Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 02:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe
-
Size
200KB
-
MD5
be02f15548abb60acdf00e452073f11b
-
SHA1
80e42d7ee48bfa5a58f4e69bc5a0236e7bd6cff0
-
SHA256
bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009
-
SHA512
e66c963d2ff8335ca3b74ececfa9338c540d364c48f62040d86caf7a7b3691a4a420e7149718b9c62c8e3354b7ff5fb7ed093e29959ccecb007d824a824645ee
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUVv1T6:n3C9BRIG0asYFm71m8+GdkB9Cv1W
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2004-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-88-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-4264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/2004-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1992-9-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1268-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2428-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1608-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/764-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2304-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1224-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1880-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1864-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1572-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1720-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3028-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1084-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2104-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/480-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1404-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2952-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-4264-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2004 7pvvv.exe 2492 jvddd.exe 2648 7frrflr.exe 1268 7tnnbt.exe 2572 vpdjp.exe 2428 rlllrlr.exe 2432 rfrlrrf.exe 2436 7vdvv.exe 1608 pjvdd.exe 1716 rlrxllr.exe 2632 tnbthb.exe 764 vpvpv.exe 2304 dpdvd.exe 1224 xlxrrxf.exe 1880 bnnnbt.exe 1864 dpvvd.exe 1572 jdjjp.exe 1720 fxxrxrf.exe 3028 nbnhnh.exe 1084 thhhhh.exe 2104 jddjp.exe 480 flrrxfr.exe 1404 httbbb.exe 1276 pdjjp.exe 940 jvjjj.exe 1988 xlrxxxx.exe 2976 hbhnhh.exe 612 3pjvd.exe 2940 xlxrxxf.exe 2952 rflflfl.exe 560 bntbhb.exe 1960 jdpjp.exe 2468 ddpjp.exe 2032 frxxxxx.exe 2588 nhtbbh.exe 2608 5bnnnt.exe 2584 jdvdj.exe 2392 pjvpv.exe 2640 1xxrxxl.exe 2520 lflrrlr.exe 2684 fxxfflf.exe 2428 1bnnbb.exe 2400 bthnbb.exe 2448 9pddv.exe 2276 vpvvv.exe 1608 xrfrfxf.exe 2568 5rflfff.exe 1504 nbttnn.exe 1564 3tbbht.exe 1588 vpvpv.exe 2304 dvddj.exe 768 jvjdd.exe 1820 3rrrxxf.exe 1932 ntbnbn.exe 1604 bbhhbt.exe 1580 dpvvd.exe 1948 pvpdv.exe 628 jvjpv.exe 1784 xrfrfff.exe 1928 rlllffr.exe 2104 hnnttn.exe 1568 bnbhnt.exe 564 5jvpv.exe 1684 xrlrllf.exe -
resource yara_rule behavioral1/memory/2004-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-4264-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2004 1992 bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe 28 PID 1992 wrote to memory of 2004 1992 bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe 28 PID 1992 wrote to memory of 2004 1992 bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe 28 PID 1992 wrote to memory of 2004 1992 bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe 28 PID 2004 wrote to memory of 2492 2004 7pvvv.exe 29 PID 2004 wrote to memory of 2492 2004 7pvvv.exe 29 PID 2004 wrote to memory of 2492 2004 7pvvv.exe 29 PID 2004 wrote to memory of 2492 2004 7pvvv.exe 29 PID 2492 wrote to memory of 2648 2492 jvddd.exe 30 PID 2492 wrote to memory of 2648 2492 jvddd.exe 30 PID 2492 wrote to memory of 2648 2492 jvddd.exe 30 PID 2492 wrote to memory of 2648 2492 jvddd.exe 30 PID 2648 wrote to memory of 1268 2648 7frrflr.exe 31 PID 2648 wrote to memory of 1268 2648 7frrflr.exe 31 PID 2648 wrote to memory of 1268 2648 7frrflr.exe 31 PID 2648 wrote to memory of 1268 2648 7frrflr.exe 31 PID 1268 wrote to memory of 2572 1268 7tnnbt.exe 32 PID 1268 wrote to memory of 2572 1268 7tnnbt.exe 32 PID 1268 wrote to memory of 2572 1268 7tnnbt.exe 32 PID 1268 wrote to memory of 2572 1268 7tnnbt.exe 32 PID 2572 wrote to memory of 2428 2572 vpdjp.exe 33 PID 2572 wrote to memory of 2428 2572 vpdjp.exe 33 PID 2572 wrote to memory of 2428 2572 vpdjp.exe 33 PID 2572 wrote to memory of 2428 2572 vpdjp.exe 33 PID 2428 wrote to memory of 2432 2428 rlllrlr.exe 34 PID 2428 wrote to memory of 2432 2428 rlllrlr.exe 34 PID 2428 wrote to memory of 2432 2428 rlllrlr.exe 34 PID 2428 wrote to memory of 2432 2428 rlllrlr.exe 34 PID 2432 wrote to memory of 2436 2432 rfrlrrf.exe 35 PID 2432 wrote to memory of 2436 2432 rfrlrrf.exe 35 PID 2432 wrote to memory of 2436 2432 rfrlrrf.exe 35 PID 2432 wrote to memory of 2436 2432 rfrlrrf.exe 35 PID 2436 wrote to memory of 1608 2436 7vdvv.exe 36 PID 2436 wrote to memory of 1608 2436 7vdvv.exe 36 PID 2436 wrote to memory of 1608 2436 7vdvv.exe 36 PID 2436 wrote to memory of 1608 2436 7vdvv.exe 36 PID 1608 wrote to memory of 1716 1608 pjvdd.exe 37 PID 1608 wrote to memory of 1716 1608 pjvdd.exe 37 PID 1608 wrote to memory of 1716 1608 pjvdd.exe 37 PID 1608 wrote to memory of 1716 1608 pjvdd.exe 37 PID 1716 wrote to memory of 2632 1716 rlrxllr.exe 38 PID 1716 wrote to memory of 2632 1716 rlrxllr.exe 38 PID 1716 wrote to memory of 2632 1716 rlrxllr.exe 38 PID 1716 wrote to memory of 2632 1716 rlrxllr.exe 38 PID 2632 wrote to memory of 764 2632 tnbthb.exe 39 PID 2632 wrote to memory of 764 2632 tnbthb.exe 39 PID 2632 wrote to memory of 764 2632 tnbthb.exe 39 PID 2632 wrote to memory of 764 2632 tnbthb.exe 39 PID 764 wrote to memory of 2304 764 vpvpv.exe 40 PID 764 wrote to memory of 2304 764 vpvpv.exe 40 PID 764 wrote to memory of 2304 764 vpvpv.exe 40 PID 764 wrote to memory of 2304 764 vpvpv.exe 40 PID 2304 wrote to memory of 1224 2304 dpdvd.exe 41 PID 2304 wrote to memory of 1224 2304 dpdvd.exe 41 PID 2304 wrote to memory of 1224 2304 dpdvd.exe 41 PID 2304 wrote to memory of 1224 2304 dpdvd.exe 41 PID 1224 wrote to memory of 1880 1224 xlxrrxf.exe 42 PID 1224 wrote to memory of 1880 1224 xlxrrxf.exe 42 PID 1224 wrote to memory of 1880 1224 xlxrrxf.exe 42 PID 1224 wrote to memory of 1880 1224 xlxrrxf.exe 42 PID 1880 wrote to memory of 1864 1880 bnnnbt.exe 43 PID 1880 wrote to memory of 1864 1880 bnnnbt.exe 43 PID 1880 wrote to memory of 1864 1880 bnnnbt.exe 43 PID 1880 wrote to memory of 1864 1880 bnnnbt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe"C:\Users\Admin\AppData\Local\Temp\bbfbde3e0242c6da4dd0a6cf28fb9cd6f27f3bfb0f6fd911dc5857518f635009.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\7pvvv.exec:\7pvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jvddd.exec:\jvddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7frrflr.exec:\7frrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\7tnnbt.exec:\7tnnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\vpdjp.exec:\vpdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rlllrlr.exec:\rlllrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rfrlrrf.exec:\rfrlrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\7vdvv.exec:\7vdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\pjvdd.exec:\pjvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\rlrxllr.exec:\rlrxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\tnbthb.exec:\tnbthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vpvpv.exec:\vpvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\dpdvd.exec:\dpdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xlxrrxf.exec:\xlxrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\bnnnbt.exec:\bnnnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\dpvvd.exec:\dpvvd.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jdjjp.exec:\jdjjp.exe18⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxxrxrf.exec:\fxxrxrf.exe19⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nbnhnh.exec:\nbnhnh.exe20⤵
- Executes dropped EXE
PID:3028 -
\??\c:\thhhhh.exec:\thhhhh.exe21⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jddjp.exec:\jddjp.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\flrrxfr.exec:\flrrxfr.exe23⤵
- Executes dropped EXE
PID:480 -
\??\c:\httbbb.exec:\httbbb.exe24⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pdjjp.exec:\pdjjp.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jvjjj.exec:\jvjjj.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe27⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hbhnhh.exec:\hbhnhh.exe28⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3pjvd.exec:\3pjvd.exe29⤵
- Executes dropped EXE
PID:612 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe30⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rflflfl.exec:\rflflfl.exe31⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bntbhb.exec:\bntbhb.exe32⤵
- Executes dropped EXE
PID:560 -
\??\c:\jdpjp.exec:\jdpjp.exe33⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ddpjp.exec:\ddpjp.exe34⤵
- Executes dropped EXE
PID:2468 -
\??\c:\frxxxxx.exec:\frxxxxx.exe35⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhtbbh.exec:\nhtbbh.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\5bnnnt.exec:\5bnnnt.exe37⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jdvdj.exec:\jdvdj.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pjvpv.exec:\pjvpv.exe39⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1xxrxxl.exec:\1xxrxxl.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lflrrlr.exec:\lflrrlr.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fxxfflf.exec:\fxxfflf.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1bnnbb.exec:\1bnnbb.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bthnbb.exec:\bthnbb.exe44⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9pddv.exec:\9pddv.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpvvv.exec:\vpvvv.exe46⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe47⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5rflfff.exec:\5rflfff.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nbttnn.exec:\nbttnn.exe49⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3tbbht.exec:\3tbbht.exe50⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vpvpv.exec:\vpvpv.exe51⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvddj.exec:\dvddj.exe52⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jvjdd.exec:\jvjdd.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\3rrrxxf.exec:\3rrrxxf.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ntbnbn.exec:\ntbnbn.exe55⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bbhhbt.exec:\bbhhbt.exe56⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dpvvd.exec:\dpvvd.exe57⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pvpdv.exec:\pvpdv.exe58⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jvjpv.exec:\jvjpv.exe59⤵
- Executes dropped EXE
PID:628 -
\??\c:\xrfrfff.exec:\xrfrfff.exe60⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rlllffr.exec:\rlllffr.exe61⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hnnttn.exec:\hnnttn.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bnbhnt.exec:\bnbhnt.exe63⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5jvpv.exec:\5jvpv.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\xrlrllf.exec:\xrlrllf.exe65⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7rxrxrx.exec:\7rxrxrx.exe66⤵PID:2780
-
\??\c:\tnhhnh.exec:\tnhhnh.exe67⤵PID:940
-
\??\c:\nnnhht.exec:\nnnhht.exe68⤵PID:1676
-
\??\c:\dvjjv.exec:\dvjjv.exe69⤵PID:664
-
\??\c:\pdjdp.exec:\pdjdp.exe70⤵PID:888
-
\??\c:\rxxllxr.exec:\rxxllxr.exe71⤵PID:2260
-
\??\c:\xrfrlfx.exec:\xrfrlfx.exe72⤵PID:2948
-
\??\c:\nbnthn.exec:\nbnthn.exe73⤵PID:2952
-
\??\c:\nhhbnn.exec:\nhhbnn.exe74⤵PID:900
-
\??\c:\jvvpj.exec:\jvvpj.exe75⤵PID:2028
-
\??\c:\pdjpd.exec:\pdjpd.exe76⤵PID:3020
-
\??\c:\9flffxx.exec:\9flffxx.exe77⤵PID:2528
-
\??\c:\hbnhnn.exec:\hbnhnn.exe78⤵PID:2644
-
\??\c:\bnnnnn.exec:\bnnnnn.exe79⤵PID:2968
-
\??\c:\jdjvv.exec:\jdjvv.exe80⤵PID:2516
-
\??\c:\pdjjd.exec:\pdjjd.exe81⤵PID:2420
-
\??\c:\7rxrrlr.exec:\7rxrrlr.exe82⤵PID:2844
-
\??\c:\nbbhnh.exec:\nbbhnh.exe83⤵PID:2628
-
\??\c:\hbnnbt.exec:\hbnnbt.exe84⤵PID:2164
-
\??\c:\vvvvd.exec:\vvvvd.exe85⤵PID:2504
-
\??\c:\7djjd.exec:\7djjd.exe86⤵PID:2800
-
\??\c:\rflxfxx.exec:\rflxfxx.exe87⤵PID:2668
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe88⤵PID:876
-
\??\c:\1nbhnt.exec:\1nbhnt.exe89⤵PID:1360
-
\??\c:\9ttbbt.exec:\9ttbbt.exe90⤵PID:2308
-
\??\c:\7vjpv.exec:\7vjpv.exe91⤵PID:2192
-
\??\c:\1ppvj.exec:\1ppvj.exe92⤵PID:240
-
\??\c:\llllfrf.exec:\llllfrf.exe93⤵PID:2188
-
\??\c:\rrfxlrf.exec:\rrfxlrf.exe94⤵PID:1624
-
\??\c:\hbtbhn.exec:\hbtbhn.exe95⤵PID:1660
-
\??\c:\hbnhnb.exec:\hbnhnb.exe96⤵PID:2316
-
\??\c:\pdjjd.exec:\pdjjd.exe97⤵PID:1652
-
\??\c:\frrfxfl.exec:\frrfxfl.exe98⤵PID:2944
-
\??\c:\5frlrxf.exec:\5frlrxf.exe99⤵PID:1444
-
\??\c:\hbtbht.exec:\hbtbht.exe100⤵PID:2204
-
\??\c:\dpjjj.exec:\dpjjj.exe101⤵PID:2480
-
\??\c:\9dvdj.exec:\9dvdj.exe102⤵PID:1084
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe103⤵PID:772
-
\??\c:\xrlfrxr.exec:\xrlfrxr.exe104⤵PID:688
-
\??\c:\1nhbhn.exec:\1nhbhn.exe105⤵PID:576
-
\??\c:\9tttbb.exec:\9tttbb.exe106⤵PID:1568
-
\??\c:\vpvvv.exec:\vpvvv.exe107⤵PID:1252
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe108⤵PID:1480
-
\??\c:\rlxflfl.exec:\rlxflfl.exe109⤵PID:1540
-
\??\c:\tnbtnn.exec:\tnbtnn.exe110⤵PID:1812
-
\??\c:\5hbbbh.exec:\5hbbbh.exe111⤵PID:2924
-
\??\c:\vvjpv.exec:\vvjpv.exe112⤵PID:612
-
\??\c:\1xllffl.exec:\1xllffl.exe113⤵PID:2992
-
\??\c:\flllrlr.exec:\flllrlr.exe114⤵PID:984
-
\??\c:\nbhbht.exec:\nbhbht.exe115⤵PID:608
-
\??\c:\nbhhbb.exec:\nbhhbb.exe116⤵PID:2464
-
\??\c:\dvddp.exec:\dvddp.exe117⤵PID:2868
-
\??\c:\7dvpj.exec:\7dvpj.exe118⤵PID:3064
-
\??\c:\xlllxrr.exec:\xlllxrr.exe119⤵PID:2532
-
\??\c:\9lxxfff.exec:\9lxxfff.exe120⤵PID:1496
-
\??\c:\5tbbnt.exec:\5tbbnt.exe121⤵PID:2492
-
\??\c:\hbhhbh.exec:\hbhhbh.exe122⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-