Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 03:39
Behavioral task
behavioral1
Sample
74844d94aa0f8fc8941ebed5f4fcc5e0N.exe
Resource
win7-20240708-en
5 signatures
120 seconds
General
-
Target
74844d94aa0f8fc8941ebed5f4fcc5e0N.exe
-
Size
404KB
-
MD5
74844d94aa0f8fc8941ebed5f4fcc5e0
-
SHA1
5ae6013bf6ccbd15a0043c81fd1a564a72b7d5b1
-
SHA256
6e427cbbeffd5c03c51b00d19c53cd23604edaeaeb384a2db33b56b495835fa0
-
SHA512
2df58a9a1edb8cb2cbbb469d178d230bf844e915402f267e9f407941d19efd7260d4b22247e369b39d837471cfcdc1ee5000722dd7b724250c7dca0ff7b3f29d
-
SSDEEP
6144:kcm4FmowdHoSph3Ymu8wdHoSM05d34iWRbzami3x:y4wFHoS3zuxHoSTd34iWRhiB
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2988-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-13-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2352-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1096-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-215-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/632-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1328-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-339-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1288-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-449-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2736-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-688-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1444-715-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-796-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2644-863-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2288-1040-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-1066-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-1146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-1153-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2840-1188-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1964-1200-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2268-1315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-1346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2352 xxrrxfr.exe 1800 nbhbbh.exe 2076 xxrxrrl.exe 2068 3hbttb.exe 2180 1xlfxlr.exe 2780 htnntn.exe 2676 vvvvj.exe 2148 lflrxxx.exe 2764 btbbbh.exe 2616 9jppv.exe 2596 btnntt.exe 1096 9pdvj.exe 1512 rlxlrxr.exe 1984 frfllxf.exe 2308 3dvdj.exe 2036 fxlxffr.exe 1756 thtbnn.exe 2540 dvvdp.exe 2796 7frrfxx.exe 2848 5nhthn.exe 3016 pjvvd.exe 3020 frffxxx.exe 1864 hbbnnb.exe 2868 lxlrxxl.exe 904 3bbntb.exe 632 pjpvd.exe 1328 rlffrrl.exe 2188 dvpdp.exe 2384 rllrflr.exe 888 9nnnhh.exe 3048 vddjj.exe 2916 llfrffx.exe 1612 9hhnth.exe 2364 9vvdp.exe 1712 xxxfrfx.exe 2336 btnttt.exe 2168 bbttbh.exe 2700 jjjvp.exe 2776 ppdpj.exe 2120 fxrllrr.exe 2668 tnhnbh.exe 2808 7pppd.exe 2576 vpjpd.exe 2812 fxxflrx.exe 2764 hbnthh.exe 2720 vpjpd.exe 3032 7vvpj.exe 1656 lxrfffr.exe 1356 ttnhhb.exe 1532 nhbhnb.exe 1952 3vppv.exe 1204 fxrlffx.exe 1288 7tnbnn.exe 1732 tnthtb.exe 1920 jjjpd.exe 1916 1vpdv.exe 2788 flflxfr.exe 2404 1tthth.exe 2388 nnhnbb.exe 2420 ppjpd.exe 1592 3lfllxf.exe 2312 xxflrxl.exe 828 btnthh.exe 948 hhtbbb.exe -
resource yara_rule behavioral1/memory/2988-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-3-0x00000000003B0000-0x00000000003D7000-memory.dmp upx behavioral1/memory/2988-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b0000000120dc-7.dat upx behavioral1/files/0x00080000000191f8-19.dat upx behavioral1/memory/2352-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019214-27.dat upx behavioral1/files/0x0006000000019219-36.dat upx behavioral1/memory/2076-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001921d-45.dat upx behavioral1/memory/2068-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019232-57.dat upx behavioral1/files/0x0006000000019329-64.dat upx behavioral1/memory/2780-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019369-75.dat upx behavioral1/memory/2148-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000195c2-83.dat upx behavioral1/memory/2148-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a2b9-94.dat upx behavioral1/memory/2764-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a2fc-101.dat upx behavioral1/memory/2596-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3e4-111.dat upx behavioral1/files/0x000500000001a3e6-121.dat upx behavioral1/memory/1096-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1512-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3e8-132.dat upx behavioral1/files/0x000500000001a3ea-139.dat upx behavioral1/memory/2308-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3ed-149.dat upx behavioral1/files/0x000500000001a423-156.dat upx behavioral1/memory/1756-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a445-165.dat upx behavioral1/files/0x000500000001a447-172.dat upx behavioral1/memory/2540-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000191d1-183.dat upx behavioral1/files/0x000500000001a452-190.dat upx behavioral1/memory/2848-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3016-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a454-201.dat upx behavioral1/memory/3020-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-210-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a463-207.dat upx behavioral1/files/0x000500000001a46d-220.dat upx behavioral1/files/0x000500000001a470-227.dat upx behavioral1/files/0x000500000001a472-236.dat upx behavioral1/memory/632-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a478-245.dat upx behavioral1/files/0x000500000001a47c-254.dat upx behavioral1/memory/1328-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a47f-264.dat upx behavioral1/memory/2384-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a481-273.dat upx behavioral1/files/0x000500000001a483-282.dat upx behavioral1/memory/2916-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a485-290.dat upx behavioral1/memory/1612-299-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2352 2988 74844d94aa0f8fc8941ebed5f4fcc5e0N.exe 30 PID 2988 wrote to memory of 2352 2988 74844d94aa0f8fc8941ebed5f4fcc5e0N.exe 30 PID 2988 wrote to memory of 2352 2988 74844d94aa0f8fc8941ebed5f4fcc5e0N.exe 30 PID 2988 wrote to memory of 2352 2988 74844d94aa0f8fc8941ebed5f4fcc5e0N.exe 30 PID 2352 wrote to memory of 1800 2352 xxrrxfr.exe 31 PID 2352 wrote to memory of 1800 2352 xxrrxfr.exe 31 PID 2352 wrote to memory of 1800 2352 xxrrxfr.exe 31 PID 2352 wrote to memory of 1800 2352 xxrrxfr.exe 31 PID 1800 wrote to memory of 2076 1800 nbhbbh.exe 32 PID 1800 wrote to memory of 2076 1800 nbhbbh.exe 32 PID 1800 wrote to memory of 2076 1800 nbhbbh.exe 32 PID 1800 wrote to memory of 2076 1800 nbhbbh.exe 32 PID 2076 wrote to memory of 2068 2076 xxrxrrl.exe 33 PID 2076 wrote to memory of 2068 2076 xxrxrrl.exe 33 PID 2076 wrote to memory of 2068 2076 xxrxrrl.exe 33 PID 2076 wrote to memory of 2068 2076 xxrxrrl.exe 33 PID 2068 wrote to memory of 2180 2068 3hbttb.exe 34 PID 2068 wrote to memory of 2180 2068 3hbttb.exe 34 PID 2068 wrote to memory of 2180 2068 3hbttb.exe 34 PID 2068 wrote to memory of 2180 2068 3hbttb.exe 34 PID 2180 wrote to memory of 2780 2180 1xlfxlr.exe 35 PID 2180 wrote to memory of 2780 2180 1xlfxlr.exe 35 PID 2180 wrote to memory of 2780 2180 1xlfxlr.exe 35 PID 2180 wrote to memory of 2780 2180 1xlfxlr.exe 35 PID 2780 wrote to memory of 2676 2780 htnntn.exe 36 PID 2780 wrote to memory of 2676 2780 htnntn.exe 36 PID 2780 wrote to memory of 2676 2780 htnntn.exe 36 PID 2780 wrote to memory of 2676 2780 htnntn.exe 36 PID 2676 wrote to memory of 2148 2676 vvvvj.exe 37 PID 2676 wrote to memory of 2148 2676 vvvvj.exe 37 PID 2676 wrote to memory of 2148 2676 vvvvj.exe 37 PID 2676 wrote to memory of 2148 2676 vvvvj.exe 37 PID 2148 wrote to memory of 2764 2148 lflrxxx.exe 38 PID 2148 wrote to memory of 2764 2148 lflrxxx.exe 38 PID 2148 wrote to memory of 2764 2148 lflrxxx.exe 38 PID 2148 wrote to memory of 2764 2148 lflrxxx.exe 38 PID 2764 wrote to memory of 2616 2764 btbbbh.exe 39 PID 2764 wrote to memory of 2616 2764 btbbbh.exe 39 PID 2764 wrote to memory of 2616 2764 btbbbh.exe 39 PID 2764 wrote to memory of 2616 2764 btbbbh.exe 39 PID 2616 wrote to memory of 2596 2616 9jppv.exe 40 PID 2616 wrote to memory of 2596 2616 9jppv.exe 40 PID 2616 wrote to memory of 2596 2616 9jppv.exe 40 PID 2616 wrote to memory of 2596 2616 9jppv.exe 40 PID 2596 wrote to memory of 1096 2596 btnntt.exe 41 PID 2596 wrote to memory of 1096 2596 btnntt.exe 41 PID 2596 wrote to memory of 1096 2596 btnntt.exe 41 PID 2596 wrote to memory of 1096 2596 btnntt.exe 41 PID 1096 wrote to memory of 1512 1096 9pdvj.exe 42 PID 1096 wrote to memory of 1512 1096 9pdvj.exe 42 PID 1096 wrote to memory of 1512 1096 9pdvj.exe 42 PID 1096 wrote to memory of 1512 1096 9pdvj.exe 42 PID 1512 wrote to memory of 1984 1512 rlxlrxr.exe 43 PID 1512 wrote to memory of 1984 1512 rlxlrxr.exe 43 PID 1512 wrote to memory of 1984 1512 rlxlrxr.exe 43 PID 1512 wrote to memory of 1984 1512 rlxlrxr.exe 43 PID 1984 wrote to memory of 2308 1984 frfllxf.exe 44 PID 1984 wrote to memory of 2308 1984 frfllxf.exe 44 PID 1984 wrote to memory of 2308 1984 frfllxf.exe 44 PID 1984 wrote to memory of 2308 1984 frfllxf.exe 44 PID 2308 wrote to memory of 2036 2308 3dvdj.exe 45 PID 2308 wrote to memory of 2036 2308 3dvdj.exe 45 PID 2308 wrote to memory of 2036 2308 3dvdj.exe 45 PID 2308 wrote to memory of 2036 2308 3dvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\74844d94aa0f8fc8941ebed5f4fcc5e0N.exe"C:\Users\Admin\AppData\Local\Temp\74844d94aa0f8fc8941ebed5f4fcc5e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\xxrrxfr.exec:\xxrrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\nbhbbh.exec:\nbhbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xxrxrrl.exec:\xxrxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\3hbttb.exec:\3hbttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\1xlfxlr.exec:\1xlfxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\htnntn.exec:\htnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vvvvj.exec:\vvvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lflrxxx.exec:\lflrxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\btbbbh.exec:\btbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\9jppv.exec:\9jppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\btnntt.exec:\btnntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\9pdvj.exec:\9pdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\rlxlrxr.exec:\rlxlrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\frfllxf.exec:\frfllxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\3dvdj.exec:\3dvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\fxlxffr.exec:\fxlxffr.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\thtbnn.exec:\thtbnn.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dvvdp.exec:\dvvdp.exe19⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7frrfxx.exec:\7frrfxx.exe20⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5nhthn.exec:\5nhthn.exe21⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjvvd.exec:\pjvvd.exe22⤵
- Executes dropped EXE
PID:3016 -
\??\c:\frffxxx.exec:\frffxxx.exe23⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hbbnnb.exec:\hbbnnb.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\lxlrxxl.exec:\lxlrxxl.exe25⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3bbntb.exec:\3bbntb.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\pjpvd.exec:\pjpvd.exe27⤵
- Executes dropped EXE
PID:632 -
\??\c:\rlffrrl.exec:\rlffrrl.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\dvpdp.exec:\dvpdp.exe29⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rllrflr.exec:\rllrflr.exe30⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9nnnhh.exec:\9nnnhh.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\vddjj.exec:\vddjj.exe32⤵
- Executes dropped EXE
PID:3048 -
\??\c:\llfrffx.exec:\llfrffx.exe33⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9hhnth.exec:\9hhnth.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9vvdp.exec:\9vvdp.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\xxxfrfx.exec:\xxxfrfx.exe36⤵
- Executes dropped EXE
PID:1712 -
\??\c:\btnttt.exec:\btnttt.exe37⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bbttbh.exec:\bbttbh.exe38⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jjjvp.exec:\jjjvp.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ppdpj.exec:\ppdpj.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxrllrr.exec:\fxrllrr.exe41⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tnhnbh.exec:\tnhnbh.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7pppd.exec:\7pppd.exe43⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vpjpd.exec:\vpjpd.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fxxflrx.exec:\fxxflrx.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hbnthh.exec:\hbnthh.exe46⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vpjpd.exec:\vpjpd.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7vvpj.exec:\7vvpj.exe48⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lxrfffr.exec:\lxrfffr.exe49⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ttnhhb.exec:\ttnhhb.exe50⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nhbhnb.exec:\nhbhnb.exe51⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3vppv.exec:\3vppv.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\fxrlffx.exec:\fxrlffx.exe53⤵
- Executes dropped EXE
PID:1204 -
\??\c:\7tnbnn.exec:\7tnbnn.exe54⤵
- Executes dropped EXE
PID:1288 -
\??\c:\tnthtb.exec:\tnthtb.exe55⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jjjpd.exec:\jjjpd.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1vpdv.exec:\1vpdv.exe57⤵
- Executes dropped EXE
PID:1916 -
\??\c:\flflxfr.exec:\flflxfr.exe58⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1tthth.exec:\1tthth.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nnhnbb.exec:\nnhnbb.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ppjpd.exec:\ppjpd.exe61⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3lfllxf.exec:\3lfllxf.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xxflrxl.exec:\xxflrxl.exe63⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btnthh.exec:\btnthh.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\hhtbbb.exec:\hhtbbb.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\pjvvd.exec:\pjvvd.exe66⤵PID:904
-
\??\c:\7xlrrxf.exec:\7xlrrxf.exe67⤵PID:1560
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe68⤵PID:1232
-
\??\c:\btntht.exec:\btntht.exe69⤵PID:1328
-
\??\c:\vjpvv.exec:\vjpvv.exe70⤵PID:1500
-
\??\c:\9fflxxf.exec:\9fflxxf.exe71⤵PID:2508
-
\??\c:\7rrfrfr.exec:\7rrfrfr.exe72⤵PID:2096
-
\??\c:\hbthnt.exec:\hbthnt.exe73⤵PID:1652
-
\??\c:\ttttbn.exec:\ttttbn.exe74⤵PID:3044
-
\??\c:\ppppd.exec:\ppppd.exe75⤵PID:1056
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe76⤵PID:2476
-
\??\c:\5frflrf.exec:\5frflrf.exe77⤵PID:1612
-
\??\c:\nnhbht.exec:\nnhbht.exe78⤵PID:2056
-
\??\c:\jdpjd.exec:\jdpjd.exe79⤵PID:2736
-
\??\c:\jvvdd.exec:\jvvdd.exe80⤵PID:2280
-
\??\c:\fllfxlf.exec:\fllfxlf.exe81⤵PID:2740
-
\??\c:\rllxffl.exec:\rllxffl.exe82⤵PID:2704
-
\??\c:\nhtbhn.exec:\nhtbhn.exe83⤵PID:2780
-
\??\c:\dvjjv.exec:\dvjjv.exe84⤵PID:2928
-
\??\c:\rxxlrxr.exec:\rxxlrxr.exe85⤵PID:2900
-
\??\c:\xrrllxf.exec:\xrrllxf.exe86⤵PID:1596
-
\??\c:\nhtbhn.exec:\nhtbhn.exe87⤵PID:2724
-
\??\c:\5tnthn.exec:\5tnthn.exe88⤵PID:2584
-
\??\c:\7pjvj.exec:\7pjvj.exe89⤵PID:2764
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe90⤵PID:2720
-
\??\c:\5frffll.exec:\5frffll.exe91⤵PID:1096
-
\??\c:\nhtbht.exec:\nhtbht.exe92⤵PID:1496
-
\??\c:\djvjj.exec:\djvjj.exe93⤵PID:2112
-
\??\c:\9ppvd.exec:\9ppvd.exe94⤵PID:1264
-
\??\c:\ffrrxlr.exec:\ffrrxlr.exe95⤵PID:1324
-
\??\c:\5nbtbn.exec:\5nbtbn.exe96⤵PID:1204
-
\??\c:\pdvdp.exec:\pdvdp.exe97⤵PID:624
-
\??\c:\7dvdv.exec:\7dvdv.exe98⤵PID:1444
-
\??\c:\lfflxfx.exec:\lfflxfx.exe99⤵PID:848
-
\??\c:\bthnbb.exec:\bthnbb.exe100⤵PID:2996
-
\??\c:\jjdjp.exec:\jjdjp.exe101⤵PID:2892
-
\??\c:\jdvjp.exec:\jdvjp.exe102⤵PID:3016
-
\??\c:\lfxlffr.exec:\lfxlffr.exe103⤵PID:2980
-
\??\c:\tnbnnt.exec:\tnbnnt.exe104⤵PID:1484
-
\??\c:\1hbbbn.exec:\1hbbbn.exe105⤵PID:1832
-
\??\c:\jdvpj.exec:\jdvpj.exe106⤵PID:828
-
\??\c:\vpjpd.exec:\vpjpd.exe107⤵PID:1240
-
\??\c:\9xffrrx.exec:\9xffrrx.exe108⤵PID:2288
-
\??\c:\nnhtbn.exec:\nnhtbn.exe109⤵PID:2328
-
\??\c:\pjjjv.exec:\pjjjv.exe110⤵PID:2116
-
\??\c:\7vddp.exec:\7vddp.exe111⤵PID:2232
-
\??\c:\1xrrlrx.exec:\1xrrlrx.exe112⤵PID:304
-
\??\c:\9hnnbn.exec:\9hnnbn.exe113⤵PID:2520
-
\??\c:\tttnbn.exec:\tttnbn.exe114⤵PID:884
-
\??\c:\dpdvd.exec:\dpdvd.exe115⤵PID:3048
-
\??\c:\lfflxxl.exec:\lfflxxl.exe116⤵PID:536
-
\??\c:\btthnb.exec:\btthnb.exe117⤵PID:2916
-
\??\c:\3nhtbh.exec:\3nhtbh.exe118⤵PID:1616
-
\??\c:\vppvj.exec:\vppvj.exe119⤵PID:348
-
\??\c:\llfrfxl.exec:\llfrfxl.exe120⤵PID:1932
-
\??\c:\frrxxlf.exec:\frrxxlf.exe121⤵PID:3024
-
\??\c:\1hhntt.exec:\1hhntt.exe122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-