Analysis
-
max time kernel
136s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe
-
Size
64KB
-
MD5
94d3f8eaa9f291bf002105b6f9b572b1
-
SHA1
85785395bc21bf763bdcdde850446fc94eab1f72
-
SHA256
2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4
-
SHA512
d9cb8dcc30b4479dee9d3a666ee970072a5bf702eb623f1b0f05e9ef0b260e51d2570bb5ab71c235ede7d7fc453b5a14eb56d588ff8e879ce3dda2c47fce0e6d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AK:ymb3NkkiQ3mdBjFI46TQK
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2276-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-51-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-296-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon behavioral1/memory/1732-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral1/memory/2276-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2328-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2888-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1208-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1152-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1732-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1596-284-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2016-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/932-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1572-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2204-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2872-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2304-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2276 pdvdv.exe 2888 xlxrffr.exe 2304 ttnbnt.exe 2616 dvjpd.exe 2576 vpdjj.exe 2540 vdddj.exe 2560 rllrfxl.exe 2440 xflrrlx.exe 2872 9bbhth.exe 2204 bbtbhn.exe 1208 vdjpd.exe 2004 jjjjd.exe 1572 llffrxl.exe 1684 7rrxrxx.exe 932 1hhnbh.exe 2708 tnbhhn.exe 2856 dvjjp.exe 2000 3jjvj.exe 2068 vjdpd.exe 1932 3llrxfr.exe 2016 rlfrffr.exe 2600 bbbnht.exe 1424 nnhbbh.exe 1836 jjjvd.exe 1152 jddpp.exe 936 lfllffx.exe 2228 frxlrfl.exe 2772 nnhtbn.exe 1596 bbbbtb.exe 1732 ppjdp.exe 1980 dvvdj.exe 1676 lrxflfr.exe 1556 rxxxxrl.exe 2564 ttnthn.exe 2776 5hhbnn.exe 2944 tbtbnt.exe 2784 9pvvp.exe 1812 dvjjv.exe 2644 lfrrflx.exe 2544 3ffflxl.exe 1640 7htnbb.exe 2864 thnthh.exe 2512 tnntbh.exe 1608 dvpvj.exe 2428 ppvvj.exe 2444 7jdjp.exe 2388 lllrlrx.exe 2472 rrlrrxl.exe 932 bbthbn.exe 1408 nntthh.exe 1748 1hbhth.exe 2384 ddvdv.exe 1612 ppvpv.exe 2068 fxrxxlf.exe 1716 rlrrfff.exe 1352 5nbhtt.exe 1432 3nbnnb.exe 1868 dvvjp.exe 1236 pjddj.exe 1504 ppppp.exe 952 xrlxffr.exe 1420 ffrxlrr.exe 2700 rllrxxf.exe 572 tntthh.exe -
resource yara_rule behavioral1/memory/2276-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-33-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2276 2328 2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe 59 PID 2328 wrote to memory of 2276 2328 2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe 59 PID 2328 wrote to memory of 2276 2328 2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe 59 PID 2328 wrote to memory of 2276 2328 2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe 59 PID 2276 wrote to memory of 2888 2276 pdvdv.exe 140 PID 2276 wrote to memory of 2888 2276 pdvdv.exe 140 PID 2276 wrote to memory of 2888 2276 pdvdv.exe 140 PID 2276 wrote to memory of 2888 2276 pdvdv.exe 140 PID 2888 wrote to memory of 2304 2888 xlxrffr.exe 30 PID 2888 wrote to memory of 2304 2888 xlxrffr.exe 30 PID 2888 wrote to memory of 2304 2888 xlxrffr.exe 30 PID 2888 wrote to memory of 2304 2888 xlxrffr.exe 30 PID 2304 wrote to memory of 2616 2304 ttnbnt.exe 31 PID 2304 wrote to memory of 2616 2304 ttnbnt.exe 31 PID 2304 wrote to memory of 2616 2304 ttnbnt.exe 31 PID 2304 wrote to memory of 2616 2304 ttnbnt.exe 31 PID 2616 wrote to memory of 2576 2616 dvjpd.exe 225 PID 2616 wrote to memory of 2576 2616 dvjpd.exe 225 PID 2616 wrote to memory of 2576 2616 dvjpd.exe 225 PID 2616 wrote to memory of 2576 2616 dvjpd.exe 225 PID 2576 wrote to memory of 2540 2576 vpdjj.exe 33 PID 2576 wrote to memory of 2540 2576 vpdjj.exe 33 PID 2576 wrote to memory of 2540 2576 vpdjj.exe 33 PID 2576 wrote to memory of 2540 2576 vpdjj.exe 33 PID 2540 wrote to memory of 2560 2540 vdddj.exe 307 PID 2540 wrote to memory of 2560 2540 vdddj.exe 307 PID 2540 wrote to memory of 2560 2540 vdddj.exe 307 PID 2540 wrote to memory of 2560 2540 vdddj.exe 307 PID 2560 wrote to memory of 2440 2560 rllrfxl.exe 35 PID 2560 wrote to memory of 2440 2560 rllrfxl.exe 35 PID 2560 wrote to memory of 2440 2560 rllrfxl.exe 35 PID 2560 wrote to memory of 2440 2560 rllrfxl.exe 35 PID 2440 wrote to memory of 2872 2440 xflrrlx.exe 36 PID 2440 wrote to memory of 2872 2440 xflrrlx.exe 36 PID 2440 wrote to memory of 2872 2440 xflrrlx.exe 36 PID 2440 wrote to memory of 2872 2440 xflrrlx.exe 36 PID 2872 wrote to memory of 2204 2872 9bbhth.exe 37 PID 2872 wrote to memory of 2204 2872 9bbhth.exe 37 PID 2872 wrote to memory of 2204 2872 9bbhth.exe 37 PID 2872 wrote to memory of 2204 2872 9bbhth.exe 37 PID 2204 wrote to memory of 1208 2204 bbtbhn.exe 231 PID 2204 wrote to memory of 1208 2204 bbtbhn.exe 231 PID 2204 wrote to memory of 1208 2204 bbtbhn.exe 231 PID 2204 wrote to memory of 1208 2204 bbtbhn.exe 231 PID 1208 wrote to memory of 2004 1208 vdjpd.exe 39 PID 1208 wrote to memory of 2004 1208 vdjpd.exe 39 PID 1208 wrote to memory of 2004 1208 vdjpd.exe 39 PID 1208 wrote to memory of 2004 1208 vdjpd.exe 39 PID 2004 wrote to memory of 1572 2004 jjjjd.exe 318 PID 2004 wrote to memory of 1572 2004 jjjjd.exe 318 PID 2004 wrote to memory of 1572 2004 jjjjd.exe 318 PID 2004 wrote to memory of 1572 2004 jjjjd.exe 318 PID 1572 wrote to memory of 1684 1572 llffrxl.exe 41 PID 1572 wrote to memory of 1684 1572 llffrxl.exe 41 PID 1572 wrote to memory of 1684 1572 llffrxl.exe 41 PID 1572 wrote to memory of 1684 1572 llffrxl.exe 41 PID 1684 wrote to memory of 932 1684 7rrxrxx.exe 118 PID 1684 wrote to memory of 932 1684 7rrxrxx.exe 118 PID 1684 wrote to memory of 932 1684 7rrxrxx.exe 118 PID 1684 wrote to memory of 932 1684 7rrxrxx.exe 118 PID 932 wrote to memory of 2708 932 1hhnbh.exe 43 PID 932 wrote to memory of 2708 932 1hhnbh.exe 43 PID 932 wrote to memory of 2708 932 1hhnbh.exe 43 PID 932 wrote to memory of 2708 932 1hhnbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe"C:\Users\Admin\AppData\Local\Temp\2b3a15f041630e6c111da68ecf3878aa42a49f18116f6aa1642b6ed749013dd4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pdvdv.exec:\pdvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\xlxrffr.exec:\xlxrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ttnbnt.exec:\ttnbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\dvjpd.exec:\dvjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vpdjj.exec:\vpdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\vdddj.exec:\vdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rllrfxl.exec:\rllrfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xflrrlx.exec:\xflrrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\9bbhth.exec:\9bbhth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\bbtbhn.exec:\bbtbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vdjpd.exec:\vdjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\jjjjd.exec:\jjjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\llffrxl.exec:\llffrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\7rrxrxx.exec:\7rrxrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\1hhnbh.exec:\1hhnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\tnbhhn.exec:\tnbhhn.exe17⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvjjp.exec:\dvjjp.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3jjvj.exec:\3jjvj.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vjdpd.exec:\vjdpd.exe20⤵
- Executes dropped EXE
PID:2068 -
\??\c:\3llrxfr.exec:\3llrxfr.exe21⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rlfrffr.exec:\rlfrffr.exe22⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bbbnht.exec:\bbbnht.exe23⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nnhbbh.exec:\nnhbbh.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jjjvd.exec:\jjjvd.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jddpp.exec:\jddpp.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lfllffx.exec:\lfllffx.exe27⤵
- Executes dropped EXE
PID:936 -
\??\c:\frxlrfl.exec:\frxlrfl.exe28⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nnhtbn.exec:\nnhtbn.exe29⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bbbbtb.exec:\bbbbtb.exe30⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ppjdp.exec:\ppjdp.exe31⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvvdj.exec:\dvvdj.exe32⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rllxlrf.exec:\rllxlrf.exe33⤵PID:2276
-
\??\c:\lrxflfr.exec:\lrxflfr.exe34⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rxxxxrl.exec:\rxxxxrl.exe35⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ttnthn.exec:\ttnthn.exe36⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5hhbnn.exec:\5hhbnn.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tbtbnt.exec:\tbtbnt.exe38⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9pvvp.exec:\9pvvp.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dvjjv.exec:\dvjjv.exe40⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lfrrflx.exec:\lfrrflx.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3ffflxl.exec:\3ffflxl.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\7htnbb.exec:\7htnbb.exe43⤵
- Executes dropped EXE
PID:1640 -
\??\c:\thnthh.exec:\thnthh.exe44⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tnntbh.exec:\tnntbh.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dvpvj.exec:\dvpvj.exe46⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ppvvj.exec:\ppvvj.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\7jdjp.exec:\7jdjp.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\lllrlrx.exec:\lllrlrx.exe49⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rrlrrxl.exec:\rrlrrxl.exe50⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bbthbn.exec:\bbthbn.exe51⤵
- Executes dropped EXE
PID:932 -
\??\c:\nntthh.exec:\nntthh.exe52⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1hbhth.exec:\1hbhth.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ddvdv.exec:\ddvdv.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ppvpv.exec:\ppvpv.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fxrxxlf.exec:\fxrxxlf.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rlrrfff.exec:\rlrrfff.exe57⤵
- Executes dropped EXE
PID:1716 -
\??\c:\5nbhtt.exec:\5nbhtt.exe58⤵
- Executes dropped EXE
PID:1352 -
\??\c:\3nbnnb.exec:\3nbnnb.exe59⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dvvjp.exec:\dvvjp.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pjddj.exec:\pjddj.exe61⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ppppp.exec:\ppppp.exe62⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrlxffr.exec:\xrlxffr.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\ffrxlrr.exec:\ffrxlrr.exe64⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rllrxxf.exec:\rllrxxf.exe65⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tntthh.exec:\tntthh.exe66⤵
- Executes dropped EXE
PID:572 -
\??\c:\9hnhtt.exec:\9hnhtt.exe67⤵PID:644
-
\??\c:\3jjdd.exec:\3jjdd.exe68⤵PID:2256
-
\??\c:\dpddp.exec:\dpddp.exe69⤵PID:1876
-
\??\c:\5lrxlxf.exec:\5lrxlxf.exe70⤵PID:2328
-
\??\c:\llrffrl.exec:\llrffrl.exe71⤵PID:2316
-
\??\c:\3nbhnh.exec:\3nbhnh.exe72⤵PID:1672
-
\??\c:\1tnntb.exec:\1tnntb.exe73⤵PID:1028
-
\??\c:\5bnnnn.exec:\5bnnnn.exe74⤵PID:2836
-
\??\c:\vpddp.exec:\vpddp.exe75⤵PID:2648
-
\??\c:\ddddj.exec:\ddddj.exe76⤵PID:2776
-
\??\c:\lfxrfll.exec:\lfxrfll.exe77⤵PID:2584
-
\??\c:\flxxxfl.exec:\flxxxfl.exe78⤵PID:2524
-
\??\c:\3nnntt.exec:\3nnntt.exe79⤵PID:2596
-
\??\c:\tnbhnt.exec:\tnbhnt.exe80⤵PID:1972
-
\??\c:\jdvvj.exec:\jdvvj.exe81⤵PID:1628
-
\??\c:\vpvvv.exec:\vpvvv.exe82⤵PID:2984
-
\??\c:\xllfrrr.exec:\xllfrrr.exe83⤵PID:1664
-
\??\c:\xlxlfll.exec:\xlxlfll.exe84⤵PID:1320
-
\??\c:\nbhbnh.exec:\nbhbnh.exe85⤵PID:2864
-
\??\c:\btnhbb.exec:\btnhbb.exe86⤵PID:2548
-
\??\c:\jdvdd.exec:\jdvdd.exe87⤵PID:1496
-
\??\c:\jjjjv.exec:\jjjjv.exe88⤵PID:1620
-
\??\c:\pjppv.exec:\pjppv.exe89⤵PID:2728
-
\??\c:\fflffrl.exec:\fflffrl.exe90⤵PID:1260
-
\??\c:\fffrrff.exec:\fffrrff.exe91⤵PID:2472
-
\??\c:\nttnnb.exec:\nttnnb.exe92⤵PID:932
-
\??\c:\ntbttb.exec:\ntbttb.exe93⤵PID:1408
-
\??\c:\nhtbhn.exec:\nhtbhn.exe94⤵PID:2208
-
\??\c:\jdpvj.exec:\jdpvj.exe95⤵PID:2360
-
\??\c:\7dpjp.exec:\7dpjp.exe96⤵PID:1612
-
\??\c:\xrflrxl.exec:\xrflrxl.exe97⤵PID:2068
-
\??\c:\9lrllxr.exec:\9lrllxr.exe98⤵PID:1716
-
\??\c:\lxfrrxr.exec:\lxfrrxr.exe99⤵PID:2720
-
\??\c:\hnbhnt.exec:\hnbhnt.exe100⤵PID:808
-
\??\c:\bthbnt.exec:\bthbnt.exe101⤵PID:2356
-
\??\c:\pjdpv.exec:\pjdpv.exe102⤵PID:1148
-
\??\c:\ddppv.exec:\ddppv.exe103⤵PID:1736
-
\??\c:\vvvdv.exec:\vvvdv.exe104⤵PID:2052
-
\??\c:\lxxffxr.exec:\lxxffxr.exe105⤵PID:2024
-
\??\c:\xlrrxrr.exec:\xlrrxrr.exe106⤵PID:3024
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe107⤵PID:2012
-
\??\c:\nhhttn.exec:\nhhttn.exe108⤵PID:1728
-
\??\c:\htbhhh.exec:\htbhhh.exe109⤵PID:880
-
\??\c:\jjdvv.exec:\jjdvv.exe110⤵PID:1872
-
\??\c:\jpjdv.exec:\jpjdv.exe111⤵PID:2916
-
\??\c:\fxfrrxx.exec:\fxfrrxx.exe112⤵PID:2176
-
\??\c:\xrfflfr.exec:\xrfflfr.exe113⤵PID:1692
-
\??\c:\lfxrlrl.exec:\lfxrlrl.exe114⤵PID:2888
-
\??\c:\hbtbtb.exec:\hbtbtb.exe115⤵PID:2572
-
\??\c:\9tbbhn.exec:\9tbbhn.exe116⤵PID:2660
-
\??\c:\ddvvd.exec:\ddvvd.exe117⤵PID:3068
-
\??\c:\1jdpj.exec:\1jdpj.exe118⤵PID:2576
-
\??\c:\jdpjp.exec:\jdpjp.exe119⤵PID:2524
-
\??\c:\1fxxxff.exec:\1fxxxff.exe120⤵PID:2036
-
\??\c:\lxffffl.exec:\lxffffl.exe121⤵PID:2644
-
\??\c:\lrlrlxx.exec:\lrlrlxx.exe122⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-