Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe
-
Size
63KB
-
MD5
ae610220bf3e55e861668d718ea60f7f
-
SHA1
aa3a18aaa60a5f1ed6d4505dc76fe51f74fe478b
-
SHA256
e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38
-
SHA512
ff92e7e2f45c98fd357fda166d5ed3ff1bb5d2174b9d547e715607c7b20239f1c7381d26e01cbe9c6ede82c64da65f4d28365d837bef13cbf4dbef7a5bcf5bc7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh127:ymb3NkkiQ3mdBjFIFdJmA
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2236-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral1/memory/2236-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2908-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2432-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/872-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2356-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2104-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/760-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2144-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1596-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2664-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1256-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2860-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/776-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2280-237-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1536-245-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1688-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1956-281-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2908 ffrrxxf.exe 2432 lrxfllf.exe 2780 pjvdj.exe 872 ddvdp.exe 2356 rlffxxl.exe 2384 bntbhb.exe 2112 hhbthh.exe 2104 vppjd.exe 2668 9xffxfl.exe 2716 1fxlrxl.exe 2604 7btbtt.exe 760 hhtbhb.exe 2144 pjdjv.exe 1596 vvdjd.exe 2664 5lrrrxf.exe 1440 9lflrxx.exe 1256 rrrxrlx.exe 2860 bthbbh.exe 2024 tnnnnn.exe 2192 pvvdd.exe 776 frflrfr.exe 584 fxrfrfr.exe 1864 ttnhtt.exe 2280 bbhttt.exe 1536 pdppp.exe 1688 3vvpj.exe 2976 llfxxlx.exe 2292 bbtbhb.exe 1956 htthhb.exe 2788 9jvpd.exe 1696 3jdvd.exe 2540 dvpdp.exe 2436 3flrxfr.exe 2944 lrflrxr.exe 1636 tnnhhb.exe 2480 vdvdp.exe 2444 xfrlrlr.exe 2576 3vdjp.exe 2572 lxffxrf.exe 2356 jpvdv.exe 2384 vpddv.exe 2852 rlxrrrx.exe 2636 httbbb.exe 2684 btbthh.exe 1420 vjpjj.exe 1604 dddpv.exe 1620 9rfxllx.exe 1268 hbtbht.exe 548 nhntbb.exe 2144 jjvjv.exe 2880 9vjpj.exe 2884 1rlllrf.exe 1364 5rflffr.exe 2516 tthhbn.exe 1256 nnhhbt.exe 1740 3pdjv.exe 1136 btntht.exe 700 tnhnbn.exe 784 bhhnbh.exe 1700 vvvvp.exe 1408 rlxrflx.exe 1864 rrxlxfx.exe 336 tbhbtn.exe 1296 bbntbb.exe -
resource yara_rule behavioral1/memory/2236-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2908 2236 e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe 28 PID 2236 wrote to memory of 2908 2236 e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe 28 PID 2236 wrote to memory of 2908 2236 e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe 28 PID 2236 wrote to memory of 2908 2236 e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe 28 PID 2908 wrote to memory of 2432 2908 ffrrxxf.exe 29 PID 2908 wrote to memory of 2432 2908 ffrrxxf.exe 29 PID 2908 wrote to memory of 2432 2908 ffrrxxf.exe 29 PID 2908 wrote to memory of 2432 2908 ffrrxxf.exe 29 PID 2432 wrote to memory of 2780 2432 lrxfllf.exe 30 PID 2432 wrote to memory of 2780 2432 lrxfllf.exe 30 PID 2432 wrote to memory of 2780 2432 lrxfllf.exe 30 PID 2432 wrote to memory of 2780 2432 lrxfllf.exe 30 PID 2780 wrote to memory of 872 2780 pjvdj.exe 31 PID 2780 wrote to memory of 872 2780 pjvdj.exe 31 PID 2780 wrote to memory of 872 2780 pjvdj.exe 31 PID 2780 wrote to memory of 872 2780 pjvdj.exe 31 PID 872 wrote to memory of 2356 872 ddvdp.exe 32 PID 872 wrote to memory of 2356 872 ddvdp.exe 32 PID 872 wrote to memory of 2356 872 ddvdp.exe 32 PID 872 wrote to memory of 2356 872 ddvdp.exe 32 PID 2356 wrote to memory of 2384 2356 rlffxxl.exe 33 PID 2356 wrote to memory of 2384 2356 rlffxxl.exe 33 PID 2356 wrote to memory of 2384 2356 rlffxxl.exe 33 PID 2356 wrote to memory of 2384 2356 rlffxxl.exe 33 PID 2384 wrote to memory of 2112 2384 bntbhb.exe 34 PID 2384 wrote to memory of 2112 2384 bntbhb.exe 34 PID 2384 wrote to memory of 2112 2384 bntbhb.exe 34 PID 2384 wrote to memory of 2112 2384 bntbhb.exe 34 PID 2112 wrote to memory of 2104 2112 hhbthh.exe 35 PID 2112 wrote to memory of 2104 2112 hhbthh.exe 35 PID 2112 wrote to memory of 2104 2112 hhbthh.exe 35 PID 2112 wrote to memory of 2104 2112 hhbthh.exe 35 PID 2104 wrote to memory of 2668 2104 vppjd.exe 36 PID 2104 wrote to memory of 2668 2104 vppjd.exe 36 PID 2104 wrote to memory of 2668 2104 vppjd.exe 36 PID 2104 wrote to memory of 2668 2104 vppjd.exe 36 PID 2668 wrote to memory of 2716 2668 9xffxfl.exe 37 PID 2668 wrote to memory of 2716 2668 9xffxfl.exe 37 PID 2668 wrote to memory of 2716 2668 9xffxfl.exe 37 PID 2668 wrote to memory of 2716 2668 9xffxfl.exe 37 PID 2716 wrote to memory of 2604 2716 1fxlrxl.exe 38 PID 2716 wrote to memory of 2604 2716 1fxlrxl.exe 38 PID 2716 wrote to memory of 2604 2716 1fxlrxl.exe 38 PID 2716 wrote to memory of 2604 2716 1fxlrxl.exe 38 PID 2604 wrote to memory of 760 2604 7btbtt.exe 39 PID 2604 wrote to memory of 760 2604 7btbtt.exe 39 PID 2604 wrote to memory of 760 2604 7btbtt.exe 39 PID 2604 wrote to memory of 760 2604 7btbtt.exe 39 PID 760 wrote to memory of 2144 760 hhtbhb.exe 40 PID 760 wrote to memory of 2144 760 hhtbhb.exe 40 PID 760 wrote to memory of 2144 760 hhtbhb.exe 40 PID 760 wrote to memory of 2144 760 hhtbhb.exe 40 PID 2144 wrote to memory of 1596 2144 pjdjv.exe 41 PID 2144 wrote to memory of 1596 2144 pjdjv.exe 41 PID 2144 wrote to memory of 1596 2144 pjdjv.exe 41 PID 2144 wrote to memory of 1596 2144 pjdjv.exe 41 PID 1596 wrote to memory of 2664 1596 vvdjd.exe 42 PID 1596 wrote to memory of 2664 1596 vvdjd.exe 42 PID 1596 wrote to memory of 2664 1596 vvdjd.exe 42 PID 1596 wrote to memory of 2664 1596 vvdjd.exe 42 PID 2664 wrote to memory of 1440 2664 5lrrrxf.exe 43 PID 2664 wrote to memory of 1440 2664 5lrrrxf.exe 43 PID 2664 wrote to memory of 1440 2664 5lrrrxf.exe 43 PID 2664 wrote to memory of 1440 2664 5lrrrxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe"C:\Users\Admin\AppData\Local\Temp\e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\lrxfllf.exec:\lrxfllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\pjvdj.exec:\pjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ddvdp.exec:\ddvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\rlffxxl.exec:\rlffxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\bntbhb.exec:\bntbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\hhbthh.exec:\hhbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vppjd.exec:\vppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\9xffxfl.exec:\9xffxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1fxlrxl.exec:\1fxlrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\7btbtt.exec:\7btbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hhtbhb.exec:\hhtbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\pjdjv.exec:\pjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\vvdjd.exec:\vvdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\5lrrrxf.exec:\5lrrrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9lflrxx.exec:\9lflrxx.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rrrxrlx.exec:\rrrxrlx.exe18⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bthbbh.exec:\bthbbh.exe19⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tnnnnn.exec:\tnnnnn.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pvvdd.exec:\pvvdd.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\frflrfr.exec:\frflrfr.exe22⤵
- Executes dropped EXE
PID:776 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe23⤵
- Executes dropped EXE
PID:584 -
\??\c:\ttnhtt.exec:\ttnhtt.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bbhttt.exec:\bbhttt.exe25⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pdppp.exec:\pdppp.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\3vvpj.exec:\3vvpj.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\llfxxlx.exec:\llfxxlx.exe28⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bbtbhb.exec:\bbtbhb.exe29⤵
- Executes dropped EXE
PID:2292 -
\??\c:\htthhb.exec:\htthhb.exe30⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9jvpd.exec:\9jvpd.exe31⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3jdvd.exec:\3jdvd.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvpdp.exec:\dvpdp.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3flrxfr.exec:\3flrxfr.exe34⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lrflrxr.exec:\lrflrxr.exe35⤵
- Executes dropped EXE
PID:2944 -
\??\c:\tnnhhb.exec:\tnnhhb.exe36⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vdvdp.exec:\vdvdp.exe37⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xfrlrlr.exec:\xfrlrlr.exe38⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3vdjp.exec:\3vdjp.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lxffxrf.exec:\lxffxrf.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jpvdv.exec:\jpvdv.exe41⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vpddv.exec:\vpddv.exe42⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\httbbb.exec:\httbbb.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btbthh.exec:\btbthh.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vjpjj.exec:\vjpjj.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dddpv.exec:\dddpv.exe47⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9rfxllx.exec:\9rfxllx.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hbtbht.exec:\hbtbht.exe49⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nhntbb.exec:\nhntbb.exe50⤵
- Executes dropped EXE
PID:548 -
\??\c:\jjvjv.exec:\jjvjv.exe51⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9vjpj.exec:\9vjpj.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1rlllrf.exec:\1rlllrf.exe53⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5rflffr.exec:\5rflffr.exe54⤵
- Executes dropped EXE
PID:1364 -
\??\c:\tthhbn.exec:\tthhbn.exe55⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nnhhbt.exec:\nnhhbt.exe56⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3pdjv.exec:\3pdjv.exe57⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btntht.exec:\btntht.exe58⤵
- Executes dropped EXE
PID:1136 -
\??\c:\tnhnbn.exec:\tnhnbn.exe59⤵
- Executes dropped EXE
PID:700 -
\??\c:\bhhnbh.exec:\bhhnbh.exe60⤵
- Executes dropped EXE
PID:784 -
\??\c:\vvvvp.exec:\vvvvp.exe61⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rlxrflx.exec:\rlxrflx.exe62⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rrxlxfx.exec:\rrxlxfx.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tbhbtn.exec:\tbhbtn.exe64⤵
- Executes dropped EXE
PID:336 -
\??\c:\bbntbb.exec:\bbntbb.exe65⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ppjvp.exec:\ppjvp.exe66⤵PID:1668
-
\??\c:\xxflflx.exec:\xxflflx.exe67⤵PID:1628
-
\??\c:\llflxlf.exec:\llflxlf.exe68⤵PID:1476
-
\??\c:\tnhhth.exec:\tnhhth.exe69⤵PID:2240
-
\??\c:\tnnnbn.exec:\tnnnbn.exe70⤵PID:2764
-
\??\c:\djdvp.exec:\djdvp.exe71⤵PID:1956
-
\??\c:\ffxxrfr.exec:\ffxxrfr.exe72⤵PID:1432
-
\??\c:\xxxlxxf.exec:\xxxlxxf.exe73⤵PID:2088
-
\??\c:\7bnbhn.exec:\7bnbhn.exe74⤵PID:2248
-
\??\c:\btbbnb.exec:\btbbnb.exe75⤵PID:1204
-
\??\c:\3pdvd.exec:\3pdvd.exe76⤵PID:2956
-
\??\c:\3frrxxf.exec:\3frrxxf.exe77⤵PID:1632
-
\??\c:\1llxlrl.exec:\1llxlrl.exe78⤵PID:2772
-
\??\c:\bthtnb.exec:\bthtnb.exe79⤵PID:2480
-
\??\c:\bttntb.exec:\bttntb.exe80⤵PID:2364
-
\??\c:\vvdpp.exec:\vvdpp.exe81⤵PID:2580
-
\??\c:\xrffrrx.exec:\xrffrrx.exe82⤵PID:2352
-
\??\c:\1frfllr.exec:\1frfllr.exe83⤵PID:2544
-
\??\c:\1tbnbn.exec:\1tbnbn.exe84⤵PID:2848
-
\??\c:\tnnbtb.exec:\tnnbtb.exe85⤵PID:2428
-
\??\c:\ttnbhn.exec:\ttnbhn.exe86⤵PID:2104
-
\??\c:\jdvdp.exec:\jdvdp.exe87⤵PID:2728
-
\??\c:\dppjp.exec:\dppjp.exe88⤵PID:2740
-
\??\c:\xxfrfxf.exec:\xxfrfxf.exe89⤵PID:1568
-
\??\c:\fxxlrfr.exec:\fxxlrfr.exe90⤵PID:1624
-
\??\c:\nhbnth.exec:\nhbnth.exe91⤵PID:992
-
\??\c:\tnbhtb.exec:\tnbhtb.exe92⤵PID:320
-
\??\c:\ddpvv.exec:\ddpvv.exe93⤵PID:2620
-
\??\c:\1djvj.exec:\1djvj.exe94⤵PID:1576
-
\??\c:\ffrxffx.exec:\ffrxffx.exe95⤵PID:1752
-
\??\c:\fxrlfrl.exec:\fxrlfrl.exe96⤵PID:3024
-
\??\c:\hbthth.exec:\hbthth.exe97⤵PID:2368
-
\??\c:\vdvjd.exec:\vdvjd.exe98⤵PID:2184
-
\??\c:\pppjp.exec:\pppjp.exe99⤵PID:1520
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe100⤵PID:672
-
\??\c:\1xxlxlx.exec:\1xxlxlx.exe101⤵PID:3060
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe102⤵PID:932
-
\??\c:\3hbnhh.exec:\3hbnhh.exe103⤵PID:2868
-
\??\c:\nnbnnt.exec:\nnbnnt.exe104⤵PID:572
-
\??\c:\ddddj.exec:\ddddj.exe105⤵PID:2280
-
\??\c:\jppdj.exec:\jppdj.exe106⤵PID:1592
-
\??\c:\fxlfrfr.exec:\fxlfrfr.exe107⤵PID:3048
-
\??\c:\frflllr.exec:\frflllr.exe108⤵PID:2312
-
\??\c:\nbthhh.exec:\nbthhh.exe109⤵PID:2976
-
\??\c:\nnhntb.exec:\nnhntb.exe110⤵PID:1788
-
\??\c:\ddjpj.exec:\ddjpj.exe111⤵PID:2260
-
\??\c:\ddvvj.exec:\ddvvj.exe112⤵PID:2080
-
\??\c:\llrxffr.exec:\llrxffr.exe113⤵PID:2788
-
\??\c:\ffrxfxf.exec:\ffrxfxf.exe114⤵PID:2264
-
\??\c:\xxrxrfx.exec:\xxrxrfx.exe115⤵PID:2760
-
\??\c:\tnttbb.exec:\tnttbb.exe116⤵PID:2924
-
\??\c:\1nhtht.exec:\1nhtht.exe117⤵PID:1800
-
\??\c:\nnnbnt.exec:\nnnbnt.exe118⤵PID:2420
-
\??\c:\9pvdj.exec:\9pvdj.exe119⤵PID:2432
-
\??\c:\dvjpd.exec:\dvjpd.exe120⤵PID:2596
-
\??\c:\xfflrxl.exec:\xfflrxl.exe121⤵PID:2584
-
\??\c:\lfrxffl.exec:\lfrxffl.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-