Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 20:28
Behavioral task
behavioral1
Sample
28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe
-
Size
442KB
-
MD5
cd428cbbb2fcd11a7f5daa5fbbec03c0
-
SHA1
9598c25e448e22afa8e02f858f9d404c7a8df446
-
SHA256
28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557
-
SHA512
63a35385f9c39d2cbf5feb9ad76790af834aa6b57256f58fe87950b5a1ed66926a2dcd3155937ef2695679d5284b22210549ad3cb36d0c1bad9301c12981bee4
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wlup:UrR/nPQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2972-7-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2836-36-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2812-27-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2428-18-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2864-63-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2184-148-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1692-167-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2856-192-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2632-302-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2808-316-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2792-323-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2296-330-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2684-337-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2536-344-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2832-352-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2832-359-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2584-366-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1248-380-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2400-387-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1684-394-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2940-403-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2868-401-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1552-373-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2572-351-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2696-309-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2444-293-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1584-284-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/980-275-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2028-266-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2464-257-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3024-248-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3024-242-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1028-238-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/896-228-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1688-219-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1812-210-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2364-201-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2856-191-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2288-183-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1692-174-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/556-164-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2184-155-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1396-145-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1492-128-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1924-119-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1924-113-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1972-109-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2920-100-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1144-91-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1340-81-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2940-409-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2592-72-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2968-54-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2984-45-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/584-416-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1396-417-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1396-424-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2912-431-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2300-432-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2300-440-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2288-450-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1712-449-0x0000000000250000-0x00000000002DC000-memory.dmp family_blackmoon behavioral1/memory/1712-448-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2288-453-0x0000000001D40000-0x0000000001DCC000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2428 vjvpv.exe 2812 btbhbb.exe 2836 9jvdp.exe 2984 7lxxffl.exe 2968 5bnhhb.exe 2864 jddjp.exe 2592 xrlfflx.exe 1340 bttnth.exe 1144 jjjdj.exe 2920 frfxxlf.exe 1972 hbnbtt.exe 1924 pdjvv.exe 1492 llxxxxl.exe 2740 ntbbtn.exe 1396 lrfxxrr.exe 2184 ttnthn.exe 556 jdppv.exe 1692 frffllr.exe 2288 pjpvd.exe 2856 ffrlrll.exe 2364 thbbhh.exe 1812 lxxrrrf.exe 1688 hnhhnn.exe 896 fffxfrl.exe 1028 bbbtbn.exe 3024 fxxfxlf.exe 2464 bthhnn.exe 2028 ffrflff.exe 980 dpvvd.exe 1584 fflxlfl.exe 2444 thnntt.exe 2632 rrlxlrf.exe 2696 bhbtnh.exe 2808 9jddj.exe 2792 lxflxxf.exe 2296 ppddj.exe 2684 lfrrflr.exe 2536 thttht.exe 2572 ddpvv.exe 2832 hhntbh.exe 2584 1ddjv.exe 1552 9ffxlff.exe 1248 vdvpj.exe 2400 llflrll.exe 1684 tnnntb.exe 2868 dpdpv.exe 2940 9hbnbh.exe 584 tttbnh.exe 1396 9bbntb.exe 2912 bbnhnh.exe 2300 3dpjp.exe 1712 3ntthh.exe 2288 htbhhn.exe 2392 pjdpd.exe 2364 tnnbnb.exe 404 hnntnt.exe 1688 dddvp.exe 2088 lxxxrrr.exe 2388 bthhhb.exe 1952 vvpdp.exe 1448 ttnnhb.exe 2464 ddjpj.exe 904 lrlxrxx.exe 980 9tntbh.exe -
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2972-7-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000d000000012731-9.dat upx behavioral1/memory/2428-12-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0007000000016cc3-20.dat upx behavioral1/files/0x0007000000016cf0-29.dat upx behavioral1/files/0x0007000000016d19-38.dat upx behavioral1/memory/2836-36-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2812-27-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2812-26-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2428-18-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0009000000016d2a-47.dat upx behavioral1/files/0x0008000000016d32-56.dat upx behavioral1/memory/2864-63-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001935d-74.dat upx behavioral1/memory/2972-85-0x0000000000490000-0x000000000051C000-memory.dmp upx behavioral1/files/0x0005000000019415-111.dat upx behavioral1/files/0x000500000001942a-130.dat upx behavioral1/files/0x0005000000019434-137.dat upx behavioral1/memory/2184-148-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1692-167-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001945d-175.dat upx behavioral1/files/0x0005000000019460-185.dat upx behavioral1/memory/2856-192-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0015000000016aa6-203.dat upx behavioral1/files/0x00050000000194bb-211.dat upx behavioral1/files/0x00050000000194d1-221.dat upx behavioral1/memory/1028-231-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001951e-240.dat upx behavioral1/files/0x0005000000019a54-295.dat upx behavioral1/memory/2632-302-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2808-316-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2792-323-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2296-330-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2684-337-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2536-344-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2832-352-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2832-359-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2584-366-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1248-380-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2400-387-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1684-394-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2868-400-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2940-403-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2868-401-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1552-373-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2572-351-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2696-309-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2444-293-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001979c-286.dat upx behavioral1/memory/1584-284-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001962d-277.dat upx behavioral1/memory/980-275-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001962c-268.dat upx behavioral1/memory/2028-266-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0005000000019624-259.dat upx behavioral1/memory/2464-257-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0005000000019622-250.dat upx behavioral1/memory/3024-248-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/3024-242-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1028-238-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x00050000000194f1-230.dat upx behavioral1/memory/896-228-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1688-219-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2428 2972 28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe 31 PID 2972 wrote to memory of 2428 2972 28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe 31 PID 2972 wrote to memory of 2428 2972 28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe 31 PID 2972 wrote to memory of 2428 2972 28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe 31 PID 2428 wrote to memory of 2812 2428 vjvpv.exe 32 PID 2428 wrote to memory of 2812 2428 vjvpv.exe 32 PID 2428 wrote to memory of 2812 2428 vjvpv.exe 32 PID 2428 wrote to memory of 2812 2428 vjvpv.exe 32 PID 2812 wrote to memory of 2836 2812 btbhbb.exe 33 PID 2812 wrote to memory of 2836 2812 btbhbb.exe 33 PID 2812 wrote to memory of 2836 2812 btbhbb.exe 33 PID 2812 wrote to memory of 2836 2812 btbhbb.exe 33 PID 2836 wrote to memory of 2984 2836 9jvdp.exe 34 PID 2836 wrote to memory of 2984 2836 9jvdp.exe 34 PID 2836 wrote to memory of 2984 2836 9jvdp.exe 34 PID 2836 wrote to memory of 2984 2836 9jvdp.exe 34 PID 2984 wrote to memory of 2968 2984 7lxxffl.exe 35 PID 2984 wrote to memory of 2968 2984 7lxxffl.exe 35 PID 2984 wrote to memory of 2968 2984 7lxxffl.exe 35 PID 2984 wrote to memory of 2968 2984 7lxxffl.exe 35 PID 2968 wrote to memory of 2864 2968 5bnhhb.exe 36 PID 2968 wrote to memory of 2864 2968 5bnhhb.exe 36 PID 2968 wrote to memory of 2864 2968 5bnhhb.exe 36 PID 2968 wrote to memory of 2864 2968 5bnhhb.exe 36 PID 2864 wrote to memory of 2592 2864 jddjp.exe 37 PID 2864 wrote to memory of 2592 2864 jddjp.exe 37 PID 2864 wrote to memory of 2592 2864 jddjp.exe 37 PID 2864 wrote to memory of 2592 2864 jddjp.exe 37 PID 2592 wrote to memory of 1340 2592 xrlfflx.exe 38 PID 2592 wrote to memory of 1340 2592 xrlfflx.exe 38 PID 2592 wrote to memory of 1340 2592 xrlfflx.exe 38 PID 2592 wrote to memory of 1340 2592 xrlfflx.exe 38 PID 1340 wrote to memory of 1144 1340 bttnth.exe 39 PID 1340 wrote to memory of 1144 1340 bttnth.exe 39 PID 1340 wrote to memory of 1144 1340 bttnth.exe 39 PID 1340 wrote to memory of 1144 1340 bttnth.exe 39 PID 1144 wrote to memory of 2920 1144 jjjdj.exe 40 PID 1144 wrote to memory of 2920 1144 jjjdj.exe 40 PID 1144 wrote to memory of 2920 1144 jjjdj.exe 40 PID 1144 wrote to memory of 2920 1144 jjjdj.exe 40 PID 2920 wrote to memory of 1972 2920 frfxxlf.exe 41 PID 2920 wrote to memory of 1972 2920 frfxxlf.exe 41 PID 2920 wrote to memory of 1972 2920 frfxxlf.exe 41 PID 2920 wrote to memory of 1972 2920 frfxxlf.exe 41 PID 1972 wrote to memory of 1924 1972 hbnbtt.exe 42 PID 1972 wrote to memory of 1924 1972 hbnbtt.exe 42 PID 1972 wrote to memory of 1924 1972 hbnbtt.exe 42 PID 1972 wrote to memory of 1924 1972 hbnbtt.exe 42 PID 1924 wrote to memory of 1492 1924 pdjvv.exe 43 PID 1924 wrote to memory of 1492 1924 pdjvv.exe 43 PID 1924 wrote to memory of 1492 1924 pdjvv.exe 43 PID 1924 wrote to memory of 1492 1924 pdjvv.exe 43 PID 1492 wrote to memory of 2740 1492 llxxxxl.exe 44 PID 1492 wrote to memory of 2740 1492 llxxxxl.exe 44 PID 1492 wrote to memory of 2740 1492 llxxxxl.exe 44 PID 1492 wrote to memory of 2740 1492 llxxxxl.exe 44 PID 2740 wrote to memory of 1396 2740 ntbbtn.exe 79 PID 2740 wrote to memory of 1396 2740 ntbbtn.exe 79 PID 2740 wrote to memory of 1396 2740 ntbbtn.exe 79 PID 2740 wrote to memory of 1396 2740 ntbbtn.exe 79 PID 1396 wrote to memory of 2184 1396 lrfxxrr.exe 46 PID 1396 wrote to memory of 2184 1396 lrfxxrr.exe 46 PID 1396 wrote to memory of 2184 1396 lrfxxrr.exe 46 PID 1396 wrote to memory of 2184 1396 lrfxxrr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe"C:\Users\Admin\AppData\Local\Temp\28dbfe04456cb46c085423a741d11cc87b1bc6bf967431e640b7edce492f9557.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vjvpv.exec:\vjvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\btbhbb.exec:\btbhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9jvdp.exec:\9jvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\7lxxffl.exec:\7lxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\5bnhhb.exec:\5bnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jddjp.exec:\jddjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xrlfflx.exec:\xrlfflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bttnth.exec:\bttnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\jjjdj.exec:\jjjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\frfxxlf.exec:\frfxxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hbnbtt.exec:\hbnbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\pdjvv.exec:\pdjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\llxxxxl.exec:\llxxxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\ntbbtn.exec:\ntbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lrfxxrr.exec:\lrfxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\ttnthn.exec:\ttnthn.exe17⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jdppv.exec:\jdppv.exe18⤵
- Executes dropped EXE
PID:556 -
\??\c:\frffllr.exec:\frffllr.exe19⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pjpvd.exec:\pjpvd.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ffrlrll.exec:\ffrlrll.exe21⤵
- Executes dropped EXE
PID:2856 -
\??\c:\thbbhh.exec:\thbbhh.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lxxrrrf.exec:\lxxrrrf.exe23⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hnhhnn.exec:\hnhhnn.exe24⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fffxfrl.exec:\fffxfrl.exe25⤵
- Executes dropped EXE
PID:896 -
\??\c:\bbbtbn.exec:\bbbtbn.exe26⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fxxfxlf.exec:\fxxfxlf.exe27⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bthhnn.exec:\bthhnn.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ffrflff.exec:\ffrflff.exe29⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dpvvd.exec:\dpvvd.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\fflxlfl.exec:\fflxlfl.exe31⤵
- Executes dropped EXE
PID:1584 -
\??\c:\thnntt.exec:\thnntt.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe33⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bhbtnh.exec:\bhbtnh.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9jddj.exec:\9jddj.exe35⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lxflxxf.exec:\lxflxxf.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ppddj.exec:\ppddj.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lfrrflr.exec:\lfrrflr.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\thttht.exec:\thttht.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ddpvv.exec:\ddpvv.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hhntbh.exec:\hhntbh.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1ddjv.exec:\1ddjv.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9ffxlff.exec:\9ffxlff.exe43⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vdvpj.exec:\vdvpj.exe44⤵
- Executes dropped EXE
PID:1248 -
\??\c:\llflrll.exec:\llflrll.exe45⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tnnntb.exec:\tnnntb.exe46⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dpdpv.exec:\dpdpv.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9hbnbh.exec:\9hbnbh.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tttbnh.exec:\tttbnh.exe49⤵
- Executes dropped EXE
PID:584 -
\??\c:\9bbntb.exec:\9bbntb.exe50⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bbnhnh.exec:\bbnhnh.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3dpjp.exec:\3dpjp.exe52⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3ntthh.exec:\3ntthh.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\htbhhn.exec:\htbhhn.exe54⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjdpd.exec:\pjdpd.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnnbnb.exec:\tnnbnb.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hnntnt.exec:\hnntnt.exe57⤵
- Executes dropped EXE
PID:404 -
\??\c:\dddvp.exec:\dddvp.exe58⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bthhhb.exec:\bthhhb.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vvpdp.exec:\vvpdp.exe61⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ttnnhb.exec:\ttnnhb.exe62⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ddjpj.exec:\ddjpj.exe63⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lrlxrxx.exec:\lrlxrxx.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\9tntbh.exec:\9tntbh.exe65⤵
- Executes dropped EXE
PID:980 -
\??\c:\nnnthb.exec:\nnnthb.exe66⤵PID:1700
-
\??\c:\xrrxlrr.exec:\xrrxlrr.exe67⤵PID:884
-
\??\c:\bbtthh.exec:\bbtthh.exe68⤵PID:1784
-
\??\c:\lfrxxlr.exec:\lfrxxlr.exe69⤵PID:2376
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe70⤵PID:1632
-
\??\c:\3dpdv.exec:\3dpdv.exe71⤵PID:1928
-
\??\c:\vvvpd.exec:\vvvpd.exe72⤵PID:2820
-
\??\c:\xlxrrff.exec:\xlxrrff.exe73⤵PID:1232
-
\??\c:\5tntnb.exec:\5tntnb.exe74⤵PID:1460
-
\??\c:\jdvdp.exec:\jdvdp.exe75⤵PID:2564
-
\??\c:\7ffrfff.exec:\7ffrfff.exe76⤵PID:1736
-
\??\c:\hbtnbh.exec:\hbtnbh.exe77⤵PID:2616
-
\??\c:\9vjpv.exec:\9vjpv.exe78⤵PID:2440
-
\??\c:\dpjpd.exec:\dpjpd.exe79⤵PID:876
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe80⤵PID:2476
-
\??\c:\bbtnht.exec:\bbtnht.exe81⤵PID:1144
-
\??\c:\bhnhtn.exec:\bhnhtn.exe82⤵PID:2964
-
\??\c:\jvpvd.exec:\jvpvd.exe83⤵PID:2920
-
\??\c:\frfxlxf.exec:\frfxlxf.exe84⤵PID:1972
-
\??\c:\bnhbtn.exec:\bnhbtn.exe85⤵PID:2400
-
\??\c:\hhhnhn.exec:\hhhnhn.exe86⤵PID:1684
-
\??\c:\9ddjj.exec:\9ddjj.exe87⤵PID:660
-
\??\c:\frxlflf.exec:\frxlflf.exe88⤵PID:2688
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe89⤵PID:2752
-
\??\c:\5hnnbh.exec:\5hnnbh.exe90⤵PID:2940
-
\??\c:\vjdjp.exec:\vjdjp.exe91⤵PID:2740
-
\??\c:\jjppj.exec:\jjppj.exe92⤵PID:2788
-
\??\c:\xrlxfxx.exec:\xrlxfxx.exe93⤵PID:1396
-
\??\c:\btbthb.exec:\btbthb.exe94⤵PID:556
-
\??\c:\pjvpd.exec:\pjvpd.exe95⤵PID:108
-
\??\c:\lrrrrrf.exec:\lrrrrrf.exe96⤵PID:2100
-
\??\c:\tnhnhb.exec:\tnhnhb.exe97⤵PID:2068
-
\??\c:\9vvdv.exec:\9vvdv.exe98⤵PID:1432
-
\??\c:\jdjpp.exec:\jdjpp.exe99⤵PID:1992
-
\??\c:\xrrfxff.exec:\xrrfxff.exe100⤵PID:3008
-
\??\c:\bnbtbb.exec:\bnbtbb.exe101⤵PID:1812
-
\??\c:\5tbbnt.exec:\5tbbnt.exe102⤵PID:1664
-
\??\c:\5pjpd.exec:\5pjpd.exe103⤵PID:1420
-
\??\c:\xrfflrl.exec:\xrfflrl.exe104⤵PID:2360
-
\??\c:\rlfxlrr.exec:\rlfxlrr.exe105⤵PID:2388
-
\??\c:\nhntth.exec:\nhntth.exe106⤵PID:2488
-
\??\c:\5jvpv.exec:\5jvpv.exe107⤵PID:2328
-
\??\c:\rrllxxf.exec:\rrllxxf.exe108⤵PID:2060
-
\??\c:\xflfrfx.exec:\xflfrfx.exe109⤵PID:2416
-
\??\c:\nnnnth.exec:\nnnnth.exe110⤵PID:1416
-
\??\c:\vvppp.exec:\vvppp.exe111⤵PID:1440
-
\??\c:\pvvpd.exec:\pvvpd.exe112⤵PID:2252
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe113⤵PID:2396
-
\??\c:\btthtb.exec:\btthtb.exe114⤵PID:2824
-
\??\c:\btnbtn.exec:\btnbtn.exe115⤵PID:1628
-
\??\c:\pddvj.exec:\pddvj.exe116⤵PID:1164
-
\??\c:\rllxlxr.exec:\rllxlxr.exe117⤵PID:2664
-
\??\c:\3fflfrf.exec:\3fflfrf.exe118⤵PID:2700
-
\??\c:\bhbhnt.exec:\bhbhnt.exe119⤵PID:2984
-
\??\c:\vjvvj.exec:\vjvvj.exe120⤵PID:2552
-
\??\c:\pvvdv.exec:\pvvdv.exe121⤵PID:2588
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-