Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45fb6d1618564ab60ecd1885d7691129.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
45fb6d1618564ab60ecd1885d7691129.exe
-
Size
86KB
-
MD5
45fb6d1618564ab60ecd1885d7691129
-
SHA1
924fe2a20095f71c1468a80b3c914cfcf7522284
-
SHA256
558d573492cd5f8ab83b9f1e46c467b4695f1d4d627a26eee6e84c3f7f9bd3b2
-
SHA512
b59bce56b100bbaf3d3d432e9d7e609485f1a1dc1d9e87114e8e270eb9f1036aab3112484e02890b1d144a82b3c1eda9e66bd84546ed96538d37c5442de54078
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkj:ymb3NkkiQ3mdBjF+3TU2iBRioSumWs
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/1652-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/500-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-512-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-601-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-661-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/500-771-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-787-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2736 9lflrll.exe 3064 bttthn.exe 3056 xxlflxx.exe 2608 7nbbhh.exe 2868 lxfffxf.exe 2148 tnbhhh.exe 2820 9flrfxl.exe 2456 btbhbb.exe 2580 9jdjv.exe 2200 frrlrll.exe 1204 rlxrrrx.exe 856 jjdpv.exe 2508 xlrxffl.exe 1664 hbhtnt.exe 2808 lxxrlll.exe 1124 3bhhnn.exe 500 frlfrxl.exe 2980 thtbnt.exe 1740 xlrrxrx.exe 2408 btbtht.exe 1432 fxxlrrf.exe 2272 dppvj.exe 1776 tnhnbh.exe 1596 9vjjp.exe 980 3lxlxxx.exe 2012 jdpvj.exe 2100 tnhnbh.exe 2320 vdpvd.exe 1168 bhbtbn.exe 2908 dppjd.exe 2920 thtnnn.exe 1580 jvdvd.exe 2088 3llxrxl.exe 2736 pdpvd.exe 2092 lflxfrx.exe 2676 1rxfxfr.exe 2692 tnhnhn.exe 2716 thtntt.exe 2720 ppjpd.exe 2628 xrfflrr.exe 2500 9jjpd.exe 2752 vjvvd.exe 1128 nbttbn.exe 1956 jdpdj.exe 2084 thttnn.exe 1144 ppjpp.exe 2788 3ntthb.exe 1656 5pjvp.exe 1084 tthbnt.exe 2644 dvjjp.exe 2180 1nhhnh.exe 1092 thbbhn.exe 2936 jdvvv.exe 2268 hhnbtt.exe 1984 ppvjv.exe 1268 nnhtbb.exe 2992 bbtntt.exe 1048 pvpdp.exe 1348 xlffrfl.exe 2660 pdjdv.exe 2028 xlrfrrl.exe 616 pjppj.exe 1216 llxlflx.exe 572 9tthtn.exe -
resource yara_rule behavioral1/memory/1652-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/500-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-511-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-512-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-520-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-528-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-601-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-600-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-644-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-659-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-661-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-668-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-683-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-741-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-763-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/500-771-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-779-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-787-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-865-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-880-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-895-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-903-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-939-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-947-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2736 1652 45fb6d1618564ab60ecd1885d7691129.exe 28 PID 1652 wrote to memory of 2736 1652 45fb6d1618564ab60ecd1885d7691129.exe 28 PID 1652 wrote to memory of 2736 1652 45fb6d1618564ab60ecd1885d7691129.exe 28 PID 1652 wrote to memory of 2736 1652 45fb6d1618564ab60ecd1885d7691129.exe 28 PID 2736 wrote to memory of 3064 2736 9lflrll.exe 29 PID 2736 wrote to memory of 3064 2736 9lflrll.exe 29 PID 2736 wrote to memory of 3064 2736 9lflrll.exe 29 PID 2736 wrote to memory of 3064 2736 9lflrll.exe 29 PID 3064 wrote to memory of 3056 3064 bttthn.exe 30 PID 3064 wrote to memory of 3056 3064 bttthn.exe 30 PID 3064 wrote to memory of 3056 3064 bttthn.exe 30 PID 3064 wrote to memory of 3056 3064 bttthn.exe 30 PID 3056 wrote to memory of 2608 3056 xxlflxx.exe 31 PID 3056 wrote to memory of 2608 3056 xxlflxx.exe 31 PID 3056 wrote to memory of 2608 3056 xxlflxx.exe 31 PID 3056 wrote to memory of 2608 3056 xxlflxx.exe 31 PID 2608 wrote to memory of 2868 2608 7nbbhh.exe 32 PID 2608 wrote to memory of 2868 2608 7nbbhh.exe 32 PID 2608 wrote to memory of 2868 2608 7nbbhh.exe 32 PID 2608 wrote to memory of 2868 2608 7nbbhh.exe 32 PID 2868 wrote to memory of 2148 2868 lxfffxf.exe 33 PID 2868 wrote to memory of 2148 2868 lxfffxf.exe 33 PID 2868 wrote to memory of 2148 2868 lxfffxf.exe 33 PID 2868 wrote to memory of 2148 2868 lxfffxf.exe 33 PID 2148 wrote to memory of 2820 2148 tnbhhh.exe 34 PID 2148 wrote to memory of 2820 2148 tnbhhh.exe 34 PID 2148 wrote to memory of 2820 2148 tnbhhh.exe 34 PID 2148 wrote to memory of 2820 2148 tnbhhh.exe 34 PID 2820 wrote to memory of 2456 2820 9flrfxl.exe 35 PID 2820 wrote to memory of 2456 2820 9flrfxl.exe 35 PID 2820 wrote to memory of 2456 2820 9flrfxl.exe 35 PID 2820 wrote to memory of 2456 2820 9flrfxl.exe 35 PID 2456 wrote to memory of 2580 2456 btbhbb.exe 36 PID 2456 wrote to memory of 2580 2456 btbhbb.exe 36 PID 2456 wrote to memory of 2580 2456 btbhbb.exe 36 PID 2456 wrote to memory of 2580 2456 btbhbb.exe 36 PID 2580 wrote to memory of 2200 2580 9jdjv.exe 37 PID 2580 wrote to memory of 2200 2580 9jdjv.exe 37 PID 2580 wrote to memory of 2200 2580 9jdjv.exe 37 PID 2580 wrote to memory of 2200 2580 9jdjv.exe 37 PID 2200 wrote to memory of 1204 2200 frrlrll.exe 38 PID 2200 wrote to memory of 1204 2200 frrlrll.exe 38 PID 2200 wrote to memory of 1204 2200 frrlrll.exe 38 PID 2200 wrote to memory of 1204 2200 frrlrll.exe 38 PID 1204 wrote to memory of 856 1204 rlxrrrx.exe 39 PID 1204 wrote to memory of 856 1204 rlxrrrx.exe 39 PID 1204 wrote to memory of 856 1204 rlxrrrx.exe 39 PID 1204 wrote to memory of 856 1204 rlxrrrx.exe 39 PID 856 wrote to memory of 2508 856 jjdpv.exe 40 PID 856 wrote to memory of 2508 856 jjdpv.exe 40 PID 856 wrote to memory of 2508 856 jjdpv.exe 40 PID 856 wrote to memory of 2508 856 jjdpv.exe 40 PID 2508 wrote to memory of 1664 2508 xlrxffl.exe 41 PID 2508 wrote to memory of 1664 2508 xlrxffl.exe 41 PID 2508 wrote to memory of 1664 2508 xlrxffl.exe 41 PID 2508 wrote to memory of 1664 2508 xlrxffl.exe 41 PID 1664 wrote to memory of 2808 1664 hbhtnt.exe 42 PID 1664 wrote to memory of 2808 1664 hbhtnt.exe 42 PID 1664 wrote to memory of 2808 1664 hbhtnt.exe 42 PID 1664 wrote to memory of 2808 1664 hbhtnt.exe 42 PID 2808 wrote to memory of 1124 2808 lxxrlll.exe 43 PID 2808 wrote to memory of 1124 2808 lxxrlll.exe 43 PID 2808 wrote to memory of 1124 2808 lxxrlll.exe 43 PID 2808 wrote to memory of 1124 2808 lxxrlll.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\45fb6d1618564ab60ecd1885d7691129.exe"C:\Users\Admin\AppData\Local\Temp\45fb6d1618564ab60ecd1885d7691129.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\9lflrll.exec:\9lflrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bttthn.exec:\bttthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xxlflxx.exec:\xxlflxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\7nbbhh.exec:\7nbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\lxfffxf.exec:\lxfffxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\tnbhhh.exec:\tnbhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\9flrfxl.exec:\9flrfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\btbhbb.exec:\btbhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\9jdjv.exec:\9jdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\frrlrll.exec:\frrlrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\jjdpv.exec:\jjdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\xlrxffl.exec:\xlrxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\hbhtnt.exec:\hbhtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\lxxrlll.exec:\lxxrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\3bhhnn.exec:\3bhhnn.exe17⤵
- Executes dropped EXE
PID:1124 -
\??\c:\frlfrxl.exec:\frlfrxl.exe18⤵
- Executes dropped EXE
PID:500 -
\??\c:\thtbnt.exec:\thtbnt.exe19⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xlrrxrx.exec:\xlrrxrx.exe20⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btbtht.exec:\btbtht.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\fxxlrrf.exec:\fxxlrrf.exe22⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dppvj.exec:\dppvj.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tnhnbh.exec:\tnhnbh.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9vjjp.exec:\9vjjp.exe25⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3lxlxxx.exec:\3lxlxxx.exe26⤵
- Executes dropped EXE
PID:980 -
\??\c:\jdpvj.exec:\jdpvj.exe27⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tnhnbh.exec:\tnhnbh.exe28⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vdpvd.exec:\vdpvd.exe29⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bhbtbn.exec:\bhbtbn.exe30⤵
- Executes dropped EXE
PID:1168 -
\??\c:\dppjd.exec:\dppjd.exe31⤵
- Executes dropped EXE
PID:2908 -
\??\c:\thtnnn.exec:\thtnnn.exe32⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jvdvd.exec:\jvdvd.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3llxrxl.exec:\3llxrxl.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pdpvd.exec:\pdpvd.exe35⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lflxfrx.exec:\lflxfrx.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1rxfxfr.exec:\1rxfxfr.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tnhnhn.exec:\tnhnhn.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\thtntt.exec:\thtntt.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ppjpd.exec:\ppjpd.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xrfflrr.exec:\xrfflrr.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9jjpd.exec:\9jjpd.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vjvvd.exec:\vjvvd.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nbttbn.exec:\nbttbn.exe44⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jdpdj.exec:\jdpdj.exe45⤵
- Executes dropped EXE
PID:1956 -
\??\c:\thttnn.exec:\thttnn.exe46⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ppjpp.exec:\ppjpp.exe47⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3ntthb.exec:\3ntthb.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5pjvp.exec:\5pjvp.exe49⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tthbnt.exec:\tthbnt.exe50⤵
- Executes dropped EXE
PID:1084 -
\??\c:\dvjjp.exec:\dvjjp.exe51⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1nhhnh.exec:\1nhhnh.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\thbbhn.exec:\thbbhn.exe53⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jdvvv.exec:\jdvvv.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhnbtt.exec:\hhnbtt.exe55⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ppvjv.exec:\ppvjv.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nnhtbb.exec:\nnhtbb.exe57⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bbtntt.exec:\bbtntt.exe58⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pvpdp.exec:\pvpdp.exe59⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xlffrfl.exec:\xlffrfl.exe60⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pdjdv.exec:\pdjdv.exe61⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xlrfrrl.exec:\xlrfrrl.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pjppj.exec:\pjppj.exe63⤵
- Executes dropped EXE
PID:616 -
\??\c:\llxlflx.exec:\llxlflx.exe64⤵
- Executes dropped EXE
PID:1216 -
\??\c:\9tthtn.exec:\9tthtn.exe65⤵
- Executes dropped EXE
PID:572 -
\??\c:\pjvvv.exec:\pjvvv.exe66⤵PID:2436
-
\??\c:\btthtt.exec:\btthtt.exe67⤵PID:2256
-
\??\c:\7pjpp.exec:\7pjpp.exe68⤵PID:2288
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe69⤵PID:896
-
\??\c:\5pjvv.exec:\5pjvv.exe70⤵PID:3020
-
\??\c:\9pppj.exec:\9pppj.exe71⤵PID:2216
-
\??\c:\fffxlrf.exec:\fffxlrf.exe72⤵PID:2920
-
\??\c:\jvvdp.exec:\jvvdp.exe73⤵PID:1712
-
\??\c:\rflllfx.exec:\rflllfx.exe74⤵PID:3032
-
\??\c:\3jvjj.exec:\3jvjj.exe75⤵PID:2552
-
\??\c:\lffflrx.exec:\lffflrx.exe76⤵PID:2588
-
\??\c:\nnhtnt.exec:\nnhtnt.exe77⤵PID:2676
-
\??\c:\rflflll.exec:\rflflll.exe78⤵PID:2668
-
\??\c:\djdjv.exec:\djdjv.exe79⤵PID:2768
-
\??\c:\rlfxfrl.exec:\rlfxfrl.exe80⤵PID:2452
-
\??\c:\1bbtht.exec:\1bbtht.exe81⤵PID:2596
-
\??\c:\vpppj.exec:\vpppj.exe82⤵PID:2532
-
\??\c:\ffrflrx.exec:\ffrflrx.exe83⤵PID:2960
-
\??\c:\3hbbhn.exec:\3hbbhn.exe84⤵PID:2636
-
\??\c:\jjvjj.exec:\jjvjj.exe85⤵PID:2432
-
\??\c:\5rrxrxl.exec:\5rrxrxl.exe86⤵PID:1928
-
\??\c:\nhbhbh.exec:\nhbhbh.exe87⤵PID:1940
-
\??\c:\llxflrr.exec:\llxflrr.exe88⤵PID:1832
-
\??\c:\5bnnbn.exec:\5bnnbn.exe89⤵PID:2376
-
\??\c:\jjjdp.exec:\jjjdp.exe90⤵PID:2800
-
\??\c:\rfxxflr.exec:\rfxxflr.exe91⤵PID:2548
-
\??\c:\9thnbt.exec:\9thnbt.exe92⤵PID:1120
-
\??\c:\vpvjv.exec:\vpvjv.exe93⤵PID:2180
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe94⤵PID:500
-
\??\c:\hbhntn.exec:\hbhntn.exe95⤵PID:2980
-
\??\c:\pppvv.exec:\pppvv.exe96⤵PID:2116
-
\??\c:\htthth.exec:\htthth.exe97⤵PID:1992
-
\??\c:\vpdjj.exec:\vpdjj.exe98⤵PID:2348
-
\??\c:\thhnhn.exec:\thhnhn.exe99⤵PID:1432
-
\??\c:\9pjpv.exec:\9pjpv.exe100⤵PID:2252
-
\??\c:\rxflllf.exec:\rxflllf.exe101⤵PID:1480
-
\??\c:\vddvd.exec:\vddvd.exe102⤵PID:2036
-
\??\c:\lfxlllx.exec:\lfxlllx.exe103⤵PID:1260
-
\??\c:\thtbhb.exec:\thtbhb.exe104⤵PID:1160
-
\??\c:\djpjj.exec:\djpjj.exe105⤵PID:2120
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe106⤵PID:904
-
\??\c:\jdpjj.exec:\jdpjj.exe107⤵PID:2848
-
\??\c:\lxlfffl.exec:\lxlfffl.exe108⤵PID:2096
-
\??\c:\pjvvd.exec:\pjvvd.exe109⤵PID:644
-
\??\c:\9xxfflr.exec:\9xxfflr.exe110⤵PID:2372
-
\??\c:\1nthtn.exec:\1nthtn.exe111⤵PID:2332
-
\??\c:\1jppv.exec:\1jppv.exe112⤵PID:2384
-
\??\c:\lfrxfff.exec:\lfrxfff.exe113⤵PID:3048
-
\??\c:\vpddj.exec:\vpddj.exe114⤵PID:2736
-
\??\c:\9lfrrlr.exec:\9lfrrlr.exe115⤵PID:2684
-
\??\c:\ntbtth.exec:\ntbtth.exe116⤵PID:2092
-
\??\c:\jppdd.exec:\jppdd.exe117⤵PID:2728
-
\??\c:\frxllll.exec:\frxllll.exe118⤵PID:2564
-
\??\c:\nnhtnn.exec:\nnhtnn.exe119⤵PID:1336
-
\??\c:\7dvpv.exec:\7dvpv.exe120⤵PID:2720
-
\??\c:\3bnttn.exec:\3bnttn.exe121⤵PID:2472
-
\??\c:\7dvdp.exec:\7dvdp.exe122⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-