Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 10:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe
-
Size
72KB
-
MD5
31aadc5e194f80cb08e2568c3b220fae
-
SHA1
9b737a1b550f81673592e2780f29056613cf1373
-
SHA256
f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba
-
SHA512
ae91008c330203083a611b74a42c49eacf9f48a561cb642c4870e3cf353b9ffdf45f8d73d400a343c750542be2aa7be5d4b1ba4729ca016a84221a03353226c8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPh:ymb3NkkiQ3mdBjFIfvTfCD+HlQp
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3024-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1440-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1844-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1460-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1268-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2208-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/808-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2260-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2248-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2960-270-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
7pdjv.exerrxxllr.exeffrxffx.exentnhnh.exepjvdv.exevjvvj.exelxlxfxr.exehbntbh.exe3jvdj.exe7vpvd.exexxrxlrf.exerlrxfxx.exe1nbhhn.exetbbttn.exeddjpv.exevpjjv.exe9rllllx.exelfllllr.exe5tntbh.exebbnbnt.exevpdpv.exexrxlxxl.exe9rlllrx.exebtnbnt.exenthnht.exepjddp.exe9xrrxfr.exe7fxxxlr.exe7bhbtb.exetttnnb.exe9jdjj.exedvjjd.exelfrxflr.exenhntbb.exehbbbbb.exejdppv.exe1ppdp.exexrffffr.exe3rrfrrl.exenhntbt.exebtbhnh.exevpppp.exe7jjpp.exexxllflx.exe5jjvd.exevvpvv.exerlxxlrx.exerrxfrxl.exe1rfrrrr.exebbhbht.exenhttnh.exepdjjj.exe1rxrxff.exe5lxfxxf.exetntbhb.exe5htbbh.exe5vdvd.exe9fxrffr.exerlrxfff.exenbhhhn.exehhtthb.exejdppd.exejdjjp.exelrxllxr.exepid process 2708 7pdjv.exe 3024 rrxxllr.exe 2596 ffrxffx.exe 2700 ntnhnh.exe 2548 pjvdv.exe 2684 vjvvj.exe 2412 lxlxfxr.exe 2444 hbntbh.exe 2120 3jvdj.exe 2660 7vpvd.exe 2720 xxrxlrf.exe 1440 rlrxfxx.exe 1844 1nbhhn.exe 1460 tbbttn.exe 1268 ddjpv.exe 2368 vpjjv.exe 2796 9rllllx.exe 2208 lfllllr.exe 2940 5tntbh.exe 2616 bbnbnt.exe 1732 vpdpv.exe 808 xrxlxxl.exe 2844 9rlllrx.exe 2260 btnbnt.exe 2076 nthnht.exe 1292 pjddp.exe 2248 9xrrxfr.exe 2960 7fxxxlr.exe 1640 7bhbtb.exe 2600 tttnnb.exe 900 9jdjj.exe 2064 dvjjd.exe 1724 lfrxflr.exe 1952 nhntbb.exe 2332 hbbbbb.exe 2580 jdppv.exe 2596 1ppdp.exe 2576 xrffffr.exe 2816 3rrfrrl.exe 2284 nhntbt.exe 2768 btbhnh.exe 2468 vpppp.exe 1984 7jjpp.exe 2460 xxllflx.exe 2644 5jjvd.exe 2724 vvpvv.exe 2652 rlxxlrx.exe 1504 rrxfrxl.exe 340 1rfrrrr.exe 1552 bbhbht.exe 1684 nhttnh.exe 1460 pdjjj.exe 2304 1rxrxff.exe 1108 5lxfxxf.exe 2796 tntbhb.exe 2140 5htbbh.exe 1932 5vdvd.exe 2876 9fxrffr.exe 1828 rlrxfff.exe 1644 nbhhhn.exe 384 hhtthb.exe 2756 jdppd.exe 2364 jdjjp.exe 2260 lrxllxr.exe -
Processes:
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-270-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe7pdjv.exerrxxllr.exeffrxffx.exentnhnh.exepjvdv.exevjvvj.exelxlxfxr.exehbntbh.exe3jvdj.exe7vpvd.exexxrxlrf.exerlrxfxx.exe1nbhhn.exetbbttn.exeddjpv.exedescription pid process target process PID 1924 wrote to memory of 2708 1924 f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe 7pdjv.exe PID 1924 wrote to memory of 2708 1924 f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe 7pdjv.exe PID 1924 wrote to memory of 2708 1924 f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe 7pdjv.exe PID 1924 wrote to memory of 2708 1924 f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe 7pdjv.exe PID 2708 wrote to memory of 3024 2708 7pdjv.exe rrxxllr.exe PID 2708 wrote to memory of 3024 2708 7pdjv.exe rrxxllr.exe PID 2708 wrote to memory of 3024 2708 7pdjv.exe rrxxllr.exe PID 2708 wrote to memory of 3024 2708 7pdjv.exe rrxxllr.exe PID 3024 wrote to memory of 2596 3024 rrxxllr.exe ffrxffx.exe PID 3024 wrote to memory of 2596 3024 rrxxllr.exe ffrxffx.exe PID 3024 wrote to memory of 2596 3024 rrxxllr.exe ffrxffx.exe PID 3024 wrote to memory of 2596 3024 rrxxllr.exe ffrxffx.exe PID 2596 wrote to memory of 2700 2596 ffrxffx.exe ntnhnh.exe PID 2596 wrote to memory of 2700 2596 ffrxffx.exe ntnhnh.exe PID 2596 wrote to memory of 2700 2596 ffrxffx.exe ntnhnh.exe PID 2596 wrote to memory of 2700 2596 ffrxffx.exe ntnhnh.exe PID 2700 wrote to memory of 2548 2700 ntnhnh.exe pjvdv.exe PID 2700 wrote to memory of 2548 2700 ntnhnh.exe pjvdv.exe PID 2700 wrote to memory of 2548 2700 ntnhnh.exe pjvdv.exe PID 2700 wrote to memory of 2548 2700 ntnhnh.exe pjvdv.exe PID 2548 wrote to memory of 2684 2548 pjvdv.exe vjvvj.exe PID 2548 wrote to memory of 2684 2548 pjvdv.exe vjvvj.exe PID 2548 wrote to memory of 2684 2548 pjvdv.exe vjvvj.exe PID 2548 wrote to memory of 2684 2548 pjvdv.exe vjvvj.exe PID 2684 wrote to memory of 2412 2684 vjvvj.exe lxlxfxr.exe PID 2684 wrote to memory of 2412 2684 vjvvj.exe lxlxfxr.exe PID 2684 wrote to memory of 2412 2684 vjvvj.exe lxlxfxr.exe PID 2684 wrote to memory of 2412 2684 vjvvj.exe lxlxfxr.exe PID 2412 wrote to memory of 2444 2412 lxlxfxr.exe hbntbh.exe PID 2412 wrote to memory of 2444 2412 lxlxfxr.exe hbntbh.exe PID 2412 wrote to memory of 2444 2412 lxlxfxr.exe hbntbh.exe PID 2412 wrote to memory of 2444 2412 lxlxfxr.exe hbntbh.exe PID 2444 wrote to memory of 2120 2444 hbntbh.exe 3jvdj.exe PID 2444 wrote to memory of 2120 2444 hbntbh.exe 3jvdj.exe PID 2444 wrote to memory of 2120 2444 hbntbh.exe 3jvdj.exe PID 2444 wrote to memory of 2120 2444 hbntbh.exe 3jvdj.exe PID 2120 wrote to memory of 2660 2120 3jvdj.exe 7vpvd.exe PID 2120 wrote to memory of 2660 2120 3jvdj.exe 7vpvd.exe PID 2120 wrote to memory of 2660 2120 3jvdj.exe 7vpvd.exe PID 2120 wrote to memory of 2660 2120 3jvdj.exe 7vpvd.exe PID 2660 wrote to memory of 2720 2660 7vpvd.exe xxrxlrf.exe PID 2660 wrote to memory of 2720 2660 7vpvd.exe xxrxlrf.exe PID 2660 wrote to memory of 2720 2660 7vpvd.exe xxrxlrf.exe PID 2660 wrote to memory of 2720 2660 7vpvd.exe xxrxlrf.exe PID 2720 wrote to memory of 1440 2720 xxrxlrf.exe rlrxfxx.exe PID 2720 wrote to memory of 1440 2720 xxrxlrf.exe rlrxfxx.exe PID 2720 wrote to memory of 1440 2720 xxrxlrf.exe rlrxfxx.exe PID 2720 wrote to memory of 1440 2720 xxrxlrf.exe rlrxfxx.exe PID 1440 wrote to memory of 1844 1440 rlrxfxx.exe 1nbhhn.exe PID 1440 wrote to memory of 1844 1440 rlrxfxx.exe 1nbhhn.exe PID 1440 wrote to memory of 1844 1440 rlrxfxx.exe 1nbhhn.exe PID 1440 wrote to memory of 1844 1440 rlrxfxx.exe 1nbhhn.exe PID 1844 wrote to memory of 1460 1844 1nbhhn.exe tbbttn.exe PID 1844 wrote to memory of 1460 1844 1nbhhn.exe tbbttn.exe PID 1844 wrote to memory of 1460 1844 1nbhhn.exe tbbttn.exe PID 1844 wrote to memory of 1460 1844 1nbhhn.exe tbbttn.exe PID 1460 wrote to memory of 1268 1460 tbbttn.exe ddjpv.exe PID 1460 wrote to memory of 1268 1460 tbbttn.exe ddjpv.exe PID 1460 wrote to memory of 1268 1460 tbbttn.exe ddjpv.exe PID 1460 wrote to memory of 1268 1460 tbbttn.exe ddjpv.exe PID 1268 wrote to memory of 2368 1268 ddjpv.exe vpjjv.exe PID 1268 wrote to memory of 2368 1268 ddjpv.exe vpjjv.exe PID 1268 wrote to memory of 2368 1268 ddjpv.exe vpjjv.exe PID 1268 wrote to memory of 2368 1268 ddjpv.exe vpjjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe"C:\Users\Admin\AppData\Local\Temp\f5533b2e98731f515e3d389f23da91cf38c799a83103e351b3439bea93055aba.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\7pdjv.exec:\7pdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rrxxllr.exec:\rrxxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\ffrxffx.exec:\ffrxffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ntnhnh.exec:\ntnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pjvdv.exec:\pjvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vjvvj.exec:\vjvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lxlxfxr.exec:\lxlxfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\hbntbh.exec:\hbntbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\3jvdj.exec:\3jvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\7vpvd.exec:\7vpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rlrxfxx.exec:\rlrxfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\1nbhhn.exec:\1nbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\tbbttn.exec:\tbbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\ddjpv.exec:\ddjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\vpjjv.exec:\vpjjv.exe17⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9rllllx.exec:\9rllllx.exe18⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lfllllr.exec:\lfllllr.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5tntbh.exec:\5tntbh.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bbnbnt.exec:\bbnbnt.exe21⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpdpv.exec:\vpdpv.exe22⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xrxlxxl.exec:\xrxlxxl.exe23⤵
- Executes dropped EXE
PID:808 -
\??\c:\9rlllrx.exec:\9rlllrx.exe24⤵
- Executes dropped EXE
PID:2844 -
\??\c:\btnbnt.exec:\btnbnt.exe25⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nthnht.exec:\nthnht.exe26⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pjddp.exec:\pjddp.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\9xrrxfr.exec:\9xrrxfr.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7fxxxlr.exec:\7fxxxlr.exe29⤵
- Executes dropped EXE
PID:2960 -
\??\c:\7bhbtb.exec:\7bhbtb.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tttnnb.exec:\tttnnb.exe31⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9jdjj.exec:\9jdjj.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\dvjjd.exec:\dvjjd.exe33⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lfrxflr.exec:\lfrxflr.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nhntbb.exec:\nhntbb.exe35⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbbbbb.exec:\hbbbbb.exe36⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdppv.exec:\jdppv.exe37⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1ppdp.exec:\1ppdp.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xrffffr.exec:\xrffffr.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3rrfrrl.exec:\3rrfrrl.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nhntbt.exec:\nhntbt.exe41⤵
- Executes dropped EXE
PID:2284 -
\??\c:\btbhnh.exec:\btbhnh.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpppp.exec:\vpppp.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\7jjpp.exec:\7jjpp.exe44⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xxllflx.exec:\xxllflx.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5jjvd.exec:\5jjvd.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vvpvv.exec:\vvpvv.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe48⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rrxfrxl.exec:\rrxfrxl.exe49⤵
- Executes dropped EXE
PID:1504 -
\??\c:\1rfrrrr.exec:\1rfrrrr.exe50⤵
- Executes dropped EXE
PID:340 -
\??\c:\bbhbht.exec:\bbhbht.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nhttnh.exec:\nhttnh.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pdjjj.exec:\pdjjj.exe53⤵
- Executes dropped EXE
PID:1460 -
\??\c:\1rxrxff.exec:\1rxrxff.exe54⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5lxfxxf.exec:\5lxfxxf.exe55⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tntbhb.exec:\tntbhb.exe56⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5htbbh.exec:\5htbbh.exe57⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5vdvd.exec:\5vdvd.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\9fxrffr.exec:\9fxrffr.exe59⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rlrxfff.exec:\rlrxfff.exe60⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nbhhhn.exec:\nbhhhn.exe61⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhtthb.exec:\hhtthb.exe62⤵
- Executes dropped EXE
PID:384 -
\??\c:\jdppd.exec:\jdppd.exe63⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jdjjp.exec:\jdjjp.exe64⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lrxllxr.exec:\lrxllxr.exe65⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bthhbt.exec:\bthhbt.exe66⤵PID:2300
-
\??\c:\tnttbb.exec:\tnttbb.exe67⤵PID:1668
-
\??\c:\pdpjj.exec:\pdpjj.exe68⤵PID:2096
-
\??\c:\jdddj.exec:\jdddj.exe69⤵PID:2252
-
\??\c:\llxxllx.exec:\llxxllx.exe70⤵PID:2960
-
\??\c:\llfxlrl.exec:\llfxlrl.exe71⤵PID:1624
-
\??\c:\nhtbhh.exec:\nhtbhh.exe72⤵PID:1908
-
\??\c:\nhnthh.exec:\nhnthh.exe73⤵PID:2852
-
\??\c:\pppvj.exec:\pppvj.exe74⤵PID:1924
-
\??\c:\9jvpv.exec:\9jvpv.exe75⤵PID:1648
-
\??\c:\lfrflff.exec:\lfrflff.exe76⤵PID:1724
-
\??\c:\7xlffff.exec:\7xlffff.exe77⤵PID:2060
-
\??\c:\5ntntt.exec:\5ntntt.exe78⤵PID:3024
-
\??\c:\tnhbnh.exec:\tnhbnh.exe79⤵PID:3000
-
\??\c:\jdddd.exec:\jdddd.exe80⤵PID:2716
-
\??\c:\1vjjv.exec:\1vjjv.exe81⤵PID:2416
-
\??\c:\rrrrrfl.exec:\rrrrrfl.exe82⤵PID:2548
-
\??\c:\nthnhb.exec:\nthnhb.exe83⤵PID:2524
-
\??\c:\nbnnnt.exec:\nbnnnt.exe84⤵PID:2904
-
\??\c:\pvjdj.exec:\pvjdj.exe85⤵PID:2396
-
\??\c:\dpjjj.exec:\dpjjj.exe86⤵PID:2908
-
\??\c:\9lffllr.exec:\9lffllr.exe87⤵PID:2120
-
\??\c:\5bhnbb.exec:\5bhnbb.exe88⤵PID:1884
-
\??\c:\nhhntt.exec:\nhhntt.exe89⤵PID:2792
-
\??\c:\jvddj.exec:\jvddj.exe90⤵PID:2720
-
\??\c:\7djvv.exec:\7djvv.exe91⤵PID:1784
-
\??\c:\ffrxfrr.exec:\ffrxfrr.exe92⤵PID:2276
-
\??\c:\xlxfflr.exec:\xlxfflr.exe93⤵PID:856
-
\??\c:\nbhttt.exec:\nbhttt.exe94⤵PID:2272
-
\??\c:\hbnnnt.exec:\hbnnnt.exe95⤵PID:2028
-
\??\c:\7vpjj.exec:\7vpjj.exe96⤵PID:1592
-
\??\c:\vjvdj.exec:\vjvdj.exe97⤵PID:1340
-
\??\c:\vjvvd.exec:\vjvvd.exe98⤵PID:2068
-
\??\c:\3xffxff.exec:\3xffxff.exe99⤵PID:1612
-
\??\c:\lxlffxf.exec:\lxlffxf.exe100⤵PID:2244
-
\??\c:\flxxrll.exec:\flxxrll.exe101⤵PID:592
-
\??\c:\5bhnnn.exec:\5bhnnn.exe102⤵PID:2616
-
\??\c:\1jvjp.exec:\1jvjp.exe103⤵PID:1388
-
\??\c:\frfxffl.exec:\frfxffl.exe104⤵PID:1772
-
\??\c:\9xrrfxf.exec:\9xrrfxf.exe105⤵PID:920
-
\??\c:\tnthhn.exec:\tnthhn.exe106⤵PID:3020
-
\??\c:\1bhbht.exec:\1bhbht.exe107⤵PID:2076
-
\??\c:\dpddj.exec:\dpddj.exe108⤵PID:1596
-
\??\c:\3pdvv.exec:\3pdvv.exe109⤵PID:2248
-
\??\c:\frfxxxx.exec:\frfxxxx.exe110⤵PID:2360
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe111⤵PID:2832
-
\??\c:\fxflllr.exec:\fxflllr.exe112⤵PID:2204
-
\??\c:\thhhhb.exec:\thhhhb.exe113⤵PID:2052
-
\??\c:\bthntb.exec:\bthntb.exe114⤵PID:888
-
\??\c:\5djdd.exec:\5djdd.exe115⤵PID:764
-
\??\c:\jvvpd.exec:\jvvpd.exe116⤵PID:996
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe117⤵PID:2496
-
\??\c:\7xxlfff.exec:\7xxlfff.exe118⤵PID:1524
-
\??\c:\5hnntn.exec:\5hnntn.exe119⤵PID:2544
-
\??\c:\vjvvv.exec:\vjvvv.exe120⤵PID:2580
-
\??\c:\dpvdv.exec:\dpvdv.exe121⤵PID:2492
-
\??\c:\dvjpv.exec:\dvjpv.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-