Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe
-
Size
92KB
-
MD5
01fbb3c604ed878c2bddff0ec99f709c
-
SHA1
3edabe63bd0ad047fc58d0503eda33b646f7fdcc
-
SHA256
98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed
-
SHA512
068c0c977a0e304e6af0a5b45c146c6fa59abbe8ae622f6e975c3db972ca8c14de38c19f420f6de6dec1a8c34c07154f8327e757a6c087637f1182210d89a828
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBi:ymb3NkkiQ3mdBjFIVLd2hWZGreRCUlba
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/1040-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-95-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-2041-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral1/memory/1040-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1928-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1688-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/856-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1492-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/376-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/380-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2272-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2012-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1404-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2988-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/804-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2992-266-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2004-275-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-284-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2980-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-2041-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2708 pjvpj.exe 1928 jjvjj.exe 2632 fxrxffx.exe 2648 nnhnhb.exe 2468 btbbhn.exe 2416 ppdpj.exe 2436 frfrxfl.exe 1688 bnhtbb.exe 856 1tnnbh.exe 2348 dpvdp.exe 2672 xrxrlll.exe 1492 nnhntb.exe 376 vjddj.exe 380 jpvpd.exe 1612 xxllxfx.exe 2272 ttnhbh.exe 1036 htnthh.exe 2912 9vppd.exe 3020 xrrrxxf.exe 2012 nhnnhn.exe 2224 tthtbn.exe 1404 jdvdp.exe 1756 llflfrl.exe 2988 nhthbn.exe 1160 5bnbhh.exe 804 ddvjv.exe 2992 lrrlrxl.exe 2004 thnntb.exe 2892 vjvdp.exe 2980 lrrrxxf.exe 2288 hnbhtt.exe 1896 tbttbt.exe 2544 ppppd.exe 1532 rfrrlff.exe 2876 7lxrxrl.exe 2724 hbttbn.exe 2636 ntbnbt.exe 2648 djppj.exe 2640 djvjj.exe 2468 rrxlrfx.exe 1692 hhhtbh.exe 2420 hnnhth.exe 2436 vjvdv.exe 864 ffxlxrx.exe 1240 flxllxl.exe 2592 9llrflx.exe 2668 ttntbh.exe 1632 dvpdj.exe 1516 ppdjp.exe 1572 dpdjj.exe 1764 lfflxrx.exe 2676 frflrxx.exe 2044 hbntbb.exe 2272 pjjdj.exe 3028 djpjj.exe 2464 xffxrrf.exe 2204 lllfrfx.exe 1948 ttbhnt.exe 1420 dpppp.exe 1068 jdvvv.exe 1576 7flrrxr.exe 1012 fxllxrx.exe 3056 btntnt.exe 3060 3nhhnn.exe -
resource yara_rule behavioral1/memory/1040-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-2041-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-2057-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1040 wrote to memory of 2708 1040 98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe 28 PID 1040 wrote to memory of 2708 1040 98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe 28 PID 1040 wrote to memory of 2708 1040 98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe 28 PID 1040 wrote to memory of 2708 1040 98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe 28 PID 2708 wrote to memory of 1928 2708 pjvpj.exe 29 PID 2708 wrote to memory of 1928 2708 pjvpj.exe 29 PID 2708 wrote to memory of 1928 2708 pjvpj.exe 29 PID 2708 wrote to memory of 1928 2708 pjvpj.exe 29 PID 1928 wrote to memory of 2632 1928 jjvjj.exe 30 PID 1928 wrote to memory of 2632 1928 jjvjj.exe 30 PID 1928 wrote to memory of 2632 1928 jjvjj.exe 30 PID 1928 wrote to memory of 2632 1928 jjvjj.exe 30 PID 2632 wrote to memory of 2648 2632 fxrxffx.exe 31 PID 2632 wrote to memory of 2648 2632 fxrxffx.exe 31 PID 2632 wrote to memory of 2648 2632 fxrxffx.exe 31 PID 2632 wrote to memory of 2648 2632 fxrxffx.exe 31 PID 2648 wrote to memory of 2468 2648 nnhnhb.exe 32 PID 2648 wrote to memory of 2468 2648 nnhnhb.exe 32 PID 2648 wrote to memory of 2468 2648 nnhnhb.exe 32 PID 2648 wrote to memory of 2468 2648 nnhnhb.exe 32 PID 2468 wrote to memory of 2416 2468 btbbhn.exe 33 PID 2468 wrote to memory of 2416 2468 btbbhn.exe 33 PID 2468 wrote to memory of 2416 2468 btbbhn.exe 33 PID 2468 wrote to memory of 2416 2468 btbbhn.exe 33 PID 2416 wrote to memory of 2436 2416 ppdpj.exe 34 PID 2416 wrote to memory of 2436 2416 ppdpj.exe 34 PID 2416 wrote to memory of 2436 2416 ppdpj.exe 34 PID 2416 wrote to memory of 2436 2416 ppdpj.exe 34 PID 2436 wrote to memory of 1688 2436 frfrxfl.exe 35 PID 2436 wrote to memory of 1688 2436 frfrxfl.exe 35 PID 2436 wrote to memory of 1688 2436 frfrxfl.exe 35 PID 2436 wrote to memory of 1688 2436 frfrxfl.exe 35 PID 1688 wrote to memory of 856 1688 bnhtbb.exe 36 PID 1688 wrote to memory of 856 1688 bnhtbb.exe 36 PID 1688 wrote to memory of 856 1688 bnhtbb.exe 36 PID 1688 wrote to memory of 856 1688 bnhtbb.exe 36 PID 856 wrote to memory of 2348 856 1tnnbh.exe 37 PID 856 wrote to memory of 2348 856 1tnnbh.exe 37 PID 856 wrote to memory of 2348 856 1tnnbh.exe 37 PID 856 wrote to memory of 2348 856 1tnnbh.exe 37 PID 2348 wrote to memory of 2672 2348 dpvdp.exe 38 PID 2348 wrote to memory of 2672 2348 dpvdp.exe 38 PID 2348 wrote to memory of 2672 2348 dpvdp.exe 38 PID 2348 wrote to memory of 2672 2348 dpvdp.exe 38 PID 2672 wrote to memory of 1492 2672 xrxrlll.exe 39 PID 2672 wrote to memory of 1492 2672 xrxrlll.exe 39 PID 2672 wrote to memory of 1492 2672 xrxrlll.exe 39 PID 2672 wrote to memory of 1492 2672 xrxrlll.exe 39 PID 1492 wrote to memory of 376 1492 nnhntb.exe 40 PID 1492 wrote to memory of 376 1492 nnhntb.exe 40 PID 1492 wrote to memory of 376 1492 nnhntb.exe 40 PID 1492 wrote to memory of 376 1492 nnhntb.exe 40 PID 376 wrote to memory of 380 376 vjddj.exe 41 PID 376 wrote to memory of 380 376 vjddj.exe 41 PID 376 wrote to memory of 380 376 vjddj.exe 41 PID 376 wrote to memory of 380 376 vjddj.exe 41 PID 380 wrote to memory of 1612 380 jpvpd.exe 42 PID 380 wrote to memory of 1612 380 jpvpd.exe 42 PID 380 wrote to memory of 1612 380 jpvpd.exe 42 PID 380 wrote to memory of 1612 380 jpvpd.exe 42 PID 1612 wrote to memory of 2272 1612 xxllxfx.exe 43 PID 1612 wrote to memory of 2272 1612 xxllxfx.exe 43 PID 1612 wrote to memory of 2272 1612 xxllxfx.exe 43 PID 1612 wrote to memory of 2272 1612 xxllxfx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe"C:\Users\Admin\AppData\Local\Temp\98939571c92ac1ef54b0a2254b0ca4668489d7974b9fd96e6c26a1e86fcb69ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\pjvpj.exec:\pjvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jjvjj.exec:\jjvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\fxrxffx.exec:\fxrxffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nnhnhb.exec:\nnhnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\btbbhn.exec:\btbbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\ppdpj.exec:\ppdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\frfrxfl.exec:\frfrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\bnhtbb.exec:\bnhtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\1tnnbh.exec:\1tnnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\dpvdp.exec:\dpvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xrxrlll.exec:\xrxrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nnhntb.exec:\nnhntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\vjddj.exec:\vjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\jpvpd.exec:\jpvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\xxllxfx.exec:\xxllxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\ttnhbh.exec:\ttnhbh.exe17⤵
- Executes dropped EXE
PID:2272 -
\??\c:\htnthh.exec:\htnthh.exe18⤵
- Executes dropped EXE
PID:1036 -
\??\c:\9vppd.exec:\9vppd.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhnnhn.exec:\nhnnhn.exe21⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tthtbn.exec:\tthtbn.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jdvdp.exec:\jdvdp.exe23⤵
- Executes dropped EXE
PID:1404 -
\??\c:\llflfrl.exec:\llflfrl.exe24⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nhthbn.exec:\nhthbn.exe25⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5bnbhh.exec:\5bnbhh.exe26⤵
- Executes dropped EXE
PID:1160 -
\??\c:\ddvjv.exec:\ddvjv.exe27⤵
- Executes dropped EXE
PID:804 -
\??\c:\lrrlrxl.exec:\lrrlrxl.exe28⤵
- Executes dropped EXE
PID:2992 -
\??\c:\thnntb.exec:\thnntb.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vjvdp.exec:\vjvdp.exe30⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lrrrxxf.exec:\lrrrxxf.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hnbhtt.exec:\hnbhtt.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tbttbt.exec:\tbttbt.exe33⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ppppd.exec:\ppppd.exe34⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rfrrlff.exec:\rfrrlff.exe35⤵
- Executes dropped EXE
PID:1532 -
\??\c:\7lxrxrl.exec:\7lxrxrl.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hbttbn.exec:\hbttbn.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ntbnbt.exec:\ntbnbt.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\djppj.exec:\djppj.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\djvjj.exec:\djvjj.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rrxlrfx.exec:\rrxlrfx.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hhhtbh.exec:\hhhtbh.exe42⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hnnhth.exec:\hnnhth.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vjvdv.exec:\vjvdv.exe44⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ffxlxrx.exec:\ffxlxrx.exe45⤵
- Executes dropped EXE
PID:864 -
\??\c:\flxllxl.exec:\flxllxl.exe46⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9llrflx.exec:\9llrflx.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ttntbh.exec:\ttntbh.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dvpdj.exec:\dvpdj.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ppdjp.exec:\ppdjp.exe50⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dpdjj.exec:\dpdjj.exe51⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lfflxrx.exec:\lfflxrx.exe52⤵
- Executes dropped EXE
PID:1764 -
\??\c:\frflrxx.exec:\frflrxx.exe53⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hbntbb.exec:\hbntbb.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pjjdj.exec:\pjjdj.exe55⤵
- Executes dropped EXE
PID:2272 -
\??\c:\djpjj.exec:\djpjj.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xffxrrf.exec:\xffxrrf.exe57⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lllfrfx.exec:\lllfrfx.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ttbhnt.exec:\ttbhnt.exe59⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dpppp.exec:\dpppp.exe60⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jdvvv.exec:\jdvvv.exe61⤵
- Executes dropped EXE
PID:1068 -
\??\c:\7flrrxr.exec:\7flrrxr.exe62⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxllxrx.exec:\fxllxrx.exe63⤵
- Executes dropped EXE
PID:1012 -
\??\c:\btntnt.exec:\btntnt.exe64⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3nhhnn.exec:\3nhhnn.exe65⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vvvdp.exec:\vvvdp.exe66⤵PID:2864
-
\??\c:\3jdjj.exec:\3jdjj.exe67⤵PID:960
-
\??\c:\1rllrrf.exec:\1rllrrf.exe68⤵PID:2060
-
\??\c:\rllrxll.exec:\rllrxll.exe69⤵PID:1964
-
\??\c:\nhtnnb.exec:\nhtnnb.exe70⤵PID:2004
-
\??\c:\ddpvd.exec:\ddpvd.exe71⤵PID:2764
-
\??\c:\pvvdp.exec:\pvvdp.exe72⤵PID:1980
-
\??\c:\rfxlxrx.exec:\rfxlxrx.exe73⤵PID:884
-
\??\c:\lflrflr.exec:\lflrflr.exe74⤵PID:2176
-
\??\c:\3tntbt.exec:\3tntbt.exe75⤵PID:2472
-
\??\c:\hhtbtt.exec:\hhtbtt.exe76⤵PID:1536
-
\??\c:\pvdvj.exec:\pvdvj.exe77⤵PID:1532
-
\??\c:\vpdjd.exec:\vpdjd.exe78⤵PID:2612
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe79⤵PID:2724
-
\??\c:\fffrxxr.exec:\fffrxxr.exe80⤵PID:2632
-
\??\c:\ttbntt.exec:\ttbntt.exe81⤵PID:2648
-
\??\c:\tthbhh.exec:\tthbhh.exe82⤵PID:2644
-
\??\c:\1tnhht.exec:\1tnhht.exe83⤵PID:2468
-
\??\c:\pdvpj.exec:\pdvpj.exe84⤵PID:2800
-
\??\c:\vpvvv.exec:\vpvvv.exe85⤵PID:2420
-
\??\c:\xrrxxrx.exec:\xrrxxrx.exe86⤵PID:1512
-
\??\c:\btthbb.exec:\btthbb.exe87⤵PID:864
-
\??\c:\hbntbb.exec:\hbntbb.exe88⤵PID:2604
-
\??\c:\vvpjj.exec:\vvpjj.exe89⤵PID:2592
-
\??\c:\jdpvd.exec:\jdpvd.exe90⤵PID:2668
-
\??\c:\xrflflx.exec:\xrflflx.exe91⤵PID:1632
-
\??\c:\tnbhnt.exec:\tnbhnt.exe92⤵PID:1492
-
\??\c:\ttbbnn.exec:\ttbbnn.exe93⤵PID:1792
-
\??\c:\3dvdd.exec:\3dvdd.exe94⤵PID:1548
-
\??\c:\dvppv.exec:\dvppv.exe95⤵PID:1644
-
\??\c:\lxffxff.exec:\lxffxff.exe96⤵PID:2280
-
\??\c:\5xlfrrx.exec:\5xlfrrx.exe97⤵PID:2796
-
\??\c:\5hhhnn.exec:\5hhhnn.exe98⤵PID:1844
-
\??\c:\7bhnbb.exec:\7bhnbb.exe99⤵PID:2464
-
\??\c:\dvvdv.exec:\dvvdv.exe100⤵PID:2196
-
\??\c:\ppdvd.exec:\ppdvd.exe101⤵PID:640
-
\??\c:\3xrrrrx.exec:\3xrrrrx.exe102⤵PID:1412
-
\??\c:\5fxxfxf.exec:\5fxxfxf.exe103⤵PID:1068
-
\??\c:\nnhhht.exec:\nnhhht.exe104⤵PID:1576
-
\??\c:\hbbbnn.exec:\hbbbnn.exe105⤵PID:1012
-
\??\c:\jvdvp.exec:\jvdvp.exe106⤵PID:1796
-
\??\c:\dvjjj.exec:\dvjjj.exe107⤵PID:3060
-
\??\c:\rflrlrr.exec:\rflrlrr.exe108⤵PID:1160
-
\??\c:\tnnhbh.exec:\tnnhbh.exe109⤵PID:920
-
\??\c:\jpdjp.exec:\jpdjp.exe110⤵PID:1364
-
\??\c:\frfllxx.exec:\frfllxx.exe111⤵PID:1940
-
\??\c:\rllrrfl.exec:\rllrrfl.exe112⤵PID:1740
-
\??\c:\thntnn.exec:\thntnn.exe113⤵PID:2764
-
\??\c:\bbnhnn.exec:\bbnhnn.exe114⤵PID:2240
-
\??\c:\vvjvd.exec:\vvjvd.exe115⤵PID:884
-
\??\c:\pjvpp.exec:\pjvpp.exe116⤵PID:2572
-
\??\c:\xlxrrxl.exec:\xlxrrxl.exe117⤵PID:1544
-
\??\c:\httttb.exec:\httttb.exe118⤵PID:1656
-
\??\c:\1tthbb.exec:\1tthbb.exe119⤵PID:1532
-
\??\c:\5dpdp.exec:\5dpdp.exe120⤵PID:2876
-
\??\c:\lfrffxl.exec:\lfrffxl.exe121⤵PID:2792
-
\??\c:\5hbntb.exec:\5hbntb.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-