Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 02:43
Behavioral task
behavioral1
Sample
c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe
-
Size
76KB
-
MD5
13f5f8f2a7e9c0f4e6474d55655cee4c
-
SHA1
9d8887516b327ee68bd9fdac1a9245dc4a2dc51e
-
SHA256
c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85
-
SHA512
6986de896f56909c5a8840d22596a6ccf8c5e9c055578c485f19ffe3390c54579325f5e2f41f4923f078952a327b94369c7f43ca79441103b391bf180985ba64
-
SSDEEP
1536:/vQBeOGtrYS3srx93UBWfwC6Ggnouy8jb5Di4rBamDR3A:/hOmTsF93UYfwC6GIoutkm9Q
Malware Config
Signatures
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1712-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1812-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/924-275-0x00000000771F0000-0x00000000772EA000-memory.dmp family_blackmoon behavioral1/memory/924-274-0x00000000770D0000-0x00000000771EF000-memory.dmp family_blackmoon behavioral1/memory/1664-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-469-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/280-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-484-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2096-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-518-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3004-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-556-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2636-576-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-869-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-903-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/944-998-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2692-1011-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2096-1019-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-1031-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-1033-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2312-1048-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2780-1099-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2836-1113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-1130-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2948 djpdd.exe 3064 rfxfxfl.exe 1052 djvvj.exe 2268 9rrxrxl.exe 2780 nhntnt.exe 2700 bntnhh.exe 2660 vdvdp.exe 2564 flxfxlx.exe 2656 ntnthn.exe 2588 dvvpd.exe 1728 xrlrflf.exe 1624 rfflxfr.exe 2776 hhnbbh.exe 2436 9ppjd.exe 1812 vdddp.exe 1432 1fflllx.exe 1704 lrxfllx.exe 316 pdpdp.exe 2908 lrlxrff.exe 2132 lxfflrx.exe 2364 bbnbht.exe 2352 ppvvp.exe 1128 rffxlfl.exe 2892 fflxrxr.exe 1304 hhbnhn.exe 2480 nhthbh.exe 560 ddpdj.exe 2444 llfflrx.exe 3068 tbttbt.exe 1644 hnbbhh.exe 924 vppjp.exe 1664 hbbhhn.exe 3004 llxfflf.exe 3064 hbtbhn.exe 2380 ttnnnt.exe 2688 vpjvv.exe 2844 pvddp.exe 2544 lrxxrlx.exe 2276 lfffrxf.exe 2820 hthbnh.exe 764 djdjj.exe 2548 vjvpv.exe 3032 rxrrxfr.exe 332 tnhbtb.exe 1728 5thtbt.exe 2580 jddpd.exe 288 jvvdj.exe 1988 frxrlxl.exe 2632 bhnthn.exe 2072 jdvjd.exe 1792 1xrflxl.exe 1820 3lfxlrl.exe 1668 ttttnb.exe 2932 pdpdp.exe 2916 pdvdv.exe 2388 rlxfxxr.exe 2640 rlxfrfr.exe 2364 nbthhh.exe 444 hbnbnh.exe 280 vjjpj.exe 2920 5rlxlll.exe 692 tnbbhh.exe 2096 5nnhtt.exe 600 7dpvv.exe -
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2948-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000014399-10.dat upx behavioral1/memory/1712-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017487-18.dat upx behavioral1/memory/2948-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174ca-29.dat upx behavioral1/memory/1052-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3064-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000018671-37.dat upx behavioral1/memory/1052-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001867d-47.dat upx behavioral1/files/0x00080000000186e4-55.dat upx behavioral1/memory/2780-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186e9-62.dat upx behavioral1/memory/2660-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019330-72.dat upx behavioral1/files/0x000500000001934a-79.dat upx behavioral1/memory/2564-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019398-89.dat upx behavioral1/files/0x00050000000193aa-100.dat upx behavioral1/memory/2588-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ae-107.dat upx behavioral1/memory/1624-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193bc-114.dat upx behavioral1/files/0x000500000001943b-124.dat upx behavioral1/memory/2436-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019449-133.dat upx behavioral1/memory/1812-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001948a-142.dat upx behavioral1/memory/1432-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a1-151.dat upx behavioral1/memory/1704-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b1-162.dat upx behavioral1/memory/316-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c1-169.dat upx behavioral1/files/0x00050000000194e5-178.dat upx behavioral1/files/0x00050000000194f0-186.dat upx behavioral1/files/0x00050000000194fa-196.dat upx behavioral1/files/0x0005000000019504-206.dat upx behavioral1/memory/2352-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019506-213.dat upx behavioral1/files/0x0005000000019571-221.dat upx behavioral1/files/0x000500000001957d-229.dat upx behavioral1/files/0x00050000000195a1-238.dat upx behavioral1/memory/560-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016de1-246.dat upx behavioral1/files/0x00050000000195e6-256.dat upx behavioral1/memory/2444-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019617-263.dat upx behavioral1/files/0x0005000000019619-272.dat upx behavioral1/memory/1644-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/924-274-0x00000000770D0000-0x00000000771EF000-memory.dmp upx behavioral1/files/0x000500000001961b-283.dat upx behavioral1/memory/1664-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-292.dat upx behavioral1/memory/3064-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-332-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2948 1712 c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe 31 PID 1712 wrote to memory of 2948 1712 c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe 31 PID 1712 wrote to memory of 2948 1712 c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe 31 PID 1712 wrote to memory of 2948 1712 c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe 31 PID 2948 wrote to memory of 3064 2948 djpdd.exe 32 PID 2948 wrote to memory of 3064 2948 djpdd.exe 32 PID 2948 wrote to memory of 3064 2948 djpdd.exe 32 PID 2948 wrote to memory of 3064 2948 djpdd.exe 32 PID 3064 wrote to memory of 1052 3064 rfxfxfl.exe 33 PID 3064 wrote to memory of 1052 3064 rfxfxfl.exe 33 PID 3064 wrote to memory of 1052 3064 rfxfxfl.exe 33 PID 3064 wrote to memory of 1052 3064 rfxfxfl.exe 33 PID 1052 wrote to memory of 2268 1052 djvvj.exe 34 PID 1052 wrote to memory of 2268 1052 djvvj.exe 34 PID 1052 wrote to memory of 2268 1052 djvvj.exe 34 PID 1052 wrote to memory of 2268 1052 djvvj.exe 34 PID 2268 wrote to memory of 2780 2268 9rrxrxl.exe 35 PID 2268 wrote to memory of 2780 2268 9rrxrxl.exe 35 PID 2268 wrote to memory of 2780 2268 9rrxrxl.exe 35 PID 2268 wrote to memory of 2780 2268 9rrxrxl.exe 35 PID 2780 wrote to memory of 2700 2780 nhntnt.exe 36 PID 2780 wrote to memory of 2700 2780 nhntnt.exe 36 PID 2780 wrote to memory of 2700 2780 nhntnt.exe 36 PID 2780 wrote to memory of 2700 2780 nhntnt.exe 36 PID 2700 wrote to memory of 2660 2700 bntnhh.exe 37 PID 2700 wrote to memory of 2660 2700 bntnhh.exe 37 PID 2700 wrote to memory of 2660 2700 bntnhh.exe 37 PID 2700 wrote to memory of 2660 2700 bntnhh.exe 37 PID 2660 wrote to memory of 2564 2660 vdvdp.exe 38 PID 2660 wrote to memory of 2564 2660 vdvdp.exe 38 PID 2660 wrote to memory of 2564 2660 vdvdp.exe 38 PID 2660 wrote to memory of 2564 2660 vdvdp.exe 38 PID 2564 wrote to memory of 2656 2564 flxfxlx.exe 39 PID 2564 wrote to memory of 2656 2564 flxfxlx.exe 39 PID 2564 wrote to memory of 2656 2564 flxfxlx.exe 39 PID 2564 wrote to memory of 2656 2564 flxfxlx.exe 39 PID 2656 wrote to memory of 2588 2656 ntnthn.exe 40 PID 2656 wrote to memory of 2588 2656 ntnthn.exe 40 PID 2656 wrote to memory of 2588 2656 ntnthn.exe 40 PID 2656 wrote to memory of 2588 2656 ntnthn.exe 40 PID 2588 wrote to memory of 1728 2588 dvvpd.exe 41 PID 2588 wrote to memory of 1728 2588 dvvpd.exe 41 PID 2588 wrote to memory of 1728 2588 dvvpd.exe 41 PID 2588 wrote to memory of 1728 2588 dvvpd.exe 41 PID 1728 wrote to memory of 1624 1728 xrlrflf.exe 42 PID 1728 wrote to memory of 1624 1728 xrlrflf.exe 42 PID 1728 wrote to memory of 1624 1728 xrlrflf.exe 42 PID 1728 wrote to memory of 1624 1728 xrlrflf.exe 42 PID 1624 wrote to memory of 2776 1624 rfflxfr.exe 43 PID 1624 wrote to memory of 2776 1624 rfflxfr.exe 43 PID 1624 wrote to memory of 2776 1624 rfflxfr.exe 43 PID 1624 wrote to memory of 2776 1624 rfflxfr.exe 43 PID 2776 wrote to memory of 2436 2776 hhnbbh.exe 44 PID 2776 wrote to memory of 2436 2776 hhnbbh.exe 44 PID 2776 wrote to memory of 2436 2776 hhnbbh.exe 44 PID 2776 wrote to memory of 2436 2776 hhnbbh.exe 44 PID 2436 wrote to memory of 1812 2436 9ppjd.exe 45 PID 2436 wrote to memory of 1812 2436 9ppjd.exe 45 PID 2436 wrote to memory of 1812 2436 9ppjd.exe 45 PID 2436 wrote to memory of 1812 2436 9ppjd.exe 45 PID 1812 wrote to memory of 1432 1812 vdddp.exe 46 PID 1812 wrote to memory of 1432 1812 vdddp.exe 46 PID 1812 wrote to memory of 1432 1812 vdddp.exe 46 PID 1812 wrote to memory of 1432 1812 vdddp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe"C:\Users\Admin\AppData\Local\Temp\c93cf89e10adc817bb5cc3c33b7d2ff3a019fafe87e8e2a0f4561d4255c02c85.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\djpdd.exec:\djpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\rfxfxfl.exec:\rfxfxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\djvvj.exec:\djvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\9rrxrxl.exec:\9rrxrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\nhntnt.exec:\nhntnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bntnhh.exec:\bntnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vdvdp.exec:\vdvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\flxfxlx.exec:\flxfxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ntnthn.exec:\ntnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\dvvpd.exec:\dvvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xrlrflf.exec:\xrlrflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\rfflxfr.exec:\rfflxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\hhnbbh.exec:\hhnbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\9ppjd.exec:\9ppjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vdddp.exec:\vdddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\1fflllx.exec:\1fflllx.exe17⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lrxfllx.exec:\lrxfllx.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pdpdp.exec:\pdpdp.exe19⤵
- Executes dropped EXE
PID:316 -
\??\c:\lrlxrff.exec:\lrlxrff.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lxfflrx.exec:\lxfflrx.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbnbht.exec:\bbnbht.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ppvvp.exec:\ppvvp.exe23⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rffxlfl.exec:\rffxlfl.exe24⤵
- Executes dropped EXE
PID:1128 -
\??\c:\fflxrxr.exec:\fflxrxr.exe25⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hhbnhn.exec:\hhbnhn.exe26⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nhthbh.exec:\nhthbh.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ddpdj.exec:\ddpdj.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\llfflrx.exec:\llfflrx.exe29⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tbttbt.exec:\tbttbt.exe30⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hnbbhh.exec:\hnbbhh.exe31⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vppjp.exec:\vppjp.exe32⤵
- Executes dropped EXE
PID:924 -
\??\c:\fxxfrfr.exec:\fxxfrfr.exe33⤵PID:1700
-
\??\c:\hbbhhn.exec:\hbbhhn.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\llxfflf.exec:\llxfflf.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hbtbhn.exec:\hbtbhn.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ttnnnt.exec:\ttnnnt.exe37⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vpjvv.exec:\vpjvv.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pvddp.exec:\pvddp.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lrxxrlx.exec:\lrxxrlx.exe40⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lfffrxf.exec:\lfffrxf.exe41⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hthbnh.exec:\hthbnh.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\djdjj.exec:\djdjj.exe43⤵
- Executes dropped EXE
PID:764 -
\??\c:\vjvpv.exec:\vjvpv.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rxrrxfr.exec:\rxrrxfr.exe45⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnhbtb.exec:\tnhbtb.exe46⤵
- Executes dropped EXE
PID:332 -
\??\c:\5thtbt.exec:\5thtbt.exe47⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jddpd.exec:\jddpd.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jvvdj.exec:\jvvdj.exe49⤵
- Executes dropped EXE
PID:288 -
\??\c:\frxrlxl.exec:\frxrlxl.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bhnthn.exec:\bhnthn.exe51⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdvjd.exec:\jdvjd.exe52⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1xrflxl.exec:\1xrflxl.exe53⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3lfxlrl.exec:\3lfxlrl.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ttttnb.exec:\ttttnb.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\pdpdp.exec:\pdpdp.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pdvdv.exec:\pdvdv.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlxfxxr.exec:\rlxfxxr.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rlxfrfr.exec:\rlxfrfr.exe59⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nbthhh.exec:\nbthhh.exe60⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hbnbnh.exec:\hbnbnh.exe61⤵
- Executes dropped EXE
PID:444 -
\??\c:\vjjpj.exec:\vjjpj.exe62⤵
- Executes dropped EXE
PID:280 -
\??\c:\5rlxlll.exec:\5rlxlll.exe63⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tnbbhh.exec:\tnbbhh.exe64⤵
- Executes dropped EXE
PID:692 -
\??\c:\5nnhtt.exec:\5nnhtt.exe65⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7dpvv.exec:\7dpvv.exe66⤵
- Executes dropped EXE
PID:600 -
\??\c:\rxfxllx.exec:\rxfxllx.exe67⤵PID:560
-
\??\c:\lllfrfr.exec:\lllfrfr.exe68⤵PID:1960
-
\??\c:\hntnnt.exec:\hntnnt.exe69⤵PID:3068
-
\??\c:\pjdpd.exec:\pjdpd.exe70⤵PID:2312
-
\??\c:\vdppd.exec:\vdppd.exe71⤵PID:1588
-
\??\c:\xrlflxl.exec:\xrlflxl.exe72⤵PID:1596
-
\??\c:\xfxxxxl.exec:\xfxxxxl.exe73⤵PID:1948
-
\??\c:\bhtbhb.exec:\bhtbhb.exe74⤵PID:1396
-
\??\c:\dvjpv.exec:\dvjpv.exe75⤵PID:3004
-
\??\c:\vjddj.exec:\vjddj.exe76⤵PID:3064
-
\??\c:\rlflrxl.exec:\rlflrxl.exe77⤵PID:2636
-
\??\c:\rxlllrx.exec:\rxlllrx.exe78⤵PID:2648
-
\??\c:\tthtth.exec:\tthtth.exe79⤵PID:2968
-
\??\c:\3hbhhb.exec:\3hbhhb.exe80⤵PID:2836
-
\??\c:\ddvdd.exec:\ddvdd.exe81⤵PID:2876
-
\??\c:\flfxlfl.exec:\flfxlfl.exe82⤵PID:2804
-
\??\c:\hhnbth.exec:\hhnbth.exe83⤵PID:2564
-
\??\c:\hnhhnb.exec:\hnhhnb.exe84⤵PID:2808
-
\??\c:\jdppv.exec:\jdppv.exe85⤵PID:2596
-
\??\c:\pvddv.exec:\pvddv.exe86⤵PID:3036
-
\??\c:\lrllffl.exec:\lrllffl.exe87⤵PID:2288
-
\??\c:\tnnhhb.exec:\tnnhhb.exe88⤵PID:1624
-
\??\c:\nhhbnn.exec:\nhhbnn.exe89⤵PID:2776
-
\??\c:\jpvpv.exec:\jpvpv.exe90⤵PID:2600
-
\??\c:\fxrfxfr.exec:\fxrfxfr.exe91⤵PID:1688
-
\??\c:\xrxlfrr.exec:\xrxlfrr.exe92⤵PID:2868
-
\??\c:\nhbhnt.exec:\nhbhnt.exe93⤵PID:1568
-
\??\c:\hbtnht.exec:\hbtnht.exe94⤵PID:1792
-
\??\c:\pjddd.exec:\pjddd.exe95⤵PID:2816
-
\??\c:\pjjjd.exec:\pjjjd.exe96⤵PID:3012
-
\??\c:\frrlrlr.exec:\frrlrlr.exe97⤵PID:2152
-
\??\c:\frxrrlr.exec:\frxrrlr.exe98⤵PID:1444
-
\??\c:\bhnnbb.exec:\bhnnbb.exe99⤵PID:2132
-
\??\c:\dpddp.exec:\dpddp.exe100⤵PID:1732
-
\??\c:\pvddj.exec:\pvddj.exe101⤵PID:1316
-
\??\c:\9lxxffr.exec:\9lxxffr.exe102⤵PID:444
-
\??\c:\nhbhth.exec:\nhbhth.exe103⤵PID:2124
-
\??\c:\tbbthb.exec:\tbbthb.exe104⤵PID:1932
-
\??\c:\9btntn.exec:\9btntn.exe105⤵PID:1532
-
\??\c:\pvdvj.exec:\pvdvj.exe106⤵PID:340
-
\??\c:\rlllffl.exec:\rlllffl.exe107⤵PID:2428
-
\??\c:\5ntnnn.exec:\5ntnnn.exe108⤵PID:988
-
\??\c:\nhbtbb.exec:\nhbtbb.exe109⤵PID:1072
-
\??\c:\pjjvj.exec:\pjjvj.exe110⤵PID:1960
-
\??\c:\jdvdv.exec:\jdvdv.exe111⤵PID:1876
-
\??\c:\5xxlflr.exec:\5xxlflr.exe112⤵PID:2992
-
\??\c:\1lfxrfr.exec:\1lfxrfr.exe113⤵PID:1588
-
\??\c:\nbnhnn.exec:\nbnhnn.exe114⤵PID:1596
-
\??\c:\hhbnbh.exec:\hhbnbh.exe115⤵PID:2084
-
\??\c:\9jjjp.exec:\9jjjp.exe116⤵PID:1052
-
\??\c:\5jdvd.exec:\5jdvd.exe117⤵PID:2732
-
\??\c:\1xxlxfr.exec:\1xxlxfr.exe118⤵PID:2796
-
\??\c:\5lrfrfr.exec:\5lrfrfr.exe119⤵PID:2636
-
\??\c:\xlrfrlr.exec:\xlrfrlr.exe120⤵PID:2648
-
\??\c:\hthnbh.exec:\hthnbh.exe121⤵PID:2368
-
\??\c:\9pjvj.exec:\9pjvj.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-