Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe
-
Size
95KB
-
MD5
bbab3adcd6ac40959876a4e811a36444
-
SHA1
bfd24f1ac2e345c34e223cf39a999c898d5ad758
-
SHA256
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef
-
SHA512
f44240ce6aa5cfbbf50c31a03d242cf8a1a0ff1f2b006b2870542c4c0b66580d470c90537f7a2acb9dd2fd7b8b7447d5703334a4d6e4e5ea541e80b98e2ebdfa
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQ0:ymb3NkkiQ3mdBjFIj+qNhvZuHQY00
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2120-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2120-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1460-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3044-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2952-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1840-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2764-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2340-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2000-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/788-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2180-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1504-228-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1224-291-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vpvdp.exerrxllxr.exenbnbbb.exe9vddj.exelxllflr.exefxrrfxf.exe9frrxfl.exe1nbhhh.exedvddj.exerrffrrl.exerfrlrxx.exetnthth.exe1pjdd.exepdjjj.exefrfllfl.exehhtbhn.exenbhbbt.exevjjpv.exedvppv.exe3flfrrf.exe7nhhtb.exenhtbbh.exepjvpv.exepjjvv.exexllffxf.exe5lxlllr.exenbnnnh.exennhbbn.exepjddp.exe3xrrxxf.exefrxrrrr.exehhttbh.exejjpjj.exe5jjvj.exelfrxlfl.exerlrxxlx.exenhthbb.exebtbhtb.exevvdjj.exejjpdp.exe5lllffl.exe3nbhhh.exetntbbb.exevjdjp.exe5vppd.exe3rxrxxf.exefxrrxrf.exexlxlrrr.exetnttbh.exenbhnnt.exejdjdp.exevvpvj.exe3lfllxr.exerrlrffr.exebbtnht.exejjddp.exe5jvjj.exefxrxxfx.exellfrlll.exetnbbnn.exe3nthtn.exeppjpd.exe5jdjj.exe9lllrrx.exepid process 1460 vpvdp.exe 2600 rrxllxr.exe 2696 nbnbbb.exe 3044 9vddj.exe 2712 lxllflr.exe 2952 fxrrfxf.exe 2472 9frrxfl.exe 2904 1nbhhh.exe 1840 dvddj.exe 2764 rrffrrl.exe 2648 rfrlrxx.exe 2340 tnthth.exe 2000 1pjdd.exe 404 pdjjj.exe 788 frfllfl.exe 816 hhtbhn.exe 1600 nbhbbt.exe 1772 vjjpv.exe 2180 dvppv.exe 1924 3flfrrf.exe 1708 7nhhtb.exe 336 nhtbbh.exe 1504 pjvpv.exe 868 pjjvv.exe 1628 xllffxf.exe 2864 5lxlllr.exe 928 nbnnnh.exe 2388 nnhbbn.exe 1500 pjddp.exe 1224 3xrrxxf.exe 1068 frxrrrr.exe 2396 hhttbh.exe 1200 jjpjj.exe 2204 5jjvj.exe 2664 lfrxlfl.exe 2832 rlrxxlx.exe 2828 nhthbb.exe 2616 btbhtb.exe 2260 vvdjj.exe 2620 jjpdp.exe 2488 5lllffl.exe 2532 3nbhhh.exe 2692 tntbbb.exe 2020 vjdjp.exe 2632 5vppd.exe 2744 3rxrxxf.exe 2776 fxrrxrf.exe 2648 xlxlrrr.exe 2044 tnttbh.exe 2172 nbhnnt.exe 1056 jdjdp.exe 404 vvpvj.exe 1060 3lfllxr.exe 1972 rrlrffr.exe 1644 bbtnht.exe 2312 jjddp.exe 2440 5jvjj.exe 2968 fxrxxfx.exe 2096 llfrlll.exe 692 tnbbnn.exe 536 3nthtn.exe 3020 ppjpd.exe 1496 5jdjj.exe 868 9lllrrx.exe -
Processes:
resource yara_rule behavioral1/memory/2120-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exevpvdp.exerrxllxr.exenbnbbb.exe9vddj.exelxllflr.exefxrrfxf.exe9frrxfl.exe1nbhhh.exedvddj.exerrffrrl.exerfrlrxx.exetnthth.exe1pjdd.exepdjjj.exefrfllfl.exedescription pid process target process PID 2120 wrote to memory of 1460 2120 db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe vpvdp.exe PID 2120 wrote to memory of 1460 2120 db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe vpvdp.exe PID 2120 wrote to memory of 1460 2120 db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe vpvdp.exe PID 2120 wrote to memory of 1460 2120 db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe vpvdp.exe PID 1460 wrote to memory of 2600 1460 vpvdp.exe rrxllxr.exe PID 1460 wrote to memory of 2600 1460 vpvdp.exe rrxllxr.exe PID 1460 wrote to memory of 2600 1460 vpvdp.exe rrxllxr.exe PID 1460 wrote to memory of 2600 1460 vpvdp.exe rrxllxr.exe PID 2600 wrote to memory of 2696 2600 rrxllxr.exe nbnbbb.exe PID 2600 wrote to memory of 2696 2600 rrxllxr.exe nbnbbb.exe PID 2600 wrote to memory of 2696 2600 rrxllxr.exe nbnbbb.exe PID 2600 wrote to memory of 2696 2600 rrxllxr.exe nbnbbb.exe PID 2696 wrote to memory of 3044 2696 nbnbbb.exe 9vddj.exe PID 2696 wrote to memory of 3044 2696 nbnbbb.exe 9vddj.exe PID 2696 wrote to memory of 3044 2696 nbnbbb.exe 9vddj.exe PID 2696 wrote to memory of 3044 2696 nbnbbb.exe 9vddj.exe PID 3044 wrote to memory of 2712 3044 9vddj.exe lxllflr.exe PID 3044 wrote to memory of 2712 3044 9vddj.exe lxllflr.exe PID 3044 wrote to memory of 2712 3044 9vddj.exe lxllflr.exe PID 3044 wrote to memory of 2712 3044 9vddj.exe lxllflr.exe PID 2712 wrote to memory of 2952 2712 lxllflr.exe fxrrfxf.exe PID 2712 wrote to memory of 2952 2712 lxllflr.exe fxrrfxf.exe PID 2712 wrote to memory of 2952 2712 lxllflr.exe fxrrfxf.exe PID 2712 wrote to memory of 2952 2712 lxllflr.exe fxrrfxf.exe PID 2952 wrote to memory of 2472 2952 fxrrfxf.exe 9frrxfl.exe PID 2952 wrote to memory of 2472 2952 fxrrfxf.exe 9frrxfl.exe PID 2952 wrote to memory of 2472 2952 fxrrfxf.exe 9frrxfl.exe PID 2952 wrote to memory of 2472 2952 fxrrfxf.exe 9frrxfl.exe PID 2472 wrote to memory of 2904 2472 9frrxfl.exe 1nbhhh.exe PID 2472 wrote to memory of 2904 2472 9frrxfl.exe 1nbhhh.exe PID 2472 wrote to memory of 2904 2472 9frrxfl.exe 1nbhhh.exe PID 2472 wrote to memory of 2904 2472 9frrxfl.exe 1nbhhh.exe PID 2904 wrote to memory of 1840 2904 1nbhhh.exe dvddj.exe PID 2904 wrote to memory of 1840 2904 1nbhhh.exe dvddj.exe PID 2904 wrote to memory of 1840 2904 1nbhhh.exe dvddj.exe PID 2904 wrote to memory of 1840 2904 1nbhhh.exe dvddj.exe PID 1840 wrote to memory of 2764 1840 dvddj.exe rrffrrl.exe PID 1840 wrote to memory of 2764 1840 dvddj.exe rrffrrl.exe PID 1840 wrote to memory of 2764 1840 dvddj.exe rrffrrl.exe PID 1840 wrote to memory of 2764 1840 dvddj.exe rrffrrl.exe PID 2764 wrote to memory of 2648 2764 rrffrrl.exe rfrlrxx.exe PID 2764 wrote to memory of 2648 2764 rrffrrl.exe rfrlrxx.exe PID 2764 wrote to memory of 2648 2764 rrffrrl.exe rfrlrxx.exe PID 2764 wrote to memory of 2648 2764 rrffrrl.exe rfrlrxx.exe PID 2648 wrote to memory of 2340 2648 rfrlrxx.exe tnthth.exe PID 2648 wrote to memory of 2340 2648 rfrlrxx.exe tnthth.exe PID 2648 wrote to memory of 2340 2648 rfrlrxx.exe tnthth.exe PID 2648 wrote to memory of 2340 2648 rfrlrxx.exe tnthth.exe PID 2340 wrote to memory of 2000 2340 tnthth.exe 1pjdd.exe PID 2340 wrote to memory of 2000 2340 tnthth.exe 1pjdd.exe PID 2340 wrote to memory of 2000 2340 tnthth.exe 1pjdd.exe PID 2340 wrote to memory of 2000 2340 tnthth.exe 1pjdd.exe PID 2000 wrote to memory of 404 2000 1pjdd.exe pdjjj.exe PID 2000 wrote to memory of 404 2000 1pjdd.exe pdjjj.exe PID 2000 wrote to memory of 404 2000 1pjdd.exe pdjjj.exe PID 2000 wrote to memory of 404 2000 1pjdd.exe pdjjj.exe PID 404 wrote to memory of 788 404 pdjjj.exe frfllfl.exe PID 404 wrote to memory of 788 404 pdjjj.exe frfllfl.exe PID 404 wrote to memory of 788 404 pdjjj.exe frfllfl.exe PID 404 wrote to memory of 788 404 pdjjj.exe frfllfl.exe PID 788 wrote to memory of 816 788 frfllfl.exe hhtbhn.exe PID 788 wrote to memory of 816 788 frfllfl.exe hhtbhn.exe PID 788 wrote to memory of 816 788 frfllfl.exe hhtbhn.exe PID 788 wrote to memory of 816 788 frfllfl.exe hhtbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe"C:\Users\Admin\AppData\Local\Temp\db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\vpvdp.exec:\vpvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\rrxllxr.exec:\rrxllxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nbnbbb.exec:\nbnbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9vddj.exec:\9vddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lxllflr.exec:\lxllflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\fxrrfxf.exec:\fxrrfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\9frrxfl.exec:\9frrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\1nbhhh.exec:\1nbhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\dvddj.exec:\dvddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\rrffrrl.exec:\rrffrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rfrlrxx.exec:\rfrlrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tnthth.exec:\tnthth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\1pjdd.exec:\1pjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\pdjjj.exec:\pdjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\frfllfl.exec:\frfllfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\hhtbhn.exec:\hhtbhn.exe17⤵
- Executes dropped EXE
PID:816 -
\??\c:\nbhbbt.exec:\nbhbbt.exe18⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vjjpv.exec:\vjjpv.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dvppv.exec:\dvppv.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3flfrrf.exec:\3flfrrf.exe21⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7nhhtb.exec:\7nhhtb.exe22⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nhtbbh.exec:\nhtbbh.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\pjvpv.exec:\pjvpv.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pjjvv.exec:\pjjvv.exe25⤵
- Executes dropped EXE
PID:868 -
\??\c:\xllffxf.exec:\xllffxf.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5lxlllr.exec:\5lxlllr.exe27⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nbnnnh.exec:\nbnnnh.exe28⤵
- Executes dropped EXE
PID:928 -
\??\c:\nnhbbn.exec:\nnhbbn.exe29⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pjddp.exec:\pjddp.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3xrrxxf.exec:\3xrrxxf.exe31⤵
- Executes dropped EXE
PID:1224 -
\??\c:\frxrrrr.exec:\frxrrrr.exe32⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hhttbh.exec:\hhttbh.exe33⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jjpjj.exec:\jjpjj.exe34⤵
- Executes dropped EXE
PID:1200 -
\??\c:\5jjvj.exec:\5jjvj.exe35⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rlrxxlx.exec:\rlrxxlx.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhthbb.exec:\nhthbb.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\btbhtb.exec:\btbhtb.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vvdjj.exec:\vvdjj.exe40⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjpdp.exec:\jjpdp.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\5lllffl.exec:\5lllffl.exe42⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3nbhhh.exec:\3nbhhh.exe43⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tntbbb.exec:\tntbbb.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vjdjp.exec:\vjdjp.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5vppd.exec:\5vppd.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3rxrxxf.exec:\3rxrxxf.exe47⤵
- Executes dropped EXE
PID:2744 -
\??\c:\fxrrxrf.exec:\fxrrxrf.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xlxlrrr.exec:\xlxlrrr.exe49⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnttbh.exec:\tnttbh.exe50⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nbhnnt.exec:\nbhnnt.exe51⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jdjdp.exec:\jdjdp.exe52⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vvpvj.exec:\vvpvj.exe53⤵
- Executes dropped EXE
PID:404 -
\??\c:\3lfllxr.exec:\3lfllxr.exe54⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rrlrffr.exec:\rrlrffr.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bbtnht.exec:\bbtnht.exe56⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jjddp.exec:\jjddp.exe57⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5jvjj.exec:\5jvjj.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\llfrlll.exec:\llfrlll.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tnbbnn.exec:\tnbbnn.exe61⤵
- Executes dropped EXE
PID:692 -
\??\c:\3nthtn.exec:\3nthtn.exe62⤵
- Executes dropped EXE
PID:536 -
\??\c:\ppjpd.exec:\ppjpd.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5jdjj.exec:\5jdjj.exe64⤵
- Executes dropped EXE
PID:1496 -
\??\c:\9lllrrx.exec:\9lllrrx.exe65⤵
- Executes dropped EXE
PID:868 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe66⤵PID:1880
-
\??\c:\3tthbn.exec:\3tthbn.exe67⤵PID:280
-
\??\c:\1nhnbb.exec:\1nhnbb.exe68⤵PID:780
-
\??\c:\jdvvj.exec:\jdvvj.exe69⤵PID:2544
-
\??\c:\pjvdj.exec:\pjvdj.exe70⤵PID:1996
-
\??\c:\bnbtbn.exec:\bnbtbn.exe71⤵PID:572
-
\??\c:\jdpvd.exec:\jdpvd.exe72⤵PID:1808
-
\??\c:\vjvpp.exec:\vjvpp.exe73⤵PID:2960
-
\??\c:\5frxlrx.exec:\5frxlrx.exe74⤵PID:1652
-
\??\c:\lffxxxf.exec:\lffxxxf.exe75⤵PID:2396
-
\??\c:\frxxffl.exec:\frxxffl.exe76⤵PID:1620
-
\??\c:\7thhhb.exec:\7thhhb.exe77⤵PID:1712
-
\??\c:\9tbhtb.exec:\9tbhtb.exe78⤵PID:2688
-
\??\c:\dvpvp.exec:\dvpvp.exe79⤵PID:2684
-
\??\c:\vpvvv.exec:\vpvvv.exe80⤵PID:2824
-
\??\c:\rxlxfff.exec:\rxlxfff.exe81⤵PID:3044
-
\??\c:\3xlllll.exec:\3xlllll.exe82⤵PID:2732
-
\??\c:\tntthh.exec:\tntthh.exe83⤵PID:2464
-
\??\c:\5hbbbn.exec:\5hbbbn.exe84⤵PID:2680
-
\??\c:\jvdvd.exec:\jvdvd.exe85⤵PID:2908
-
\??\c:\jjdpj.exec:\jjdpj.exe86⤵PID:2924
-
\??\c:\lfflffr.exec:\lfflffr.exe87⤵PID:2628
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe88⤵PID:2760
-
\??\c:\tbbbtb.exec:\tbbbtb.exe89⤵PID:2764
-
\??\c:\hthbbb.exec:\hthbbb.exe90⤵PID:2792
-
\??\c:\dvjjj.exec:\dvjjj.exe91⤵PID:2920
-
\??\c:\pdpjp.exec:\pdpjp.exe92⤵PID:2024
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe93⤵PID:2352
-
\??\c:\1ffflrr.exec:\1ffflrr.exe94⤵PID:2424
-
\??\c:\btbhbn.exec:\btbhbn.exe95⤵PID:1288
-
\??\c:\pjvvj.exec:\pjvvj.exe96⤵PID:1656
-
\??\c:\jdppv.exec:\jdppv.exe97⤵PID:2216
-
\??\c:\3jjjp.exec:\3jjjp.exe98⤵PID:1600
-
\??\c:\lfrflrf.exec:\lfrflrf.exe99⤵PID:1800
-
\??\c:\rflrffl.exec:\rflrffl.exe100⤵PID:2180
-
\??\c:\ffxllrf.exec:\ffxllrf.exe101⤵PID:2092
-
\??\c:\tthnht.exec:\tthnht.exe102⤵PID:596
-
\??\c:\jdpjv.exec:\jdpjv.exe103⤵PID:1076
-
\??\c:\vjvpj.exec:\vjvpj.exe104⤵PID:1488
-
\??\c:\7rfrlxf.exec:\7rfrlxf.exe105⤵PID:1824
-
\??\c:\rflrllx.exec:\rflrllx.exe106⤵PID:2500
-
\??\c:\3thttn.exec:\3thttn.exe107⤵PID:988
-
\??\c:\thbhbb.exec:\thbhbb.exe108⤵PID:2336
-
\??\c:\pjvjp.exec:\pjvjp.exe109⤵PID:956
-
\??\c:\7rllxff.exec:\7rllxff.exe110⤵PID:1928
-
\??\c:\fxfffff.exec:\fxfffff.exe111⤵PID:708
-
\??\c:\3xxlrxl.exec:\3xxlrxl.exe112⤵PID:2880
-
\??\c:\thhhth.exec:\thhhth.exe113⤵PID:1500
-
\??\c:\pjjvj.exec:\pjjvj.exe114⤵PID:1516
-
\??\c:\1pdjv.exec:\1pdjv.exe115⤵PID:2120
-
\??\c:\xrxxllx.exec:\xrxxllx.exe116⤵PID:2328
-
\??\c:\bhthnb.exec:\bhthnb.exe117⤵PID:1676
-
\??\c:\hbbbhb.exec:\hbbbhb.exe118⤵PID:2196
-
\??\c:\ppjvj.exec:\ppjvj.exe119⤵PID:2644
-
\??\c:\vdvvv.exec:\vdvvv.exe120⤵PID:2600
-
\??\c:\7rxrrlr.exec:\7rxrrlr.exe121⤵PID:2700
-
\??\c:\7bnnbh.exec:\7bnnbh.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-