Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe
-
Size
77KB
-
MD5
1b3bd8d426377af1df2c64dd7139747b
-
SHA1
87954ae40414e6182b24bdf81688d3a2a43be5ec
-
SHA256
73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445
-
SHA512
cede94198ab2bfd398768358441ff87a53ab916b19c4cbbabfe459c07a44e5ea4483b1e3a26f40160f728a7c96a5dd6814127770398c8aaac46f7085d7209369
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmBs:ymb3NkkiQ3mdBjFo73thgQ/wEks
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2232-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-61-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-85-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral1/memory/2232-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2324-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2508-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2172-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3052-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1924-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/764-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1264-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/112-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1668-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2100-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1556-246-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1372-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1952-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1504-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2952-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1796 rlrfllx.exe 2324 nnbnbh.exe 2732 3hbbnn.exe 2064 vvvdj.exe 2956 jjjpv.exe 2780 llxfffl.exe 2508 vpdpv.exe 3068 1jvpd.exe 2172 lfrfffl.exe 3052 nbbbht.exe 468 jdjvv.exe 2876 dpjjp.exe 2580 xrffrlx.exe 2840 htnnbb.exe 1924 5nhntb.exe 2920 jdpvj.exe 764 lxlrflf.exe 1264 llxxfxf.exe 112 hthtbb.exe 1704 dvjpp.exe 1668 7fxlrxl.exe 2100 lrllrlx.exe 1792 hbthtt.exe 1676 hbntth.exe 1556 vpjpv.exe 1372 lfrxxxr.exe 1952 bthnbb.exe 1504 9tntbh.exe 2952 7jjpd.exe 2352 3rffflr.exe 872 xxflxxl.exe 556 btnbhn.exe 2596 nhbhhh.exe 2592 jvpjp.exe 2388 dvpjp.exe 1576 lfrrxff.exe 2660 xrfrrxf.exe 2732 nbthtb.exe 2392 htbhtt.exe 2548 pjvvd.exe 2900 1vppv.exe 2512 fxrrrrx.exe 2632 9lfflff.exe 1648 hthntt.exe 3068 bthhhh.exe 620 dvdjj.exe 1524 lfrrllr.exe 1712 5rrlffl.exe 2096 7btbnn.exe 2612 9hbbhb.exe 2788 ppjjp.exe 348 ddpvd.exe 2860 9frrxxf.exe 380 frfrfxf.exe 2920 5tthbn.exe 1788 hhbnth.exe 328 3ddjv.exe 1764 vpvdv.exe 1512 ddjpp.exe 2260 llflrrx.exe 2020 bthntt.exe 2100 3ttttt.exe 1312 vpdjp.exe 1856 1vvpp.exe -
resource yara_rule behavioral1/memory/2232-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-282-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1796 2232 73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe 28 PID 2232 wrote to memory of 1796 2232 73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe 28 PID 2232 wrote to memory of 1796 2232 73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe 28 PID 2232 wrote to memory of 1796 2232 73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe 28 PID 1796 wrote to memory of 2324 1796 rlrfllx.exe 29 PID 1796 wrote to memory of 2324 1796 rlrfllx.exe 29 PID 1796 wrote to memory of 2324 1796 rlrfllx.exe 29 PID 1796 wrote to memory of 2324 1796 rlrfllx.exe 29 PID 2324 wrote to memory of 2732 2324 nnbnbh.exe 30 PID 2324 wrote to memory of 2732 2324 nnbnbh.exe 30 PID 2324 wrote to memory of 2732 2324 nnbnbh.exe 30 PID 2324 wrote to memory of 2732 2324 nnbnbh.exe 30 PID 2732 wrote to memory of 2064 2732 3hbbnn.exe 31 PID 2732 wrote to memory of 2064 2732 3hbbnn.exe 31 PID 2732 wrote to memory of 2064 2732 3hbbnn.exe 31 PID 2732 wrote to memory of 2064 2732 3hbbnn.exe 31 PID 2064 wrote to memory of 2956 2064 vvvdj.exe 32 PID 2064 wrote to memory of 2956 2064 vvvdj.exe 32 PID 2064 wrote to memory of 2956 2064 vvvdj.exe 32 PID 2064 wrote to memory of 2956 2064 vvvdj.exe 32 PID 2956 wrote to memory of 2780 2956 jjjpv.exe 33 PID 2956 wrote to memory of 2780 2956 jjjpv.exe 33 PID 2956 wrote to memory of 2780 2956 jjjpv.exe 33 PID 2956 wrote to memory of 2780 2956 jjjpv.exe 33 PID 2780 wrote to memory of 2508 2780 llxfffl.exe 34 PID 2780 wrote to memory of 2508 2780 llxfffl.exe 34 PID 2780 wrote to memory of 2508 2780 llxfffl.exe 34 PID 2780 wrote to memory of 2508 2780 llxfffl.exe 34 PID 2508 wrote to memory of 3068 2508 vpdpv.exe 35 PID 2508 wrote to memory of 3068 2508 vpdpv.exe 35 PID 2508 wrote to memory of 3068 2508 vpdpv.exe 35 PID 2508 wrote to memory of 3068 2508 vpdpv.exe 35 PID 3068 wrote to memory of 2172 3068 1jvpd.exe 36 PID 3068 wrote to memory of 2172 3068 1jvpd.exe 36 PID 3068 wrote to memory of 2172 3068 1jvpd.exe 36 PID 3068 wrote to memory of 2172 3068 1jvpd.exe 36 PID 2172 wrote to memory of 3052 2172 lfrfffl.exe 37 PID 2172 wrote to memory of 3052 2172 lfrfffl.exe 37 PID 2172 wrote to memory of 3052 2172 lfrfffl.exe 37 PID 2172 wrote to memory of 3052 2172 lfrfffl.exe 37 PID 3052 wrote to memory of 468 3052 nbbbht.exe 38 PID 3052 wrote to memory of 468 3052 nbbbht.exe 38 PID 3052 wrote to memory of 468 3052 nbbbht.exe 38 PID 3052 wrote to memory of 468 3052 nbbbht.exe 38 PID 468 wrote to memory of 2876 468 jdjvv.exe 39 PID 468 wrote to memory of 2876 468 jdjvv.exe 39 PID 468 wrote to memory of 2876 468 jdjvv.exe 39 PID 468 wrote to memory of 2876 468 jdjvv.exe 39 PID 2876 wrote to memory of 2580 2876 dpjjp.exe 40 PID 2876 wrote to memory of 2580 2876 dpjjp.exe 40 PID 2876 wrote to memory of 2580 2876 dpjjp.exe 40 PID 2876 wrote to memory of 2580 2876 dpjjp.exe 40 PID 2580 wrote to memory of 2840 2580 xrffrlx.exe 41 PID 2580 wrote to memory of 2840 2580 xrffrlx.exe 41 PID 2580 wrote to memory of 2840 2580 xrffrlx.exe 41 PID 2580 wrote to memory of 2840 2580 xrffrlx.exe 41 PID 2840 wrote to memory of 1924 2840 htnnbb.exe 42 PID 2840 wrote to memory of 1924 2840 htnnbb.exe 42 PID 2840 wrote to memory of 1924 2840 htnnbb.exe 42 PID 2840 wrote to memory of 1924 2840 htnnbb.exe 42 PID 1924 wrote to memory of 2920 1924 5nhntb.exe 43 PID 1924 wrote to memory of 2920 1924 5nhntb.exe 43 PID 1924 wrote to memory of 2920 1924 5nhntb.exe 43 PID 1924 wrote to memory of 2920 1924 5nhntb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe"C:\Users\Admin\AppData\Local\Temp\73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\rlrfllx.exec:\rlrfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\nnbnbh.exec:\nnbnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3hbbnn.exec:\3hbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vvvdj.exec:\vvvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jjjpv.exec:\jjjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\llxfffl.exec:\llxfffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vpdpv.exec:\vpdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\1jvpd.exec:\1jvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\lfrfffl.exec:\lfrfffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\nbbbht.exec:\nbbbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jdjvv.exec:\jdjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\dpjjp.exec:\dpjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xrffrlx.exec:\xrffrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\htnnbb.exec:\htnnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5nhntb.exec:\5nhntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxlrflf.exec:\lxlrflf.exe18⤵
- Executes dropped EXE
PID:764 -
\??\c:\llxxfxf.exec:\llxxfxf.exe19⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hthtbb.exec:\hthtbb.exe20⤵
- Executes dropped EXE
PID:112 -
\??\c:\dvjpp.exec:\dvjpp.exe21⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7fxlrxl.exec:\7fxlrxl.exe22⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lrllrlx.exec:\lrllrlx.exe23⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hbthtt.exec:\hbthtt.exe24⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hbntth.exec:\hbntth.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vpjpv.exec:\vpjpv.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lfrxxxr.exec:\lfrxxxr.exe27⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bthnbb.exec:\bthnbb.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9tntbh.exec:\9tntbh.exe29⤵
- Executes dropped EXE
PID:1504 -
\??\c:\7jjpd.exec:\7jjpd.exe30⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3rffflr.exec:\3rffflr.exe31⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xxflxxl.exec:\xxflxxl.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\btnbhn.exec:\btnbhn.exe33⤵
- Executes dropped EXE
PID:556 -
\??\c:\nhbhhh.exec:\nhbhhh.exe34⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jvpjp.exec:\jvpjp.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dvpjp.exec:\dvpjp.exe36⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lfrrxff.exec:\lfrrxff.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xrfrrxf.exec:\xrfrrxf.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nbthtb.exec:\nbthtb.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\htbhtt.exec:\htbhtt.exe40⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjvvd.exec:\pjvvd.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1vppv.exec:\1vppv.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9lfflff.exec:\9lfflff.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hthntt.exec:\hthntt.exe45⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bthhhh.exec:\bthhhh.exe46⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dvdjj.exec:\dvdjj.exe47⤵
- Executes dropped EXE
PID:620 -
\??\c:\lfrrllr.exec:\lfrrllr.exe48⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5rrlffl.exec:\5rrlffl.exe49⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7btbnn.exec:\7btbnn.exe50⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9hbbhb.exec:\9hbbhb.exe51⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ppjjp.exec:\ppjjp.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ddpvd.exec:\ddpvd.exe53⤵
- Executes dropped EXE
PID:348 -
\??\c:\9frrxxf.exec:\9frrxxf.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\frfrfxf.exec:\frfrfxf.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\5tthbn.exec:\5tthbn.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hhbnth.exec:\hhbnth.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3ddjv.exec:\3ddjv.exe58⤵
- Executes dropped EXE
PID:328 -
\??\c:\vpvdv.exec:\vpvdv.exe59⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ddjpp.exec:\ddjpp.exe60⤵
- Executes dropped EXE
PID:1512 -
\??\c:\llflrrx.exec:\llflrrx.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bthntt.exec:\bthntt.exe62⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3ttttt.exec:\3ttttt.exe63⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vpdjp.exec:\vpdjp.exe64⤵
- Executes dropped EXE
PID:1312 -
\??\c:\1vvpp.exec:\1vvpp.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lflrrrx.exec:\lflrrrx.exe66⤵PID:2472
-
\??\c:\lfrflrr.exec:\lfrflrr.exe67⤵PID:1864
-
\??\c:\ttntnt.exec:\ttntnt.exe68⤵PID:1404
-
\??\c:\thtntb.exec:\thtntb.exe69⤵PID:924
-
\??\c:\5hhbtt.exec:\5hhbtt.exe70⤵PID:1580
-
\??\c:\1dvvp.exec:\1dvvp.exe71⤵PID:2240
-
\??\c:\7fxfrfr.exec:\7fxfrfr.exe72⤵PID:2952
-
\??\c:\rxfxfxf.exec:\rxfxfxf.exe73⤵PID:2424
-
\??\c:\frrrflx.exec:\frrrflx.exe74⤵PID:872
-
\??\c:\nnbtnb.exec:\nnbtnb.exe75⤵PID:1916
-
\??\c:\jdpvd.exec:\jdpvd.exe76⤵PID:1720
-
\??\c:\jjddd.exec:\jjddd.exe77⤵PID:2324
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe78⤵PID:2832
-
\??\c:\rlfffrf.exec:\rlfffrf.exe79⤵PID:2972
-
\??\c:\3nhhhn.exec:\3nhhhn.exe80⤵PID:2820
-
\??\c:\btbhnn.exec:\btbhnn.exe81⤵PID:2620
-
\??\c:\nhtthh.exec:\nhtthh.exe82⤵PID:2064
-
\??\c:\vvjjv.exec:\vvjjv.exe83⤵PID:2004
-
\??\c:\vdjvj.exec:\vdjvj.exe84⤵PID:2808
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe85⤵PID:2532
-
\??\c:\7ffrffr.exec:\7ffrffr.exe86⤵PID:2564
-
\??\c:\5nbhtb.exec:\5nbhtb.exe87⤵PID:1696
-
\??\c:\nhttnn.exec:\nhttnn.exe88⤵PID:3012
-
\??\c:\jdjvv.exec:\jdjvv.exe89⤵PID:3040
-
\??\c:\pdpvv.exec:\pdpvv.exe90⤵PID:1436
-
\??\c:\lfrxxxr.exec:\lfrxxxr.exe91⤵PID:2844
-
\??\c:\1lfrxfr.exec:\1lfrxfr.exe92⤵PID:2796
-
\??\c:\nhtbhh.exec:\nhtbhh.exe93⤵PID:2500
-
\??\c:\nbnnhn.exec:\nbnnhn.exe94⤵PID:824
-
\??\c:\vdvjd.exec:\vdvjd.exe95⤵PID:2848
-
\??\c:\vdvvj.exec:\vdvvj.exe96⤵PID:2768
-
\??\c:\vpdvv.exec:\vpdvv.exe97⤵PID:568
-
\??\c:\3rllrxf.exec:\3rllrxf.exe98⤵PID:1172
-
\??\c:\3flfrrf.exec:\3flfrrf.exe99⤵PID:788
-
\??\c:\btnntt.exec:\btnntt.exe100⤵PID:328
-
\??\c:\bthntt.exec:\bthntt.exe101⤵PID:2052
-
\??\c:\jjdjv.exec:\jjdjv.exe102⤵PID:292
-
\??\c:\vvjjp.exec:\vvjjp.exe103⤵PID:1528
-
\??\c:\lfflrlx.exec:\lfflrlx.exe104⤵PID:2276
-
\??\c:\lffrxrr.exec:\lffrxrr.exe105⤵PID:580
-
\??\c:\ttthnb.exec:\ttthnb.exe106⤵PID:1816
-
\??\c:\tnbhnn.exec:\tnbhnn.exe107⤵PID:1132
-
\??\c:\pjvdd.exec:\pjvdd.exe108⤵PID:944
-
\??\c:\pjpdv.exec:\pjpdv.exe109⤵PID:2008
-
\??\c:\xrllllr.exec:\xrllllr.exe110⤵PID:1960
-
\??\c:\fxllrrf.exec:\fxllrrf.exe111⤵PID:736
-
\??\c:\xxlxlfl.exec:\xxlxlfl.exe112⤵PID:600
-
\??\c:\7nbhnn.exec:\7nbhnn.exe113⤵PID:1632
-
\??\c:\nhbhbn.exec:\nhbhbn.exe114⤵PID:1684
-
\??\c:\5vjjj.exec:\5vjjj.exe115⤵PID:2332
-
\??\c:\5dvvd.exec:\5dvvd.exe116⤵PID:1604
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe117⤵PID:556
-
\??\c:\lflxfrx.exec:\lflxfrx.exe118⤵PID:2348
-
\??\c:\bbnhnn.exec:\bbnhnn.exe119⤵PID:2656
-
\??\c:\bbnttb.exec:\bbnttb.exe120⤵PID:2388
-
\??\c:\pjpvd.exec:\pjpvd.exe121⤵PID:2720
-
\??\c:\pdppp.exec:\pdppp.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-