Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe
-
Size
68KB
-
MD5
0d9ca127eb6fe79f5223884a92fc9590
-
SHA1
49d96a768fea752f3bfa0368ea7e464b05875aa0
-
SHA256
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc
-
SHA512
c142970881f38b646c5d8161d2658d0e1a1342432b5aea4d26dbb4373f42ccb45592d0fe168625a8996402bcc35606138ba91ee9a0efab91e81547d9e61e329e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY/O:ymb3NkkiQ3mdBjF0yjcsMW
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1940-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbnnbb.exe1thnbb.exejdjjp.exexrffrrx.exehbtthh.exenhbhbb.exe3vddj.exexrflffr.exebbhtbh.exevvvvj.exefxlxrxx.exe5rrfffl.exethhbhh.exejjvjv.exelfxxflx.exe1rlrxfr.exetnhnbh.exe7nhnbn.exepjvvp.exedpdvd.exeffxxlrf.exe7fxxlrx.exehnhhnh.exevpdjp.exejvdpp.exerlxxxfl.exe9tthhb.exeppjpd.exeppjpj.exefxlrrrf.exerrlxflr.exebbbnnn.exeddpdj.exepdvdp.exexlrffxf.exelfllxfl.exetnhbhn.exetnhtbb.exejdjpd.exevpdvd.exenhbbhh.exehbbbhh.exevvjdj.exepvjpv.exe3lfrxfl.exexrffxrl.exenbnthn.exehnhtnb.exejvvvv.exelfllrrf.exeffrrfrf.exebtntbb.exetnhbtn.exejvppp.exejdppp.exefrxxxrx.exe1rrrffl.exe5btbhh.exehtbbtt.exejpvpp.exe7vddj.exexrfxfxx.exe1lxlxfl.exenhhhnb.exepid process 2560 hbnnbb.exe 2644 1thnbb.exe 2436 jdjjp.exe 2696 xrffrrx.exe 2604 hbtthh.exe 2460 nhbhbb.exe 2836 3vddj.exe 2344 xrflffr.exe 1468 bbhtbh.exe 2328 vvvvj.exe 284 fxlxrxx.exe 1792 5rrfffl.exe 240 thhbhh.exe 1808 jjvjv.exe 2492 lfxxflx.exe 1044 1rlrxfr.exe 2656 tnhnbh.exe 2128 7nhnbn.exe 2036 pjvvp.exe 596 dpdvd.exe 1416 ffxxlrf.exe 1772 7fxxlrx.exe 2316 hnhhnh.exe 328 vpdjp.exe 2964 jvdpp.exe 2776 rlxxxfl.exe 1636 9tthhb.exe 1968 ppjpd.exe 2896 ppjpj.exe 2152 fxlrrrf.exe 1940 rrlxflr.exe 1512 bbbnnn.exe 2376 ddpdj.exe 2684 pdvdp.exe 2556 xlrffxf.exe 2732 lfllxfl.exe 2676 tnhbhn.exe 2488 tnhtbb.exe 2284 jdjpd.exe 2460 vpdvd.exe 1880 nhbbhh.exe 1892 hbbbhh.exe 2144 vvjdj.exe 804 pvjpv.exe 1596 3lfrxfl.exe 2188 xrffxrl.exe 2184 nbnthn.exe 1700 hnhtnb.exe 240 jvvvv.exe 1040 lfllrrf.exe 1248 ffrrfrf.exe 2828 btntbb.exe 1952 tnhbtn.exe 2656 jvppp.exe 3064 jdppp.exe 2264 frxxxrx.exe 880 1rrrffl.exe 2404 5btbhh.exe 1820 htbbtt.exe 2400 jpvpp.exe 2944 7vddj.exe 964 xrfxfxx.exe 2916 1lxlxfl.exe 1632 nhhhnb.exe -
Processes:
resource yara_rule behavioral1/memory/1940-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exehbnnbb.exe1thnbb.exejdjjp.exexrffrrx.exehbtthh.exenhbhbb.exe3vddj.exexrflffr.exebbhtbh.exevvvvj.exefxlxrxx.exe5rrfffl.exethhbhh.exejjvjv.exelfxxflx.exedescription pid process target process PID 1940 wrote to memory of 2560 1940 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe hbnnbb.exe PID 1940 wrote to memory of 2560 1940 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe hbnnbb.exe PID 1940 wrote to memory of 2560 1940 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe hbnnbb.exe PID 1940 wrote to memory of 2560 1940 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe hbnnbb.exe PID 2560 wrote to memory of 2644 2560 hbnnbb.exe 1thnbb.exe PID 2560 wrote to memory of 2644 2560 hbnnbb.exe 1thnbb.exe PID 2560 wrote to memory of 2644 2560 hbnnbb.exe 1thnbb.exe PID 2560 wrote to memory of 2644 2560 hbnnbb.exe 1thnbb.exe PID 2644 wrote to memory of 2436 2644 1thnbb.exe jdjjp.exe PID 2644 wrote to memory of 2436 2644 1thnbb.exe jdjjp.exe PID 2644 wrote to memory of 2436 2644 1thnbb.exe jdjjp.exe PID 2644 wrote to memory of 2436 2644 1thnbb.exe jdjjp.exe PID 2436 wrote to memory of 2696 2436 jdjjp.exe xrffrrx.exe PID 2436 wrote to memory of 2696 2436 jdjjp.exe xrffrrx.exe PID 2436 wrote to memory of 2696 2436 jdjjp.exe xrffrrx.exe PID 2436 wrote to memory of 2696 2436 jdjjp.exe xrffrrx.exe PID 2696 wrote to memory of 2604 2696 xrffrrx.exe hbtthh.exe PID 2696 wrote to memory of 2604 2696 xrffrrx.exe hbtthh.exe PID 2696 wrote to memory of 2604 2696 xrffrrx.exe hbtthh.exe PID 2696 wrote to memory of 2604 2696 xrffrrx.exe hbtthh.exe PID 2604 wrote to memory of 2460 2604 hbtthh.exe nhbhbb.exe PID 2604 wrote to memory of 2460 2604 hbtthh.exe nhbhbb.exe PID 2604 wrote to memory of 2460 2604 hbtthh.exe nhbhbb.exe PID 2604 wrote to memory of 2460 2604 hbtthh.exe nhbhbb.exe PID 2460 wrote to memory of 2836 2460 nhbhbb.exe 3vddj.exe PID 2460 wrote to memory of 2836 2460 nhbhbb.exe 3vddj.exe PID 2460 wrote to memory of 2836 2460 nhbhbb.exe 3vddj.exe PID 2460 wrote to memory of 2836 2460 nhbhbb.exe 3vddj.exe PID 2836 wrote to memory of 2344 2836 3vddj.exe xrflffr.exe PID 2836 wrote to memory of 2344 2836 3vddj.exe xrflffr.exe PID 2836 wrote to memory of 2344 2836 3vddj.exe xrflffr.exe PID 2836 wrote to memory of 2344 2836 3vddj.exe xrflffr.exe PID 2344 wrote to memory of 1468 2344 xrflffr.exe bbhtbh.exe PID 2344 wrote to memory of 1468 2344 xrflffr.exe bbhtbh.exe PID 2344 wrote to memory of 1468 2344 xrflffr.exe bbhtbh.exe PID 2344 wrote to memory of 1468 2344 xrflffr.exe bbhtbh.exe PID 1468 wrote to memory of 2328 1468 bbhtbh.exe vvvvj.exe PID 1468 wrote to memory of 2328 1468 bbhtbh.exe vvvvj.exe PID 1468 wrote to memory of 2328 1468 bbhtbh.exe vvvvj.exe PID 1468 wrote to memory of 2328 1468 bbhtbh.exe vvvvj.exe PID 2328 wrote to memory of 284 2328 vvvvj.exe fxlxrxx.exe PID 2328 wrote to memory of 284 2328 vvvvj.exe fxlxrxx.exe PID 2328 wrote to memory of 284 2328 vvvvj.exe fxlxrxx.exe PID 2328 wrote to memory of 284 2328 vvvvj.exe fxlxrxx.exe PID 284 wrote to memory of 1792 284 fxlxrxx.exe 5rrfffl.exe PID 284 wrote to memory of 1792 284 fxlxrxx.exe 5rrfffl.exe PID 284 wrote to memory of 1792 284 fxlxrxx.exe 5rrfffl.exe PID 284 wrote to memory of 1792 284 fxlxrxx.exe 5rrfffl.exe PID 1792 wrote to memory of 240 1792 5rrfffl.exe thhbhh.exe PID 1792 wrote to memory of 240 1792 5rrfffl.exe thhbhh.exe PID 1792 wrote to memory of 240 1792 5rrfffl.exe thhbhh.exe PID 1792 wrote to memory of 240 1792 5rrfffl.exe thhbhh.exe PID 240 wrote to memory of 1808 240 thhbhh.exe jjvjv.exe PID 240 wrote to memory of 1808 240 thhbhh.exe jjvjv.exe PID 240 wrote to memory of 1808 240 thhbhh.exe jjvjv.exe PID 240 wrote to memory of 1808 240 thhbhh.exe jjvjv.exe PID 1808 wrote to memory of 2492 1808 jjvjv.exe lfxxflx.exe PID 1808 wrote to memory of 2492 1808 jjvjv.exe lfxxflx.exe PID 1808 wrote to memory of 2492 1808 jjvjv.exe lfxxflx.exe PID 1808 wrote to memory of 2492 1808 jjvjv.exe lfxxflx.exe PID 2492 wrote to memory of 1044 2492 lfxxflx.exe 1rlrxfr.exe PID 2492 wrote to memory of 1044 2492 lfxxflx.exe 1rlrxfr.exe PID 2492 wrote to memory of 1044 2492 lfxxflx.exe 1rlrxfr.exe PID 2492 wrote to memory of 1044 2492 lfxxflx.exe 1rlrxfr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe"C:\Users\Admin\AppData\Local\Temp\321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\hbnnbb.exec:\hbnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1thnbb.exec:\1thnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jdjjp.exec:\jdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\xrffrrx.exec:\xrffrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\hbtthh.exec:\hbtthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nhbhbb.exec:\nhbhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\3vddj.exec:\3vddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xrflffr.exec:\xrflffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\bbhtbh.exec:\bbhtbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\vvvvj.exec:\vvvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\fxlxrxx.exec:\fxlxrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\5rrfffl.exec:\5rrfffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\thhbhh.exec:\thhbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\jjvjv.exec:\jjvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\lfxxflx.exec:\lfxxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\1rlrxfr.exec:\1rlrxfr.exe17⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tnhnbh.exec:\tnhnbh.exe18⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7nhnbn.exec:\7nhnbn.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjvvp.exec:\pjvvp.exe20⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dpdvd.exec:\dpdvd.exe21⤵
- Executes dropped EXE
PID:596 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe22⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7fxxlrx.exec:\7fxxlrx.exe23⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hnhhnh.exec:\hnhhnh.exe24⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vpdjp.exec:\vpdjp.exe25⤵
- Executes dropped EXE
PID:328 -
\??\c:\jvdpp.exec:\jvdpp.exe26⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe27⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9tthhb.exec:\9tthhb.exe28⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ppjpd.exec:\ppjpd.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ppjpj.exec:\ppjpj.exe30⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rrlxflr.exec:\rrlxflr.exe32⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bbbnnn.exec:\bbbnnn.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ddpdj.exec:\ddpdj.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pdvdp.exec:\pdvdp.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xlrffxf.exec:\xlrffxf.exe36⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lfllxfl.exec:\lfllxfl.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tnhbhn.exec:\tnhbhn.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tnhtbb.exec:\tnhtbb.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jdjpd.exec:\jdjpd.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vpdvd.exec:\vpdvd.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nhbbhh.exec:\nhbbhh.exe42⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbbbhh.exec:\hbbbhh.exe43⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vvjdj.exec:\vvjdj.exe44⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pvjpv.exec:\pvjpv.exe45⤵
- Executes dropped EXE
PID:804 -
\??\c:\3lfrxfl.exec:\3lfrxfl.exe46⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrffxrl.exec:\xrffxrl.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nbnthn.exec:\nbnthn.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hnhtnb.exec:\hnhtnb.exe49⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jvvvv.exec:\jvvvv.exe50⤵
- Executes dropped EXE
PID:240 -
\??\c:\lfllrrf.exec:\lfllrrf.exe51⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ffrrfrf.exec:\ffrrfrf.exe52⤵
- Executes dropped EXE
PID:1248 -
\??\c:\btntbb.exec:\btntbb.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnhbtn.exec:\tnhbtn.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jvppp.exec:\jvppp.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jdppp.exec:\jdppp.exe56⤵
- Executes dropped EXE
PID:3064 -
\??\c:\frxxxrx.exec:\frxxxrx.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1rrrffl.exec:\1rrrffl.exe58⤵
- Executes dropped EXE
PID:880 -
\??\c:\5btbhh.exec:\5btbhh.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\htbbtt.exec:\htbbtt.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jpvpp.exec:\jpvpp.exe61⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7vddj.exec:\7vddj.exe62⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xrfxfxx.exec:\xrfxfxx.exe63⤵
- Executes dropped EXE
PID:964 -
\??\c:\1lxlxfl.exec:\1lxlxfl.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nhhhnb.exec:\nhhhnb.exe65⤵
- Executes dropped EXE
PID:1632 -
\??\c:\httbhh.exec:\httbhh.exe66⤵PID:1680
-
\??\c:\dvjpp.exec:\dvjpp.exe67⤵PID:2096
-
\??\c:\jddpp.exec:\jddpp.exe68⤵PID:3044
-
\??\c:\lflrxxx.exec:\lflrxxx.exe69⤵PID:1148
-
\??\c:\rffrxxf.exec:\rffrxxf.exe70⤵PID:2304
-
\??\c:\bnhhtb.exec:\bnhhtb.exe71⤵PID:1752
-
\??\c:\9thbhh.exec:\9thbhh.exe72⤵PID:2912
-
\??\c:\vpjpv.exec:\vpjpv.exe73⤵PID:2524
-
\??\c:\dpvvd.exec:\dpvvd.exe74⤵PID:2632
-
\??\c:\9lfrllr.exec:\9lfrllr.exe75⤵PID:2664
-
\??\c:\rlrxxrf.exec:\rlrxxrf.exe76⤵PID:2680
-
\??\c:\nbhntn.exec:\nbhntn.exe77⤵PID:2708
-
\??\c:\ppvjj.exec:\ppvjj.exe78⤵PID:2044
-
\??\c:\dvdvv.exec:\dvdvv.exe79⤵PID:2604
-
\??\c:\7xlrrlr.exec:\7xlrrlr.exe80⤵PID:2448
-
\??\c:\5lxrrrx.exec:\5lxrrrx.exe81⤵PID:3060
-
\??\c:\hbnthn.exec:\hbnthn.exe82⤵PID:1660
-
\??\c:\httnnt.exec:\httnnt.exe83⤵PID:1524
-
\??\c:\jdjpv.exec:\jdjpv.exe84⤵PID:2312
-
\??\c:\jvppj.exec:\jvppj.exe85⤵PID:1516
-
\??\c:\rffxxrr.exec:\rffxxrr.exe86⤵PID:1268
-
\??\c:\llrrxfl.exec:\llrrxfl.exe87⤵PID:1696
-
\??\c:\7ntbnn.exec:\7ntbnn.exe88⤵PID:1428
-
\??\c:\1tnhtb.exec:\1tnhtb.exe89⤵PID:1520
-
\??\c:\dpppj.exec:\dpppj.exe90⤵PID:1580
-
\??\c:\pjdjd.exec:\pjdjd.exe91⤵PID:240
-
\??\c:\xxrlfff.exec:\xxrlfff.exe92⤵PID:2608
-
\??\c:\rxlffrx.exec:\rxlffrx.exe93⤵PID:1248
-
\??\c:\nbhntt.exec:\nbhntt.exe94⤵PID:2060
-
\??\c:\7bnhnh.exec:\7bnhnh.exe95⤵PID:1952
-
\??\c:\httbbt.exec:\httbbt.exe96⤵PID:2528
-
\??\c:\dpvpj.exec:\dpvpj.exe97⤵PID:1648
-
\??\c:\djjdj.exec:\djjdj.exe98⤵PID:644
-
\??\c:\5lrlrlr.exec:\5lrlrlr.exe99⤵PID:880
-
\??\c:\frflrrl.exec:\frflrrl.exe100⤵PID:1124
-
\??\c:\htttbn.exec:\htttbn.exe101⤵PID:2396
-
\??\c:\bthbtt.exec:\bthbtt.exe102⤵PID:2960
-
\??\c:\9jpdj.exec:\9jpdj.exe103⤵PID:2220
-
\??\c:\jpdpp.exec:\jpdpp.exe104⤵PID:1136
-
\??\c:\vjvdv.exec:\vjvdv.exe105⤵PID:2384
-
\??\c:\1fllrlf.exec:\1fllrlf.exe106⤵PID:2924
-
\??\c:\1lfrrrl.exec:\1lfrrrl.exe107⤵PID:1636
-
\??\c:\htbtnh.exec:\htbtnh.exe108⤵PID:1652
-
\??\c:\thbtbb.exec:\thbtbb.exe109⤵PID:2236
-
\??\c:\7ntbhb.exec:\7ntbhb.exe110⤵PID:1992
-
\??\c:\dpdvd.exec:\dpdvd.exe111⤵PID:1544
-
\??\c:\5pjdj.exec:\5pjdj.exe112⤵PID:2152
-
\??\c:\frfflrr.exec:\frfflrr.exe113⤵PID:2576
-
\??\c:\1xlrxff.exec:\1xlrxff.exe114⤵PID:2584
-
\??\c:\ttntbn.exec:\ttntbn.exe115⤵PID:2628
-
\??\c:\bntthh.exec:\bntthh.exe116⤵PID:2640
-
\??\c:\dpddj.exec:\dpddj.exe117⤵PID:2696
-
\??\c:\5jvpp.exec:\5jvpp.exe118⤵PID:2548
-
\??\c:\vpdjj.exec:\vpdjj.exe119⤵PID:2596
-
\??\c:\xrlrrrf.exec:\xrlrrrf.exe120⤵PID:2504
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe121⤵PID:2840
-
\??\c:\tnbbbh.exec:\tnbbbh.exe122⤵PID:1896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-