Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe
-
Size
63KB
-
MD5
1cd6beb3db803de72c24bfe505c5e455
-
SHA1
ff373248e2ef7b31891e72ac812af2a6723866bd
-
SHA256
2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c
-
SHA512
776efd4485a167fa84a64028d3ac870ff6fb697c4a6da2c6b9fdedf8dc687f58014c6d1341e7e45680b6186d5255e05a7c76def4f0712fc7618a2149b1f11a88
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDAB:ymb3NkkiQ3mdBjFIk8B
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3044-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2916-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2900-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2880-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2812-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1644-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1824-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/568-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1924-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2928-227-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/784-245-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2292-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2000-281-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/632-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3044 jdjpv.exe 2596 vvdjd.exe 2916 frllxxx.exe 2900 dvpjp.exe 2880 7ppdp.exe 2512 xrflrrx.exe 2496 9bhtbb.exe 2420 ppjpd.exe 2812 fffllxx.exe 2856 hbhnbb.exe 2976 9pvdj.exe 1644 7xxrxfr.exe 1824 lfrxlrf.exe 1372 hbtbnn.exe 568 jdvdd.exe 1540 jdvdp.exe 1400 ffrxlxl.exe 2040 5fffffr.exe 2956 3hhbhh.exe 2096 7jddj.exe 1904 pjvpp.exe 1924 lfrrxxf.exe 2928 tthnbn.exe 1472 jvjvv.exe 784 pjvjj.exe 2292 flxrrrl.exe 856 nnhbnb.exe 2548 flxrlfr.exe 2000 1rlxrfr.exe 632 bbtbnt.exe 1656 nhhbth.exe 2372 lflxxfx.exe 2100 xlllxfr.exe 2576 9hnhnt.exe 1516 ppjpd.exe 2592 7jjdd.exe 2916 5llxffl.exe 2672 9ffrxfr.exe 2632 btbhnt.exe 2464 bthnbh.exe 2540 vpppj.exe 2516 pjjpv.exe 2440 5lxrfrf.exe 1784 lrlrfxl.exe 2836 bnbttt.exe 2972 jjjjj.exe 2992 pjjjp.exe 2112 xfrrflx.exe 1548 xrffllx.exe 760 3bnbnt.exe 320 hbnttb.exe 1416 pjdjv.exe 2796 vvjvj.exe 1584 3rrrxxl.exe 1156 xxrfrxl.exe 1964 5btbhn.exe 3028 9nbbbh.exe 1092 vvpvj.exe 2644 1ppdp.exe 1904 9lxrxfl.exe 1728 tnbnth.exe 2220 btbhbn.exe 1908 3vvjv.exe 1176 9djvj.exe -
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 3044 2180 2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe 28 PID 2180 wrote to memory of 3044 2180 2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe 28 PID 2180 wrote to memory of 3044 2180 2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe 28 PID 2180 wrote to memory of 3044 2180 2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe 28 PID 3044 wrote to memory of 2596 3044 jdjpv.exe 29 PID 3044 wrote to memory of 2596 3044 jdjpv.exe 29 PID 3044 wrote to memory of 2596 3044 jdjpv.exe 29 PID 3044 wrote to memory of 2596 3044 jdjpv.exe 29 PID 2596 wrote to memory of 2916 2596 vvdjd.exe 30 PID 2596 wrote to memory of 2916 2596 vvdjd.exe 30 PID 2596 wrote to memory of 2916 2596 vvdjd.exe 30 PID 2596 wrote to memory of 2916 2596 vvdjd.exe 30 PID 2916 wrote to memory of 2900 2916 frllxxx.exe 31 PID 2916 wrote to memory of 2900 2916 frllxxx.exe 31 PID 2916 wrote to memory of 2900 2916 frllxxx.exe 31 PID 2916 wrote to memory of 2900 2916 frllxxx.exe 31 PID 2900 wrote to memory of 2880 2900 dvpjp.exe 32 PID 2900 wrote to memory of 2880 2900 dvpjp.exe 32 PID 2900 wrote to memory of 2880 2900 dvpjp.exe 32 PID 2900 wrote to memory of 2880 2900 dvpjp.exe 32 PID 2880 wrote to memory of 2512 2880 7ppdp.exe 33 PID 2880 wrote to memory of 2512 2880 7ppdp.exe 33 PID 2880 wrote to memory of 2512 2880 7ppdp.exe 33 PID 2880 wrote to memory of 2512 2880 7ppdp.exe 33 PID 2512 wrote to memory of 2496 2512 xrflrrx.exe 34 PID 2512 wrote to memory of 2496 2512 xrflrrx.exe 34 PID 2512 wrote to memory of 2496 2512 xrflrrx.exe 34 PID 2512 wrote to memory of 2496 2512 xrflrrx.exe 34 PID 2496 wrote to memory of 2420 2496 9bhtbb.exe 35 PID 2496 wrote to memory of 2420 2496 9bhtbb.exe 35 PID 2496 wrote to memory of 2420 2496 9bhtbb.exe 35 PID 2496 wrote to memory of 2420 2496 9bhtbb.exe 35 PID 2420 wrote to memory of 2812 2420 ppjpd.exe 36 PID 2420 wrote to memory of 2812 2420 ppjpd.exe 36 PID 2420 wrote to memory of 2812 2420 ppjpd.exe 36 PID 2420 wrote to memory of 2812 2420 ppjpd.exe 36 PID 2812 wrote to memory of 2856 2812 fffllxx.exe 37 PID 2812 wrote to memory of 2856 2812 fffllxx.exe 37 PID 2812 wrote to memory of 2856 2812 fffllxx.exe 37 PID 2812 wrote to memory of 2856 2812 fffllxx.exe 37 PID 2856 wrote to memory of 2976 2856 hbhnbb.exe 38 PID 2856 wrote to memory of 2976 2856 hbhnbb.exe 38 PID 2856 wrote to memory of 2976 2856 hbhnbb.exe 38 PID 2856 wrote to memory of 2976 2856 hbhnbb.exe 38 PID 2976 wrote to memory of 1644 2976 9pvdj.exe 39 PID 2976 wrote to memory of 1644 2976 9pvdj.exe 39 PID 2976 wrote to memory of 1644 2976 9pvdj.exe 39 PID 2976 wrote to memory of 1644 2976 9pvdj.exe 39 PID 1644 wrote to memory of 1824 1644 7xxrxfr.exe 40 PID 1644 wrote to memory of 1824 1644 7xxrxfr.exe 40 PID 1644 wrote to memory of 1824 1644 7xxrxfr.exe 40 PID 1644 wrote to memory of 1824 1644 7xxrxfr.exe 40 PID 1824 wrote to memory of 1372 1824 lfrxlrf.exe 41 PID 1824 wrote to memory of 1372 1824 lfrxlrf.exe 41 PID 1824 wrote to memory of 1372 1824 lfrxlrf.exe 41 PID 1824 wrote to memory of 1372 1824 lfrxlrf.exe 41 PID 1372 wrote to memory of 568 1372 hbtbnn.exe 42 PID 1372 wrote to memory of 568 1372 hbtbnn.exe 42 PID 1372 wrote to memory of 568 1372 hbtbnn.exe 42 PID 1372 wrote to memory of 568 1372 hbtbnn.exe 42 PID 568 wrote to memory of 1540 568 jdvdd.exe 43 PID 568 wrote to memory of 1540 568 jdvdd.exe 43 PID 568 wrote to memory of 1540 568 jdvdd.exe 43 PID 568 wrote to memory of 1540 568 jdvdd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe"C:\Users\Admin\AppData\Local\Temp\2223e0f69fa4c4be1a8b43f15b308fe811e2f9969859abb1d7ff1870b69aef2c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jdjpv.exec:\jdjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vvdjd.exec:\vvdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\frllxxx.exec:\frllxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dvpjp.exec:\dvpjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\7ppdp.exec:\7ppdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xrflrrx.exec:\xrflrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\9bhtbb.exec:\9bhtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ppjpd.exec:\ppjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\fffllxx.exec:\fffllxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hbhnbb.exec:\hbhnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\9pvdj.exec:\9pvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\7xxrxfr.exec:\7xxrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hbtbnn.exec:\hbtbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\jdvdd.exec:\jdvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\jdvdp.exec:\jdvdp.exe17⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ffrxlxl.exec:\ffrxlxl.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\5fffffr.exec:\5fffffr.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3hhbhh.exec:\3hhbhh.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7jddj.exec:\7jddj.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjvpp.exec:\pjvpp.exe22⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tthnbn.exec:\tthnbn.exe24⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jvjvv.exec:\jvjvv.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pjvjj.exec:\pjvjj.exe26⤵
- Executes dropped EXE
PID:784 -
\??\c:\flxrrrl.exec:\flxrrrl.exe27⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nnhbnb.exec:\nnhbnb.exe28⤵
- Executes dropped EXE
PID:856 -
\??\c:\flxrlfr.exec:\flxrlfr.exe29⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1rlxrfr.exec:\1rlxrfr.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bbtbnt.exec:\bbtbnt.exe31⤵
- Executes dropped EXE
PID:632 -
\??\c:\nhhbth.exec:\nhhbth.exe32⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lflxxfx.exec:\lflxxfx.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xlllxfr.exec:\xlllxfr.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hbhntb.exec:\hbhntb.exe35⤵PID:3044
-
\??\c:\9hnhnt.exec:\9hnhnt.exe36⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ppjpd.exec:\ppjpd.exe37⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7jjdd.exec:\7jjdd.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5llxffl.exec:\5llxffl.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9ffrxfr.exec:\9ffrxfr.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btbhnt.exec:\btbhnt.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bthnbh.exec:\bthnbh.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vpppj.exec:\vpppj.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pjjpv.exec:\pjjpv.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5lxrfrf.exec:\5lxrfrf.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lrlrfxl.exec:\lrlrfxl.exe46⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bnbttt.exec:\bnbttt.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jjjjj.exec:\jjjjj.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pjjjp.exec:\pjjjp.exe49⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xfrrflx.exec:\xfrrflx.exe50⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xrffllx.exec:\xrffllx.exe51⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3bnbnt.exec:\3bnbnt.exe52⤵
- Executes dropped EXE
PID:760 -
\??\c:\hbnttb.exec:\hbnttb.exe53⤵
- Executes dropped EXE
PID:320 -
\??\c:\pjdjv.exec:\pjdjv.exe54⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vvjvj.exec:\vvjvj.exe55⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3rrrxxl.exec:\3rrrxxl.exe56⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\5btbhn.exec:\5btbhn.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9nbbbh.exec:\9nbbbh.exe59⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vvpvj.exec:\vvpvj.exe60⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1ppdp.exec:\1ppdp.exe61⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9lxrxfl.exec:\9lxrxfl.exe62⤵
- Executes dropped EXE
PID:1904 -
\??\c:\tnbnth.exec:\tnbnth.exe63⤵
- Executes dropped EXE
PID:1728 -
\??\c:\btbhbn.exec:\btbhbn.exe64⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3vvjv.exec:\3vvjv.exe65⤵
- Executes dropped EXE
PID:1908 -
\??\c:\9djvj.exec:\9djvj.exe66⤵
- Executes dropped EXE
PID:1176 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe67⤵PID:1668
-
\??\c:\xxrlrfr.exec:\xxrlrfr.exe68⤵PID:2292
-
\??\c:\hnhnhn.exec:\hnhnhn.exe69⤵PID:2268
-
\??\c:\jjddj.exec:\jjddj.exe70⤵PID:2552
-
\??\c:\dpvjp.exec:\dpvjp.exe71⤵PID:2964
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe72⤵PID:1900
-
\??\c:\hbhntn.exec:\hbhntn.exe73⤵PID:2968
-
\??\c:\hthnbb.exec:\hthnbb.exe74⤵PID:2376
-
\??\c:\1tnntb.exec:\1tnntb.exe75⤵PID:1608
-
\??\c:\dvpvv.exec:\dvpvv.exe76⤵PID:2560
-
\??\c:\fxlllrx.exec:\fxlllrx.exe77⤵PID:2608
-
\??\c:\flffrlx.exec:\flffrlx.exe78⤵PID:1504
-
\??\c:\tnttht.exec:\tnttht.exe79⤵PID:1516
-
\??\c:\hbnnbb.exec:\hbnnbb.exe80⤵PID:2592
-
\??\c:\tnhbnn.exec:\tnhbnn.exe81⤵PID:2648
-
\??\c:\dvppv.exec:\dvppv.exe82⤵PID:2584
-
\??\c:\1ddjj.exec:\1ddjj.exe83⤵PID:2640
-
\??\c:\1fxffrf.exec:\1fxffrf.exe84⤵PID:1528
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe85⤵PID:2544
-
\??\c:\hbnbnt.exec:\hbnbnt.exe86⤵PID:2852
-
\??\c:\nbnhnh.exec:\nbnhnh.exe87⤵PID:2440
-
\??\c:\dvppv.exec:\dvppv.exe88⤵PID:1236
-
\??\c:\vdjdp.exec:\vdjdp.exe89⤵PID:2836
-
\??\c:\fxffrxf.exec:\fxffrxf.exe90⤵PID:1256
-
\??\c:\llffllx.exec:\llffllx.exe91⤵PID:2184
-
\??\c:\hhnntb.exec:\hhnntb.exe92⤵PID:840
-
\??\c:\9httbb.exec:\9httbb.exe93⤵PID:2680
-
\??\c:\9jvpv.exec:\9jvpv.exe94⤵PID:2528
-
\??\c:\pdppd.exec:\pdppd.exe95⤵PID:320
-
\??\c:\fxrxxrr.exec:\fxrxxrr.exe96⤵PID:1312
-
\??\c:\xrlxffl.exec:\xrlxffl.exe97⤵PID:2676
-
\??\c:\tntthh.exec:\tntthh.exe98⤵PID:2032
-
\??\c:\5nbhnt.exec:\5nbhnt.exe99⤵PID:1172
-
\??\c:\vdvdv.exec:\vdvdv.exe100⤵PID:2956
-
\??\c:\pjvdv.exec:\pjvdv.exe101⤵PID:3036
-
\??\c:\rfxxlrx.exec:\rfxxlrx.exe102⤵PID:1200
-
\??\c:\xfxrxrl.exec:\xfxrxrl.exe103⤵PID:2644
-
\??\c:\5bhhnn.exec:\5bhhnn.exe104⤵PID:2136
-
\??\c:\tntthh.exec:\tntthh.exe105⤵PID:1072
-
\??\c:\nbthbb.exec:\nbthbb.exe106⤵PID:2052
-
\??\c:\3ddpd.exec:\3ddpd.exe107⤵PID:1908
-
\??\c:\jddjp.exec:\jddjp.exe108⤵PID:1780
-
\??\c:\5rrfxfl.exec:\5rrfxfl.exe109⤵PID:1668
-
\??\c:\7nnthn.exec:\7nnthn.exe110⤵PID:2656
-
\??\c:\bhnhbt.exec:\bhnhbt.exe111⤵PID:916
-
\??\c:\jdvdp.exec:\jdvdp.exe112⤵PID:600
-
\??\c:\ddpdj.exec:\ddpdj.exe113⤵PID:2964
-
\??\c:\3xlrfll.exec:\3xlrfll.exe114⤵PID:632
-
\??\c:\lfxxxll.exec:\lfxxxll.exe115⤵PID:2372
-
\??\c:\1thnbt.exec:\1thnbt.exe116⤵PID:876
-
\??\c:\ttthth.exec:\ttthth.exe117⤵PID:2704
-
\??\c:\ddjdp.exec:\ddjdp.exe118⤵PID:2100
-
\??\c:\jjdjd.exec:\jjdjd.exe119⤵PID:2416
-
\??\c:\9lxfffr.exec:\9lxfffr.exe120⤵PID:2616
-
\??\c:\fxllrxl.exec:\fxllrxl.exe121⤵PID:2700
-
\??\c:\tnbntt.exec:\tnbntt.exe122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-