Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 00:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe
-
Size
192KB
-
MD5
36ef18928d4b97ce244315c0a6ec4d49
-
SHA1
5fe5371c3002cacaa95fd17e8d339c4f346c277e
-
SHA256
ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069
-
SHA512
ecd05ddf6bf9314f7ba6d3cbf24924ceb64d8a9f913b05eaf53c028a11389122b42339ac7eb2a897d03dedb22afbf5f0e976c11f6ad7d746c9c1be582f8237ba
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+3Q:Ycm4FmowdHoSLEaTBftapTsyFeO3Q
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2364-13-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2036-8-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1628-32-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2620-56-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2676-41-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2488-73-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2632-82-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2852-116-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2716-128-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2912-125-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1692-147-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2976-227-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2364-305-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2512-366-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2500-911-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1520-1152-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1656-990-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/380-744-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1196-545-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2984-520-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2540-376-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2960-374-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2664-359-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2756-350-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2328-324-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2184-287-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2192-252-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2436-229-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1428-218-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/372-200-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/864-180-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1664-145-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1616-107-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2016-28-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2036-0-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2036-6-0x0000000000260000-0x0000000000290000-memory.dmp UPX behavioral1/memory/2364-13-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x000b000000012301-11.dat UPX behavioral1/memory/2036-8-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x00360000000167e8-19.dat UPX behavioral1/memory/2016-20-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0008000000016c5b-30.dat UPX behavioral1/memory/1628-32-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0007000000016ccd-37.dat UPX behavioral1/files/0x0007000000016cf2-46.dat UPX behavioral1/files/0x0007000000016d01-57.dat UPX behavioral1/files/0x0009000000016d19-64.dat UPX behavioral1/memory/2620-56-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2676-41-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2488-73-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x000700000001708c-74.dat UPX behavioral1/memory/2632-82-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x00060000000171ad-83.dat UPX behavioral1/files/0x000600000001738f-99.dat UPX behavioral1/files/0x00060000000173e5-117.dat UPX behavioral1/memory/2852-116-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0006000000017436-126.dat UPX behavioral1/memory/2716-128-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2912-125-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1692-147-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x00060000000175f7-154.dat UPX behavioral1/files/0x00060000000175fd-163.dat UPX behavioral1/files/0x0006000000017603-171.dat UPX behavioral1/files/0x000d000000018689-181.dat UPX behavioral1/memory/748-182-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x00050000000186a2-191.dat UPX behavioral1/files/0x000500000001870e-202.dat UPX behavioral1/files/0x000500000001871c-210.dat UPX behavioral1/memory/2976-227-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/files/0x0005000000019276-262.dat UPX behavioral1/files/0x000500000001928e-279.dat UPX behavioral1/files/0x000500000001937a-290.dat UPX behavioral1/memory/2364-305-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2756-343-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2960-367-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2512-366-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1192-401-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1552-597-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2500-624-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1888-668-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2820-661-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2876-687-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/692-731-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2116-868-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2500-911-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/320-997-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/812-1024-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1716-1079-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1520-1152-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2288-1177-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2836-1004-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1656-990-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/380-744-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1664-712-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2992-590-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/2188-571-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1196-545-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/540-532-0x0000000000400000-0x0000000000430000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2364 hbbhhn.exe 2016 nnbhtn.exe 1628 fxrxrrf.exe 2676 xxflrlr.exe 2620 bthntn.exe 2580 3tnnbb.exe 2488 ppjdj.exe 2632 rlxrrrf.exe 2484 lflrxlr.exe 3024 jjpdv.exe 1616 jdvjv.exe 2852 lllxrfx.exe 2912 tbnbhn.exe 2716 hbttnt.exe 1664 pjvdj.exe 1692 7llrxxl.exe 2772 nhhtht.exe 2780 vpjvd.exe 864 jjdjp.exe 748 xrlrrxf.exe 372 hbhntb.exe 2124 hbthtb.exe 1428 7jdvv.exe 2976 fxlrxfr.exe 2436 fxxrflf.exe 1516 thtthh.exe 2192 jdddv.exe 1712 lrrfrlr.exe 2344 7rllxxf.exe 1508 hhthnt.exe 2184 hbnhtn.exe 892 jdpvj.exe 2036 frllxrx.exe 2364 rlfflxf.exe 2660 bnbtbh.exe 2328 ttnnbb.exe 1560 7dvvv.exe 2700 vpppd.exe 2672 3lxxxxf.exe 2756 9fxlxlx.exe 2664 nntbhb.exe 2512 jdvdp.exe 2960 jdpdj.exe 2540 rrxxfxl.exe 2692 fxrxxfl.exe 1660 3bnnnn.exe 2848 1nhtbh.exe 1192 3dvjv.exe 2924 ppjvj.exe 3016 3lxrllr.exe 1656 lflxrlx.exe 1664 tttthb.exe 2816 hbnnbn.exe 2784 jvpjp.exe 2772 jdjjd.exe 1596 lflflxl.exe 864 1xflxfr.exe 2656 fxllrlr.exe 2800 htnntb.exe 1156 bnbthn.exe 1320 ppdpj.exe 1988 dvdjv.exe 1428 9lxxllr.exe 2052 xxrxlxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2364 2036 ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe 61 PID 2036 wrote to memory of 2364 2036 ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe 61 PID 2036 wrote to memory of 2364 2036 ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe 61 PID 2036 wrote to memory of 2364 2036 ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe 61 PID 2364 wrote to memory of 2016 2364 hbbhhn.exe 195 PID 2364 wrote to memory of 2016 2364 hbbhhn.exe 195 PID 2364 wrote to memory of 2016 2364 hbbhhn.exe 195 PID 2364 wrote to memory of 2016 2364 hbbhhn.exe 195 PID 2016 wrote to memory of 1628 2016 nnbhtn.exe 30 PID 2016 wrote to memory of 1628 2016 nnbhtn.exe 30 PID 2016 wrote to memory of 1628 2016 nnbhtn.exe 30 PID 2016 wrote to memory of 1628 2016 nnbhtn.exe 30 PID 1628 wrote to memory of 2676 1628 fxrxrrf.exe 31 PID 1628 wrote to memory of 2676 1628 fxrxrrf.exe 31 PID 1628 wrote to memory of 2676 1628 fxrxrrf.exe 31 PID 1628 wrote to memory of 2676 1628 fxrxrrf.exe 31 PID 2676 wrote to memory of 2620 2676 xxflrlr.exe 199 PID 2676 wrote to memory of 2620 2676 xxflrlr.exe 199 PID 2676 wrote to memory of 2620 2676 xxflrlr.exe 199 PID 2676 wrote to memory of 2620 2676 xxflrlr.exe 199 PID 2620 wrote to memory of 2580 2620 bthntn.exe 111 PID 2620 wrote to memory of 2580 2620 bthntn.exe 111 PID 2620 wrote to memory of 2580 2620 bthntn.exe 111 PID 2620 wrote to memory of 2580 2620 bthntn.exe 111 PID 2580 wrote to memory of 2488 2580 3tnnbb.exe 251 PID 2580 wrote to memory of 2488 2580 3tnnbb.exe 251 PID 2580 wrote to memory of 2488 2580 3tnnbb.exe 251 PID 2580 wrote to memory of 2488 2580 3tnnbb.exe 251 PID 2488 wrote to memory of 2632 2488 ppjdj.exe 35 PID 2488 wrote to memory of 2632 2488 ppjdj.exe 35 PID 2488 wrote to memory of 2632 2488 ppjdj.exe 35 PID 2488 wrote to memory of 2632 2488 ppjdj.exe 35 PID 2632 wrote to memory of 2484 2632 rlxrrrf.exe 36 PID 2632 wrote to memory of 2484 2632 rlxrrrf.exe 36 PID 2632 wrote to memory of 2484 2632 rlxrrrf.exe 36 PID 2632 wrote to memory of 2484 2632 rlxrrrf.exe 36 PID 2484 wrote to memory of 3024 2484 lflrxlr.exe 37 PID 2484 wrote to memory of 3024 2484 lflrxlr.exe 37 PID 2484 wrote to memory of 3024 2484 lflrxlr.exe 37 PID 2484 wrote to memory of 3024 2484 lflrxlr.exe 37 PID 3024 wrote to memory of 1616 3024 jjpdv.exe 254 PID 3024 wrote to memory of 1616 3024 jjpdv.exe 254 PID 3024 wrote to memory of 1616 3024 jjpdv.exe 254 PID 3024 wrote to memory of 1616 3024 jjpdv.exe 254 PID 1616 wrote to memory of 2852 1616 jdvjv.exe 213 PID 1616 wrote to memory of 2852 1616 jdvjv.exe 213 PID 1616 wrote to memory of 2852 1616 jdvjv.exe 213 PID 1616 wrote to memory of 2852 1616 jdvjv.exe 213 PID 2852 wrote to memory of 2912 2852 lllxrfx.exe 40 PID 2852 wrote to memory of 2912 2852 lllxrfx.exe 40 PID 2852 wrote to memory of 2912 2852 lllxrfx.exe 40 PID 2852 wrote to memory of 2912 2852 lllxrfx.exe 40 PID 2912 wrote to memory of 2716 2912 tbnbhn.exe 41 PID 2912 wrote to memory of 2716 2912 tbnbhn.exe 41 PID 2912 wrote to memory of 2716 2912 tbnbhn.exe 41 PID 2912 wrote to memory of 2716 2912 tbnbhn.exe 41 PID 2716 wrote to memory of 1664 2716 hbttnt.exe 124 PID 2716 wrote to memory of 1664 2716 hbttnt.exe 124 PID 2716 wrote to memory of 1664 2716 hbttnt.exe 124 PID 2716 wrote to memory of 1664 2716 hbttnt.exe 124 PID 1664 wrote to memory of 1692 1664 pjvdj.exe 43 PID 1664 wrote to memory of 1692 1664 pjvdj.exe 43 PID 1664 wrote to memory of 1692 1664 pjvdj.exe 43 PID 1664 wrote to memory of 1692 1664 pjvdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe"C:\Users\Admin\AppData\Local\Temp\ac9f6231276a5ab76fc16a4200f3de4f6a49c0d087e62eacffa61aaa010cc069.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hbbhhn.exec:\hbbhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\nnbhtn.exec:\nnbhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\xxflrlr.exec:\xxflrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bthntn.exec:\bthntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3tnnbb.exec:\3tnnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ppjdj.exec:\ppjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\lflrxlr.exec:\lflrxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\jjpdv.exec:\jjpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jdvjv.exec:\jdvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\lllxrfx.exec:\lllxrfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\tbnbhn.exec:\tbnbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hbttnt.exec:\hbttnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pjvdj.exec:\pjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\7llrxxl.exec:\7llrxxl.exe17⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhhtht.exec:\nhhtht.exe18⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpjvd.exec:\vpjvd.exe19⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jjdjp.exec:\jjdjp.exe20⤵
- Executes dropped EXE
PID:864 -
\??\c:\xrlrrxf.exec:\xrlrrxf.exe21⤵
- Executes dropped EXE
PID:748 -
\??\c:\hbhntb.exec:\hbhntb.exe22⤵
- Executes dropped EXE
PID:372 -
\??\c:\hbthtb.exec:\hbthtb.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7jdvv.exec:\7jdvv.exe24⤵
- Executes dropped EXE
PID:1428 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe25⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fxxrflf.exec:\fxxrflf.exe26⤵
- Executes dropped EXE
PID:2436 -
\??\c:\thtthh.exec:\thtthh.exe27⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jdddv.exec:\jdddv.exe28⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lrrfrlr.exec:\lrrfrlr.exe29⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7rllxxf.exec:\7rllxxf.exe30⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhthnt.exec:\hhthnt.exe31⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hbnhtn.exec:\hbnhtn.exe32⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jdpvj.exec:\jdpvj.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\frllxrx.exec:\frllxrx.exe34⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rlfflxf.exec:\rlfflxf.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bnbtbh.exec:\bnbtbh.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ttnnbb.exec:\ttnnbb.exe37⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7dvvv.exec:\7dvvv.exe38⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vpppd.exec:\vpppd.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3lxxxxf.exec:\3lxxxxf.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9fxlxlx.exec:\9fxlxlx.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nntbhb.exec:\nntbhb.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdvdp.exec:\jdvdp.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jdpdj.exec:\jdpdj.exe44⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rrxxfxl.exec:\rrxxfxl.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3bnnnn.exec:\3bnnnn.exe47⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1nhtbh.exec:\1nhtbh.exe48⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3dvjv.exec:\3dvjv.exe49⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ppjvj.exec:\ppjvj.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3lxrllr.exec:\3lxrllr.exe51⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lflxrlx.exec:\lflxrlx.exe52⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tttthb.exec:\tttthb.exe53⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbnnbn.exec:\hbnnbn.exe54⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jvpjp.exec:\jvpjp.exe55⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jdjjd.exec:\jdjjd.exe56⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lflflxl.exec:\lflflxl.exe57⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1xflxfr.exec:\1xflxfr.exe58⤵
- Executes dropped EXE
PID:864 -
\??\c:\fxllrlr.exec:\fxllrlr.exe59⤵
- Executes dropped EXE
PID:2656 -
\??\c:\htnntb.exec:\htnntb.exe60⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bnbthn.exec:\bnbthn.exe61⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ppdpj.exec:\ppdpj.exe62⤵
- Executes dropped EXE
PID:1320 -
\??\c:\dvdjv.exec:\dvdjv.exe63⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9lxxllr.exec:\9lxxllr.exe64⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe65⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rlllffx.exec:\rlllffx.exe66⤵PID:1592
-
\??\c:\bbtbhh.exec:\bbtbhh.exe67⤵PID:1348
-
\??\c:\nbtttt.exec:\nbtttt.exe68⤵PID:2984
-
\??\c:\jpvvd.exec:\jpvvd.exe69⤵PID:2428
-
\??\c:\pppjp.exec:\pppjp.exe70⤵PID:540
-
\??\c:\1pjjv.exec:\1pjjv.exe71⤵PID:1196
-
\??\c:\xrrlxlx.exec:\xrrlxlx.exe72⤵PID:2980
-
\??\c:\lxlrffr.exec:\lxlrffr.exe73⤵PID:2256
-
\??\c:\bnttbh.exec:\bnttbh.exe74⤵PID:2184
-
\??\c:\bhbbbt.exec:\bhbbbt.exe75⤵PID:1312
-
\??\c:\ddpdj.exec:\ddpdj.exe76⤵PID:2188
-
\??\c:\dvpvp.exec:\dvpvp.exe77⤵PID:1432
-
\??\c:\3lfxlfl.exec:\3lfxlfl.exe78⤵PID:2116
-
\??\c:\rxxxffl.exec:\rxxxffl.exe79⤵PID:2992
-
\??\c:\tttbbb.exec:\tttbbb.exe80⤵PID:1552
-
\??\c:\btbntb.exec:\btbntb.exe81⤵PID:2748
-
\??\c:\1hnbtt.exec:\1hnbtt.exe82⤵PID:1484
-
\??\c:\vvpdj.exec:\vvpdj.exe83⤵PID:1732
-
\??\c:\lfrxllr.exec:\lfrxllr.exe84⤵PID:2500
-
\??\c:\rrllxxr.exec:\rrllxxr.exe85⤵PID:2580
-
\??\c:\hbnthn.exec:\hbnthn.exe86⤵PID:2664
-
\??\c:\hhthbh.exec:\hhthbh.exe87⤵PID:2512
-
\??\c:\tnbnbb.exec:\tnbnbb.exe88⤵PID:2616
-
\??\c:\vpdjp.exec:\vpdjp.exe89⤵PID:2600
-
\??\c:\jjjjp.exec:\jjjjp.exe90⤵PID:2820
-
\??\c:\rlxlrfx.exec:\rlxlrfx.exe91⤵PID:1888
-
\??\c:\fffllrf.exec:\fffllrf.exe92⤵PID:2896
-
\??\c:\fxfxffl.exec:\fxfxffl.exe93⤵PID:2908
-
\??\c:\5bntbh.exec:\5bntbh.exe94⤵PID:2876
-
\??\c:\nhthtb.exec:\nhthtb.exe95⤵PID:2532
-
\??\c:\5vddv.exec:\5vddv.exe96⤵PID:1036
-
\??\c:\vpddp.exec:\vpddp.exe97⤵PID:1656
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe98⤵PID:1664
-
\??\c:\xxlxflr.exec:\xxlxflr.exe99⤵PID:2816
-
\??\c:\bbtthn.exec:\bbtthn.exe100⤵PID:1248
-
\??\c:\hbthtt.exec:\hbthtt.exe101⤵PID:692
-
\??\c:\hbtnbb.exec:\hbtnbb.exe102⤵PID:380
-
\??\c:\jdjjp.exec:\jdjjp.exe103⤵PID:2636
-
\??\c:\pppjp.exec:\pppjp.exe104⤵PID:2656
-
\??\c:\llfrflx.exec:\llfrflx.exe105⤵PID:3048
-
\??\c:\lxlllxf.exec:\lxlllxf.exe106⤵PID:2452
-
\??\c:\5bthtb.exec:\5bthtb.exe107⤵PID:3000
-
\??\c:\hbntbb.exec:\hbntbb.exe108⤵PID:2792
-
\??\c:\vppdv.exec:\vppdv.exe109⤵PID:2964
-
\??\c:\djjdd.exec:\djjdd.exe110⤵PID:2444
-
\??\c:\xlrllff.exec:\xlrllff.exe111⤵PID:1576
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe112⤵PID:1368
-
\??\c:\xxxxlxl.exec:\xxxxlxl.exe113⤵PID:852
-
\??\c:\bhnhnh.exec:\bhnhnh.exe114⤵PID:904
-
\??\c:\hnbtbt.exec:\hnbtbt.exe115⤵PID:1860
-
\??\c:\jdvvd.exec:\jdvvd.exe116⤵PID:2392
-
\??\c:\jpvpp.exec:\jpvpp.exe117⤵PID:568
-
\??\c:\ffxfxrx.exec:\ffxfxrx.exe118⤵PID:1240
-
\??\c:\lrrrrlr.exec:\lrrrrlr.exe119⤵PID:1244
-
\??\c:\fxlxfrx.exec:\fxlxfrx.exe120⤵PID:2008
-
\??\c:\nnbbhn.exec:\nnbbhn.exe121⤵PID:2164
-
\??\c:\7hbtbh.exec:\7hbtbh.exe122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-