Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 01:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe
-
Size
335KB
-
MD5
3451a2b089e7fcdb50fa611f83f14a4f
-
SHA1
92e7fd7827f5174a448251c48eb72c6b30603626
-
SHA256
9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12
-
SHA512
af8e00bd3b707c1e06cf64ee1346e2b446f5335bcf7ed4ffd88b9b05698314768b1d93321c744c9a6f797db43d6e44e99b4cb93686fee7e19c0a0c8c98634b79
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4efG:n3C9BRo/CEilXBG2qZSlSFdBXExG
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1732-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral1/memory/1732-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1928-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2844-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2376-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2528-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1356-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1076-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1208-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/940-274-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3004-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1668-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1352-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/344-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2244-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1584-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2016-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2376-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2844-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1928 tntbbn.exe 3056 vjddj.exe 2736 9fllxxf.exe 2788 rfffffl.exe 2844 dvpvj.exe 2376 jdjjv.exe 2528 frxxlfl.exe 2016 hbbhtb.exe 1356 jdjpp.exe 2696 llfrffr.exe 1584 hbbtbt.exe 1008 5bbnnt.exe 2244 pdppd.exe 344 xxrxrrl.exe 1352 xxrxxxf.exe 1172 nnnbth.exe 2040 7vdjj.exe 2948 rlfxrlx.exe 1668 7rrfrrx.exe 1728 5ntbnt.exe 664 7jvpv.exe 1412 9fllffl.exe 572 hthbbh.exe 1076 jvvdd.exe 2328 lfrrxxx.exe 684 lfrrflr.exe 3004 nbntbh.exe 940 pdpjp.exe 1816 xxrxflx.exe 1932 tntbbb.exe 1208 1bttbn.exe 1520 vpdjp.exe 2264 rfllfxx.exe 2564 7frlllr.exe 2404 3nbbnt.exe 2588 nhtbnt.exe 1936 dvpvp.exe 2620 lxlrxrf.exe 2436 1bhnnt.exe 2744 nhntbh.exe 2300 vdvdd.exe 2528 9dvvv.exe 2692 lfxlxfr.exe 2640 7ffrxfl.exe 1340 nbhbbb.exe 1776 bththt.exe 2148 9jpvv.exe 2500 jvdjj.exe 1196 lrxxfff.exe 2344 5ttbhh.exe 1228 nbnbhh.exe 2984 1btbhn.exe 2204 ppjvd.exe 1880 xlrlfxf.exe 1612 9xllrxf.exe 2892 5thnhn.exe 1704 nhnhbb.exe 1604 vpddj.exe 1812 ffrfrxf.exe 2452 xxrxxrf.exe 832 tbhhnh.exe 2348 hhtbhn.exe 2296 vvjjj.exe 744 9jjdj.exe -
resource yara_rule behavioral1/memory/1732-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-22-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1928 1732 9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe 28 PID 1732 wrote to memory of 1928 1732 9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe 28 PID 1732 wrote to memory of 1928 1732 9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe 28 PID 1732 wrote to memory of 1928 1732 9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe 28 PID 1928 wrote to memory of 3056 1928 tntbbn.exe 29 PID 1928 wrote to memory of 3056 1928 tntbbn.exe 29 PID 1928 wrote to memory of 3056 1928 tntbbn.exe 29 PID 1928 wrote to memory of 3056 1928 tntbbn.exe 29 PID 3056 wrote to memory of 2736 3056 vjddj.exe 30 PID 3056 wrote to memory of 2736 3056 vjddj.exe 30 PID 3056 wrote to memory of 2736 3056 vjddj.exe 30 PID 3056 wrote to memory of 2736 3056 vjddj.exe 30 PID 2736 wrote to memory of 2788 2736 9fllxxf.exe 31 PID 2736 wrote to memory of 2788 2736 9fllxxf.exe 31 PID 2736 wrote to memory of 2788 2736 9fllxxf.exe 31 PID 2736 wrote to memory of 2788 2736 9fllxxf.exe 31 PID 2788 wrote to memory of 2844 2788 rfffffl.exe 32 PID 2788 wrote to memory of 2844 2788 rfffffl.exe 32 PID 2788 wrote to memory of 2844 2788 rfffffl.exe 32 PID 2788 wrote to memory of 2844 2788 rfffffl.exe 32 PID 2844 wrote to memory of 2376 2844 dvpvj.exe 33 PID 2844 wrote to memory of 2376 2844 dvpvj.exe 33 PID 2844 wrote to memory of 2376 2844 dvpvj.exe 33 PID 2844 wrote to memory of 2376 2844 dvpvj.exe 33 PID 2376 wrote to memory of 2528 2376 jdjjv.exe 34 PID 2376 wrote to memory of 2528 2376 jdjjv.exe 34 PID 2376 wrote to memory of 2528 2376 jdjjv.exe 34 PID 2376 wrote to memory of 2528 2376 jdjjv.exe 34 PID 2528 wrote to memory of 2016 2528 frxxlfl.exe 35 PID 2528 wrote to memory of 2016 2528 frxxlfl.exe 35 PID 2528 wrote to memory of 2016 2528 frxxlfl.exe 35 PID 2528 wrote to memory of 2016 2528 frxxlfl.exe 35 PID 2016 wrote to memory of 1356 2016 hbbhtb.exe 36 PID 2016 wrote to memory of 1356 2016 hbbhtb.exe 36 PID 2016 wrote to memory of 1356 2016 hbbhtb.exe 36 PID 2016 wrote to memory of 1356 2016 hbbhtb.exe 36 PID 1356 wrote to memory of 2696 1356 jdjpp.exe 37 PID 1356 wrote to memory of 2696 1356 jdjpp.exe 37 PID 1356 wrote to memory of 2696 1356 jdjpp.exe 37 PID 1356 wrote to memory of 2696 1356 jdjpp.exe 37 PID 2696 wrote to memory of 1584 2696 llfrffr.exe 38 PID 2696 wrote to memory of 1584 2696 llfrffr.exe 38 PID 2696 wrote to memory of 1584 2696 llfrffr.exe 38 PID 2696 wrote to memory of 1584 2696 llfrffr.exe 38 PID 1584 wrote to memory of 1008 1584 hbbtbt.exe 39 PID 1584 wrote to memory of 1008 1584 hbbtbt.exe 39 PID 1584 wrote to memory of 1008 1584 hbbtbt.exe 39 PID 1584 wrote to memory of 1008 1584 hbbtbt.exe 39 PID 1008 wrote to memory of 2244 1008 5bbnnt.exe 116 PID 1008 wrote to memory of 2244 1008 5bbnnt.exe 116 PID 1008 wrote to memory of 2244 1008 5bbnnt.exe 116 PID 1008 wrote to memory of 2244 1008 5bbnnt.exe 116 PID 2244 wrote to memory of 344 2244 pdppd.exe 41 PID 2244 wrote to memory of 344 2244 pdppd.exe 41 PID 2244 wrote to memory of 344 2244 pdppd.exe 41 PID 2244 wrote to memory of 344 2244 pdppd.exe 41 PID 344 wrote to memory of 1352 344 xxrxrrl.exe 42 PID 344 wrote to memory of 1352 344 xxrxrrl.exe 42 PID 344 wrote to memory of 1352 344 xxrxrrl.exe 42 PID 344 wrote to memory of 1352 344 xxrxrrl.exe 42 PID 1352 wrote to memory of 1172 1352 xxrxxxf.exe 43 PID 1352 wrote to memory of 1172 1352 xxrxxxf.exe 43 PID 1352 wrote to memory of 1172 1352 xxrxxxf.exe 43 PID 1352 wrote to memory of 1172 1352 xxrxxxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe"C:\Users\Admin\AppData\Local\Temp\9e983a288cff68d96b789d23f1c7263863e80a5ddcb000b87d06d47a53b7ea12.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\tntbbn.exec:\tntbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\vjddj.exec:\vjddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\9fllxxf.exec:\9fllxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\rfffffl.exec:\rfffffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dvpvj.exec:\dvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jdjjv.exec:\jdjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\frxxlfl.exec:\frxxlfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\hbbhtb.exec:\hbbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jdjpp.exec:\jdjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\llfrffr.exec:\llfrffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\hbbtbt.exec:\hbbtbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\5bbnnt.exec:\5bbnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\pdppd.exec:\pdppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xxrxrrl.exec:\xxrxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\xxrxxxf.exec:\xxrxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\nnnbth.exec:\nnnbth.exe17⤵
- Executes dropped EXE
PID:1172 -
\??\c:\7vdjj.exec:\7vdjj.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rlfxrlx.exec:\rlfxrlx.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7rrfrrx.exec:\7rrfrrx.exe20⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5ntbnt.exec:\5ntbnt.exe21⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7jvpv.exec:\7jvpv.exe22⤵
- Executes dropped EXE
PID:664 -
\??\c:\9fllffl.exec:\9fllffl.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\hthbbh.exec:\hthbbh.exe24⤵
- Executes dropped EXE
PID:572 -
\??\c:\jvvdd.exec:\jvvdd.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lfrrflr.exec:\lfrrflr.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\nbntbh.exec:\nbntbh.exe28⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdpjp.exec:\pdpjp.exe29⤵
- Executes dropped EXE
PID:940 -
\??\c:\xxrxflx.exec:\xxrxflx.exe30⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tntbbb.exec:\tntbbb.exe31⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1bttbn.exec:\1bttbn.exe32⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vpdjp.exec:\vpdjp.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rfllfxx.exec:\rfllfxx.exe34⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7frlllr.exec:\7frlllr.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3nbbnt.exec:\3nbbnt.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nhtbnt.exec:\nhtbnt.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dvpvp.exec:\dvpvp.exe38⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lxlrxrf.exec:\lxlrxrf.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1bhnnt.exec:\1bhnnt.exe40⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nhntbh.exec:\nhntbh.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vdvdd.exec:\vdvdd.exe42⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9dvvv.exec:\9dvvv.exe43⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7ffrxfl.exec:\7ffrxfl.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nbhbbb.exec:\nbhbbb.exe46⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bththt.exec:\bththt.exe47⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9jpvv.exec:\9jpvv.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jvdjj.exec:\jvdjj.exe49⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lrxxfff.exec:\lrxxfff.exe50⤵
- Executes dropped EXE
PID:1196 -
\??\c:\5ttbhh.exec:\5ttbhh.exe51⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nbnbhh.exec:\nbnbhh.exe52⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1btbhn.exec:\1btbhn.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ppjvd.exec:\ppjvd.exe54⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xlrlfxf.exec:\xlrlfxf.exe55⤵
- Executes dropped EXE
PID:1880 -
\??\c:\9xllrxf.exec:\9xllrxf.exe56⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5thnhn.exec:\5thnhn.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nhnhbb.exec:\nhnhbb.exe58⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vpddj.exec:\vpddj.exe59⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe60⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xxrxxrf.exec:\xxrxxrf.exe61⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tbhhnh.exec:\tbhhnh.exe62⤵
- Executes dropped EXE
PID:832 -
\??\c:\hhtbhn.exec:\hhtbhn.exe63⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vvjjj.exec:\vvjjj.exe64⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9jjdj.exec:\9jjdj.exe65⤵
- Executes dropped EXE
PID:744 -
\??\c:\rfxrxlf.exec:\rfxrxlf.exe66⤵PID:1680
-
\??\c:\frxrxlx.exec:\frxrxlx.exe67⤵PID:1236
-
\??\c:\tnhntt.exec:\tnhntt.exe68⤵PID:2824
-
\??\c:\7hhntt.exec:\7hhntt.exe69⤵PID:880
-
\??\c:\dvppd.exec:\dvppd.exe70⤵PID:2084
-
\??\c:\ddjjp.exec:\ddjjp.exe71⤵PID:2412
-
\??\c:\xrlrllr.exec:\xrlrllr.exe72⤵PID:2096
-
\??\c:\lflfrrf.exec:\lflfrrf.exe73⤵PID:2584
-
\??\c:\hhbhbt.exec:\hhbhbt.exe74⤵PID:2316
-
\??\c:\1nhntn.exec:\1nhntn.exe75⤵PID:2560
-
\??\c:\1jpvj.exec:\1jpvj.exe76⤵PID:2732
-
\??\c:\pjppv.exec:\pjppv.exe77⤵PID:2476
-
\??\c:\fxlllrx.exec:\fxlllrx.exe78⤵PID:2628
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe79⤵PID:2660
-
\??\c:\rfrrfxl.exec:\rfrrfxl.exe80⤵PID:2132
-
\??\c:\bntttt.exec:\bntttt.exe81⤵PID:2520
-
\??\c:\1nhhtn.exec:\1nhhtn.exe82⤵PID:2496
-
\??\c:\ddddd.exec:\ddddd.exe83⤵PID:1756
-
\??\c:\ddddj.exec:\ddddj.exe84⤵PID:2528
-
\??\c:\xlffrrx.exec:\xlffrrx.exe85⤵PID:2700
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe86⤵PID:2632
-
\??\c:\htbbtt.exec:\htbbtt.exe87⤵PID:2704
-
\??\c:\thtnnn.exec:\thtnnn.exe88⤵PID:1772
-
\??\c:\pjddj.exec:\pjddj.exe89⤵PID:1452
-
\??\c:\pdpjd.exec:\pdpjd.exe90⤵PID:2244
-
\??\c:\jjddp.exec:\jjddp.exe91⤵PID:1116
-
\??\c:\lxlrflx.exec:\lxlrflx.exe92⤵PID:2044
-
\??\c:\1lxxffr.exec:\1lxxffr.exe93⤵PID:2380
-
\??\c:\bnhhnb.exec:\bnhhnb.exe94⤵PID:2760
-
\??\c:\3bhnhn.exec:\3bhnhn.exe95⤵PID:2032
-
\??\c:\5jddd.exec:\5jddd.exe96⤵PID:2772
-
\??\c:\pjvdj.exec:\pjvdj.exe97⤵PID:764
-
\??\c:\3lllrff.exec:\3lllrff.exe98⤵PID:688
-
\??\c:\fxrxrrf.exec:\fxrxrrf.exe99⤵PID:640
-
\??\c:\fxrxfxl.exec:\fxrxfxl.exe100⤵PID:1676
-
\??\c:\9htbhn.exec:\9htbhn.exe101⤵PID:2336
-
\??\c:\tnnnnt.exec:\tnnnnt.exe102⤵PID:1016
-
\??\c:\dvpdj.exec:\dvpdj.exe103⤵PID:1076
-
\??\c:\pjddj.exec:\pjddj.exe104⤵PID:920
-
\??\c:\5rlxxlx.exec:\5rlxxlx.exe105⤵PID:1556
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe106⤵PID:2252
-
\??\c:\tnhhnn.exec:\tnhhnn.exe107⤵PID:936
-
\??\c:\thnbth.exec:\thnbth.exe108⤵PID:1868
-
\??\c:\3vddd.exec:\3vddd.exe109⤵PID:1900
-
\??\c:\pjvpd.exec:\pjvpd.exe110⤵PID:2008
-
\??\c:\rrflllr.exec:\rrflllr.exe111⤵PID:1464
-
\??\c:\fxlfllr.exec:\fxlfllr.exe112⤵PID:2868
-
\??\c:\xrflllr.exec:\xrflllr.exe113⤵PID:1496
-
\??\c:\9bbtbb.exec:\9bbtbb.exe114⤵PID:2648
-
\??\c:\hbtbnn.exec:\hbtbnn.exe115⤵PID:2564
-
\??\c:\vpjjp.exec:\vpjjp.exe116⤵PID:2572
-
\??\c:\dvjpj.exec:\dvjpj.exe117⤵PID:2836
-
\??\c:\frfxflr.exec:\frfxflr.exe118⤵PID:2592
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe119⤵PID:2456
-
\??\c:\xrflxxf.exec:\xrflxxf.exe120⤵PID:1524
-
\??\c:\bthnbh.exec:\bthnbh.exe121⤵PID:2656
-
\??\c:\hbtbhh.exec:\hbtbhh.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-