Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-07-2024 23:54
Behavioral task
behavioral1
Sample
2dd57210a04bf4fd2a9f266b8e771310N.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
120 seconds
General
-
Target
2dd57210a04bf4fd2a9f266b8e771310N.exe
-
Size
138KB
-
MD5
2dd57210a04bf4fd2a9f266b8e771310
-
SHA1
477db9374b1f9c1ebc905907a9123a499fb578a1
-
SHA256
6572e2eac63d7b435fe6d53b4def56b15ddb3f0fe5f946b42f6798a122f687ff
-
SHA512
f2b22612e1899c8612f3e417fec17b457db8f7f6a8b23ed3f3659d2a6cdc7e983ba870ab68233d71797b1700b7764f949cb61c14d8ed757b7caf4ff948bcdb47
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBuItR8pz7sH:9cm4FmowdHoS4Bftapz7u
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2352-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-91-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/836-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1800-190-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1184-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-451-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2956-450-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-562-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1472-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-676-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-686-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1888-715-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1888-714-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2384-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-774-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2828-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-943-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-993-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-1061-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-1132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-1176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 nbntbb.exe 2668 pdddd.exe 2944 tntbnn.exe 2792 djdjj.exe 2568 5rrxrlx.exe 2708 jjvpd.exe 2572 dpjdj.exe 3056 btbbth.exe 1736 bthhtb.exe 2908 vvpvd.exe 1968 rflrxrf.exe 836 hhhthn.exe 1732 tnhhhn.exe 2988 jppdp.exe 2888 rxllrxl.exe 2516 3thnhn.exe 1916 bttnht.exe 2732 dvppd.exe 1668 thtnbh.exe 1800 bnhtbn.exe 448 jdvdp.exe 1184 llflxlx.exe 1268 bnhnbh.exe 1892 jvvdv.exe 820 vjdvv.exe 2300 rllfxrr.exe 3068 bttbhn.exe 1796 xlffrfx.exe 1276 xrlflxx.exe 1128 htnntt.exe 1976 frrxllr.exe 2156 httbtn.exe 1568 tnttnt.exe 2684 jjvdd.exe 2724 vpdvd.exe 2812 fxxxlrf.exe 2752 bhttnn.exe 2132 pvpdp.exe 2576 djddv.exe 2816 rlxxlxr.exe 2612 fxrxfff.exe 3004 7tnbnh.exe 3016 dvpjv.exe 612 ppjjp.exe 1776 rrlxlfr.exe 840 5bthnn.exe 2348 btbbtb.exe 2344 ddpjd.exe 2036 pvdpv.exe 536 lfxrfxr.exe 3012 xfrlxlx.exe 2780 bhhtbt.exe 1904 dvpdj.exe 1052 pvdjv.exe 1684 ffxxlll.exe 2956 1bhbnn.exe 2204 bbbtnh.exe 2372 jdddd.exe 2600 1lllxlf.exe 1080 llxlflx.exe 2608 ttnbnb.exe 1852 1vdpd.exe 1268 vdvjj.exe 2168 lxxfrxr.exe -
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000011c2f-5.dat upx behavioral1/memory/2352-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015ce7-15.dat upx behavioral1/files/0x0008000000015d09-28.dat upx behavioral1/memory/2944-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d30-35.dat upx behavioral1/memory/2792-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d47-47.dat upx behavioral1/files/0x0007000000015d5f-53.dat upx behavioral1/memory/2708-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d7f-66.dat upx behavioral1/memory/2708-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d87-75.dat upx behavioral1/memory/3056-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001660d-83.dat upx behavioral1/files/0x0006000000016688-93.dat upx behavioral1/memory/2908-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001688f-101.dat upx behavioral1/files/0x0006000000016b85-108.dat upx behavioral1/files/0x0006000000016c88-119.dat upx behavioral1/memory/836-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c9f-126.dat upx behavioral1/memory/2988-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016caa-136.dat upx behavioral1/files/0x0006000000016cef-143.dat upx behavioral1/memory/2516-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d21-155.dat upx behavioral1/memory/2516-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4b-162.dat upx behavioral1/memory/1916-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d67-172.dat upx behavioral1/files/0x0006000000016d6e-179.dat upx behavioral1/memory/1800-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1668-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d72-192.dat upx behavioral1/files/0x0006000000016d76-199.dat upx behavioral1/memory/1184-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d92-209.dat upx behavioral1/files/0x0006000000016da7-216.dat upx behavioral1/files/0x0006000000016dbd-226.dat upx behavioral1/memory/2300-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000015cb8-234.dat upx behavioral1/files/0x0006000000016dcf-242.dat upx behavioral1/files/0x0006000000016de2-258.dat upx behavioral1/files/0x0006000000016dd8-251.dat upx behavioral1/files/0x0006000000016dec-268.dat upx behavioral1/files/0x0006000000016df2-277.dat upx behavioral1/memory/1128-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016df7-285.dat upx behavioral1/memory/2724-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-308-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2724-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-341-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2724 2352 2dd57210a04bf4fd2a9f266b8e771310N.exe 30 PID 2352 wrote to memory of 2724 2352 2dd57210a04bf4fd2a9f266b8e771310N.exe 30 PID 2352 wrote to memory of 2724 2352 2dd57210a04bf4fd2a9f266b8e771310N.exe 30 PID 2352 wrote to memory of 2724 2352 2dd57210a04bf4fd2a9f266b8e771310N.exe 30 PID 2724 wrote to memory of 2668 2724 nbntbb.exe 31 PID 2724 wrote to memory of 2668 2724 nbntbb.exe 31 PID 2724 wrote to memory of 2668 2724 nbntbb.exe 31 PID 2724 wrote to memory of 2668 2724 nbntbb.exe 31 PID 2668 wrote to memory of 2944 2668 pdddd.exe 32 PID 2668 wrote to memory of 2944 2668 pdddd.exe 32 PID 2668 wrote to memory of 2944 2668 pdddd.exe 32 PID 2668 wrote to memory of 2944 2668 pdddd.exe 32 PID 2944 wrote to memory of 2792 2944 tntbnn.exe 33 PID 2944 wrote to memory of 2792 2944 tntbnn.exe 33 PID 2944 wrote to memory of 2792 2944 tntbnn.exe 33 PID 2944 wrote to memory of 2792 2944 tntbnn.exe 33 PID 2792 wrote to memory of 2568 2792 djdjj.exe 34 PID 2792 wrote to memory of 2568 2792 djdjj.exe 34 PID 2792 wrote to memory of 2568 2792 djdjj.exe 34 PID 2792 wrote to memory of 2568 2792 djdjj.exe 34 PID 2568 wrote to memory of 2708 2568 5rrxrlx.exe 35 PID 2568 wrote to memory of 2708 2568 5rrxrlx.exe 35 PID 2568 wrote to memory of 2708 2568 5rrxrlx.exe 35 PID 2568 wrote to memory of 2708 2568 5rrxrlx.exe 35 PID 2708 wrote to memory of 2572 2708 jjvpd.exe 36 PID 2708 wrote to memory of 2572 2708 jjvpd.exe 36 PID 2708 wrote to memory of 2572 2708 jjvpd.exe 36 PID 2708 wrote to memory of 2572 2708 jjvpd.exe 36 PID 2572 wrote to memory of 3056 2572 dpjdj.exe 37 PID 2572 wrote to memory of 3056 2572 dpjdj.exe 37 PID 2572 wrote to memory of 3056 2572 dpjdj.exe 37 PID 2572 wrote to memory of 3056 2572 dpjdj.exe 37 PID 3056 wrote to memory of 1736 3056 btbbth.exe 38 PID 3056 wrote to memory of 1736 3056 btbbth.exe 38 PID 3056 wrote to memory of 1736 3056 btbbth.exe 38 PID 3056 wrote to memory of 1736 3056 btbbth.exe 38 PID 1736 wrote to memory of 2908 1736 bthhtb.exe 39 PID 1736 wrote to memory of 2908 1736 bthhtb.exe 39 PID 1736 wrote to memory of 2908 1736 bthhtb.exe 39 PID 1736 wrote to memory of 2908 1736 bthhtb.exe 39 PID 2908 wrote to memory of 1968 2908 vvpvd.exe 40 PID 2908 wrote to memory of 1968 2908 vvpvd.exe 40 PID 2908 wrote to memory of 1968 2908 vvpvd.exe 40 PID 2908 wrote to memory of 1968 2908 vvpvd.exe 40 PID 1968 wrote to memory of 836 1968 rflrxrf.exe 41 PID 1968 wrote to memory of 836 1968 rflrxrf.exe 41 PID 1968 wrote to memory of 836 1968 rflrxrf.exe 41 PID 1968 wrote to memory of 836 1968 rflrxrf.exe 41 PID 836 wrote to memory of 1732 836 hhhthn.exe 42 PID 836 wrote to memory of 1732 836 hhhthn.exe 42 PID 836 wrote to memory of 1732 836 hhhthn.exe 42 PID 836 wrote to memory of 1732 836 hhhthn.exe 42 PID 1732 wrote to memory of 2988 1732 tnhhhn.exe 43 PID 1732 wrote to memory of 2988 1732 tnhhhn.exe 43 PID 1732 wrote to memory of 2988 1732 tnhhhn.exe 43 PID 1732 wrote to memory of 2988 1732 tnhhhn.exe 43 PID 2988 wrote to memory of 2888 2988 jppdp.exe 44 PID 2988 wrote to memory of 2888 2988 jppdp.exe 44 PID 2988 wrote to memory of 2888 2988 jppdp.exe 44 PID 2988 wrote to memory of 2888 2988 jppdp.exe 44 PID 2888 wrote to memory of 2516 2888 rxllrxl.exe 45 PID 2888 wrote to memory of 2516 2888 rxllrxl.exe 45 PID 2888 wrote to memory of 2516 2888 rxllrxl.exe 45 PID 2888 wrote to memory of 2516 2888 rxllrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dd57210a04bf4fd2a9f266b8e771310N.exe"C:\Users\Admin\AppData\Local\Temp\2dd57210a04bf4fd2a9f266b8e771310N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\nbntbb.exec:\nbntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\pdddd.exec:\pdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tntbnn.exec:\tntbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\djdjj.exec:\djdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\5rrxrlx.exec:\5rrxrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jjvpd.exec:\jjvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dpjdj.exec:\dpjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\btbbth.exec:\btbbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\bthhtb.exec:\bthhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\vvpvd.exec:\vvpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rflrxrf.exec:\rflrxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\hhhthn.exec:\hhhthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\tnhhhn.exec:\tnhhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jppdp.exec:\jppdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rxllrxl.exec:\rxllrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\3thnhn.exec:\3thnhn.exe17⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bttnht.exec:\bttnht.exe18⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dvppd.exec:\dvppd.exe19⤵
- Executes dropped EXE
PID:2732 -
\??\c:\thtnbh.exec:\thtnbh.exe20⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnhtbn.exec:\bnhtbn.exe21⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdvdp.exec:\jdvdp.exe22⤵
- Executes dropped EXE
PID:448 -
\??\c:\llflxlx.exec:\llflxlx.exe23⤵
- Executes dropped EXE
PID:1184 -
\??\c:\bnhnbh.exec:\bnhnbh.exe24⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jvvdv.exec:\jvvdv.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vjdvv.exec:\vjdvv.exe26⤵
- Executes dropped EXE
PID:820 -
\??\c:\rllfxrr.exec:\rllfxrr.exe27⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bttbhn.exec:\bttbhn.exe28⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xlffrfx.exec:\xlffrfx.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xrlflxx.exec:\xrlflxx.exe30⤵
- Executes dropped EXE
PID:1276 -
\??\c:\htnntt.exec:\htnntt.exe31⤵
- Executes dropped EXE
PID:1128 -
\??\c:\frrxllr.exec:\frrxllr.exe32⤵
- Executes dropped EXE
PID:1976 -
\??\c:\httbtn.exec:\httbtn.exe33⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tnttnt.exec:\tnttnt.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jjvdd.exec:\jjvdd.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vpdvd.exec:\vpdvd.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bhttnn.exec:\bhttnn.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pvpdp.exec:\pvpdp.exe39⤵
- Executes dropped EXE
PID:2132 -
\??\c:\djddv.exec:\djddv.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rlxxlxr.exec:\rlxxlxr.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxrxfff.exec:\fxrxfff.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\7tnbnh.exec:\7tnbnh.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dvpjv.exec:\dvpjv.exe44⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ppjjp.exec:\ppjjp.exe45⤵
- Executes dropped EXE
PID:612 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe46⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5bthnn.exec:\5bthnn.exe47⤵
- Executes dropped EXE
PID:840 -
\??\c:\btbbtb.exec:\btbbtb.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ddpjd.exec:\ddpjd.exe49⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pvdpv.exec:\pvdpv.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe51⤵
- Executes dropped EXE
PID:536 -
\??\c:\xfrlxlx.exec:\xfrlxlx.exe52⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bhhtbt.exec:\bhhtbt.exe53⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dvpdj.exec:\dvpdj.exe54⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pvdjv.exec:\pvdjv.exe55⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ffxxlll.exec:\ffxxlll.exe56⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1bhbnn.exec:\1bhbnn.exe57⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bbbtnh.exec:\bbbtnh.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jdddd.exec:\jdddd.exe59⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1lllxlf.exec:\1lllxlf.exe60⤵
- Executes dropped EXE
PID:2600 -
\??\c:\llxlflx.exec:\llxlflx.exe61⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ttnbnb.exec:\ttnbnb.exe62⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1vdpd.exec:\1vdpd.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vdvjj.exec:\vdvjj.exe64⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lxxfrxr.exec:\lxxfrxr.exe65⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1btnnn.exec:\1btnnn.exe66⤵PID:684
-
\??\c:\vvjpj.exec:\vvjpj.exe67⤵PID:832
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe68⤵PID:2300
-
\??\c:\httnbh.exec:\httnbh.exe69⤵PID:324
-
\??\c:\dpdpv.exec:\dpdpv.exe70⤵PID:1248
-
\??\c:\lxffffx.exec:\lxffffx.exe71⤵PID:2004
-
\??\c:\5fflrrr.exec:\5fflrrr.exe72⤵PID:1708
-
\??\c:\bbnbht.exec:\bbnbht.exe73⤵PID:2236
-
\??\c:\dddvj.exec:\dddvj.exe74⤵PID:304
-
\??\c:\9rllrxf.exec:\9rllrxf.exe75⤵PID:1792
-
\??\c:\5bbnnb.exec:\5bbnnb.exe76⤵PID:2284
-
\??\c:\dvjjv.exec:\dvjjv.exe77⤵PID:2828
-
\??\c:\flxxlfr.exec:\flxxlfr.exe78⤵PID:2696
-
\??\c:\1nhnhh.exec:\1nhnhh.exe79⤵PID:2664
-
\??\c:\jdvdp.exec:\jdvdp.exe80⤵PID:2944
-
\??\c:\lrxxlfl.exec:\lrxxlfl.exe81⤵PID:2656
-
\??\c:\nnnbnb.exec:\nnnbnb.exe82⤵PID:2712
-
\??\c:\9vddp.exec:\9vddp.exe83⤵PID:2576
-
\??\c:\ffrxllx.exec:\ffrxllx.exe84⤵PID:2816
-
\??\c:\nhnbnb.exec:\nhnbnb.exe85⤵PID:2584
-
\??\c:\pjvdd.exec:\pjvdd.exe86⤵PID:2032
-
\??\c:\djvdd.exec:\djvdd.exe87⤵PID:1472
-
\??\c:\flrllll.exec:\flrllll.exe88⤵PID:1152
-
\??\c:\tbhnhb.exec:\tbhnhb.exe89⤵PID:2580
-
\??\c:\vpvdj.exec:\vpvdj.exe90⤵PID:840
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe91⤵PID:300
-
\??\c:\nnhbth.exec:\nnhbth.exe92⤵PID:836
-
\??\c:\dvpvj.exec:\dvpvj.exe93⤵PID:768
-
\??\c:\rlflxrx.exec:\rlflxrx.exe94⤵PID:2064
-
\??\c:\7tbnnh.exec:\7tbnnh.exe95⤵PID:2888
-
\??\c:\vpjpd.exec:\vpjpd.exe96⤵PID:752
-
\??\c:\frlrfll.exec:\frlrfll.exe97⤵PID:2208
-
\??\c:\9tbntt.exec:\9tbntt.exe98⤵PID:1888
-
\??\c:\7ddjd.exec:\7ddjd.exe99⤵PID:2384
-
\??\c:\pjddv.exec:\pjddv.exe100⤵PID:2096
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe101⤵PID:1800
-
\??\c:\htnnnt.exec:\htnnnt.exe102⤵PID:332
-
\??\c:\vpdvj.exec:\vpdvj.exe103⤵PID:2528
-
\??\c:\hhbbnt.exec:\hhbbnt.exe104⤵PID:976
-
\??\c:\xrxrxll.exec:\xrxrxll.exe105⤵PID:2040
-
\??\c:\9nbhnh.exec:\9nbhnh.exe106⤵PID:2080
-
\??\c:\lffrlrf.exec:\lffrlrf.exe107⤵PID:1524
-
\??\c:\7nhnhb.exec:\7nhnhb.exe108⤵PID:1032
-
\??\c:\dpjpv.exec:\dpjpv.exe109⤵PID:2996
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe110⤵PID:2296
-
\??\c:\btnnbn.exec:\btnnbn.exe111⤵PID:2508
-
\??\c:\1jjpd.exec:\1jjpd.exe112⤵PID:2968
-
\??\c:\lfrxflr.exec:\lfrxflr.exe113⤵PID:864
-
\??\c:\7tnbtb.exec:\7tnbtb.exe114⤵PID:1128
-
\??\c:\3bnntb.exec:\3bnntb.exe115⤵PID:2068
-
\??\c:\ppjjp.exec:\ppjjp.exe116⤵PID:2644
-
\??\c:\lfrrflf.exec:\lfrrflf.exe117⤵PID:2192
-
\??\c:\htbhhh.exec:\htbhhh.exe118⤵PID:1568
-
\??\c:\jdjjd.exec:\jdjjd.exe119⤵PID:2768
-
\??\c:\9jdvp.exec:\9jdvp.exe120⤵PID:2828
-
\??\c:\lrfflff.exec:\lrfflff.exe121⤵PID:2928
-
\??\c:\hhntbn.exec:\hhntbn.exe122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-