\??\c:\frrlrlx.exec:\frrlrlx.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rlfllrx.exec:\rlfllrx.exe29⤵
- Executes dropped EXE
PID:916 -
\??\c:\3htnnb.exec:\3htnnb.exe30⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dvddj.exec:\dvddj.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\9xxflrx.exec:\9xxflrx.exe32⤵
- Executes dropped EXE
PID:1500 -
\??\c:\nbhhnh.exec:\nbhhnh.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nnhbhb.exec:\nnhbhb.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\pdjjp.exec:\pdjjp.exe35⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9lfxfrr.exec:\9lfxfrr.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lffflff.exec:\lffflff.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1ntnbt.exec:\1ntnbt.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdvjp.exec:\pdvjp.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpvvd.exec:\vpvvd.exe40⤵
- Executes dropped EXE
PID:1328 -
\??\c:\frxfxrx.exec:\frxfxrx.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lxlfllr.exec:\lxlfllr.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bhttbh.exec:\bhttbh.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nhbthh.exec:\nhbthh.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jpdjj.exec:\jpdjj.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7vpvd.exec:\7vpvd.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxxfllr.exec:\fxxfllr.exe47⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5xfrxrr.exec:\5xfrxrr.exe48⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bttbbb.exec:\bttbbb.exe49⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vjvvv.exec:\vjvvv.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dvdjv.exec:\dvdjv.exe51⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rlrfffl.exec:\rlrfffl.exe52⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rxrxffl.exec:\rxrxffl.exe53⤵
- Executes dropped EXE
PID:272 -
\??\c:\ntbtbb.exec:\ntbtbb.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7thntt.exec:\7thntt.exe55⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9dvdp.exec:\9dvdp.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\vvdvv.exec:\vvdvv.exe57⤵
- Executes dropped EXE
PID:636 -
\??\c:\xlffxfr.exec:\xlffxfr.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\fxlllrr.exec:\fxlllrr.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bthnhh.exec:\bthnhh.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nbtthb.exec:\nbtthb.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jvdjj.exec:\jvdjj.exe62⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vdppp.exec:\vdppp.exe63⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1xlllfl.exec:\1xlllfl.exe64⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hhhtnb.exec:\hhhtnb.exe65⤵
- Executes dropped EXE
PID:936 -
\??\c:\bnbhhb.exec:\bnbhhb.exe66⤵PID:1488
-
\??\c:\vpvdp.exec:\vpvdp.exe67⤵PID:752
-
\??\c:\jpdjd.exec:\jpdjd.exe68⤵PID:1128
-
\??\c:\7lffffl.exec:\7lffffl.exe69⤵PID:1028
-
\??\c:\nbhnbt.exec:\nbhnbt.exe70⤵PID:708
-
\??\c:\nhnbbh.exec:\nhnbbh.exe71⤵PID:2068
-
\??\c:\jvdvp.exec:\jvdvp.exe72⤵PID:792
-
\??\c:\pdpjp.exec:\pdpjp.exe73⤵PID:3064
-
\??\c:\5fxxfxx.exec:\5fxxfxx.exe74⤵PID:868
-
\??\c:\lfxxlff.exec:\lfxxlff.exe75⤵PID:1500
-
\??\c:\btnbnt.exec:\btnbnt.exe76⤵PID:2732
-
\??\c:\vpvvd.exec:\vpvvd.exe77⤵PID:1880
-
\??\c:\djppp.exec:\djppp.exe78⤵PID:2904
-
\??\c:\rlrfllf.exec:\rlrfllf.exe79⤵PID:2536
-
\??\c:\7lxrrll.exec:\7lxrrll.exe80⤵PID:2568
-
\??\c:\hnbhnn.exec:\hnbhnn.exe81⤵PID:2688
-
\??\c:\5tnhnt.exec:\5tnhnt.exe82⤵PID:3004
-
\??\c:\pjvvv.exec:\pjvvv.exe83⤵PID:2716
-
\??\c:\9lflrrl.exec:\9lflrrl.exe84⤵PID:2744
-
\??\c:\fxfflrf.exec:\fxfflrf.exe85⤵PID:2704
-
\??\c:\1hbhtt.exec:\1hbhtt.exe86⤵PID:2700
-
\??\c:\bnhhnh.exec:\bnhhnh.exe87⤵PID:2672
-
\??\c:\jdvpv.exec:\jdvpv.exe88⤵PID:2452
-
\??\c:\dvdjp.exec:\dvdjp.exe89⤵PID:2608
-
\??\c:\5lflrxr.exec:\5lflrxr.exe90⤵PID:3032
-
\??\c:\thnnbt.exec:\thnnbt.exe91⤵PID:1896
-
\??\c:\btbhhn.exec:\btbhhn.exe92⤵PID:1428
-
\??\c:\7vpjv.exec:\7vpjv.exe93⤵PID:2740
-
\??\c:\pjjjv.exec:\pjjjv.exe94⤵PID:1032
-
\??\c:\llllllx.exec:\llllllx.exe95⤵PID:1968
-
\??\c:\9lfxllr.exec:\9lfxllr.exe96⤵PID:556
-
\??\c:\1tnbnn.exec:\1tnbnn.exe97⤵PID:1948
-
\??\c:\5vjjp.exec:\5vjjp.exe98⤵PID:668
-
\??\c:\1vjjj.exec:\1vjjj.exe99⤵PID:2324
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe100⤵PID:1404
-
\??\c:\xrflrrx.exec:\xrflrrx.exe101⤵PID:1496
-
\??\c:\3hbhnn.exec:\3hbhnn.exe102⤵PID:1300
-
\??\c:\5tbntt.exec:\5tbntt.exe103⤵PID:1388
-
\??\c:\ppjpj.exec:\ppjpj.exe104⤵PID:2424
-
\??\c:\7llrxrf.exec:\7llrxrf.exe105⤵PID:2036
-
\??\c:\fxfxlfr.exec:\fxfxlfr.exe106⤵PID:2052
-
\??\c:\9btntt.exec:\9btntt.exe107⤵PID:696
-
\??\c:\bntntn.exec:\bntntn.exe108⤵PID:268
-
\??\c:\jjvvv.exec:\jjvvv.exe109⤵PID:1472
-
\??\c:\jvjjd.exec:\jvjjd.exe110⤵PID:1868
-
\??\c:\fxfrxlr.exec:\fxfrxlr.exe111⤵PID:2796
-
\??\c:\1bnnbt.exec:\1bnnbt.exe112⤵PID:1036
-
\??\c:\hnttbb.exec:\hnttbb.exe113⤵PID:1044
-
\??\c:\1dvdv.exec:\1dvdv.exe114⤵PID:1028
-
\??\c:\7flllll.exec:\7flllll.exe115⤵PID:2332
-
\??\c:\lxlrllr.exec:\lxlrllr.exe116⤵PID:1376
-
\??\c:\tnbbnt.exec:\tnbbnt.exe117⤵PID:988
-
\??\c:\hbttbb.exec:\hbttbb.exe118⤵PID:2072
-
\??\c:\dvvpp.exec:\dvvpp.exe119⤵PID:1708
-
\??\c:\1vpjp.exec:\1vpjp.exe120⤵PID:1600
-
\??\c:\xlxrxrr.exec:\xlxrxrr.exe121⤵PID:1996
-
\??\c:\bbthth.exec:\bbthth.exe122⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-