Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8d32d58c62504ec10559113f782eb50N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
b8d32d58c62504ec10559113f782eb50N.exe
-
Size
523KB
-
MD5
b8d32d58c62504ec10559113f782eb50
-
SHA1
9134085e8e84199b23aad8189dbf6d125143172b
-
SHA256
bfeeee3d2737f117e68db46600b416614c6217759c6bb383fcafbfc6fecab355
-
SHA512
94dff61181a2c84dd9ceb6f99b24c9c1d8a8c09b11b222f41dfcfd53746ded28ffc856817d80ca288457f3f9a5779d98d0fd3ab9e33e831b14f9536bd6cd0269
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3x+v:q7Tc2NYHUrAwfMHNnpls4894v
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2440-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-73-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2992-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-530-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-665-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1276-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-958-0x00000000004C0000-0x00000000004EA000-memory.dmp family_blackmoon behavioral1/memory/1508-1088-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 376 1dvvp.exe 580 xxxfrxl.exe 2476 1bbnht.exe 2500 bttttt.exe 2852 dvdjp.exe 2788 pjvpv.exe 2600 fxxflxf.exe 2992 nhhthh.exe 2800 jdvvv.exe 2652 7bbntn.exe 1076 jjpdv.exe 1560 ttntnt.exe 2032 tbbnbn.exe 2872 xxfxxll.exe 2996 hnhbnb.exe 1628 xrlxrxl.exe 2980 1tbbbh.exe 1568 lxlrlrx.exe 284 rrflxfr.exe 2532 hhtnbh.exe 2404 rrfrxlr.exe 2092 pppvd.exe 2024 vppdp.exe 2068 1nnnbh.exe 1552 jdjpv.exe 2244 xxfxxrr.exe 1588 hhbnth.exe 1664 lflrlrl.exe 2452 ntbtth.exe 1996 flxfrfl.exe 892 bnbhth.exe 2544 lffrrxr.exe 1652 tnttbh.exe 884 dpppj.exe 2432 9jvvd.exe 2492 fxlrffr.exe 1416 nhbnnt.exe 2764 vvpdj.exe 2164 jjdjp.exe 2860 xxxfxrl.exe 2644 nhbhtb.exe 2940 pjvjv.exe 2664 pjjdj.exe 1756 rlllrxf.exe 2684 3ntbhh.exe 2536 5jdjj.exe 2592 pdddp.exe 1976 ffflrxr.exe 1832 nhthnt.exe 2888 jdvdp.exe 2960 9jjjj.exe 3036 rlffflr.exe 2696 7btnbn.exe 2884 7vpdv.exe 2984 jjppp.exe 1604 xxlrxxl.exe 1328 3hbbtb.exe 2152 btntnt.exe 1428 rrllxlx.exe 2392 xrlfrfl.exe 2076 ttbtth.exe 1412 5vpvd.exe 408 vpdpj.exe 956 nnhtnb.exe -
resource yara_rule behavioral1/memory/2440-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-665-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1628-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-958-0x00000000004C0000-0x00000000004EA000-memory.dmp upx behavioral1/memory/2884-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 376 2440 b8d32d58c62504ec10559113f782eb50N.exe 30 PID 2440 wrote to memory of 376 2440 b8d32d58c62504ec10559113f782eb50N.exe 30 PID 2440 wrote to memory of 376 2440 b8d32d58c62504ec10559113f782eb50N.exe 30 PID 2440 wrote to memory of 376 2440 b8d32d58c62504ec10559113f782eb50N.exe 30 PID 376 wrote to memory of 580 376 1dvvp.exe 31 PID 376 wrote to memory of 580 376 1dvvp.exe 31 PID 376 wrote to memory of 580 376 1dvvp.exe 31 PID 376 wrote to memory of 580 376 1dvvp.exe 31 PID 580 wrote to memory of 2476 580 xxxfrxl.exe 32 PID 580 wrote to memory of 2476 580 xxxfrxl.exe 32 PID 580 wrote to memory of 2476 580 xxxfrxl.exe 32 PID 580 wrote to memory of 2476 580 xxxfrxl.exe 32 PID 2476 wrote to memory of 2500 2476 1bbnht.exe 33 PID 2476 wrote to memory of 2500 2476 1bbnht.exe 33 PID 2476 wrote to memory of 2500 2476 1bbnht.exe 33 PID 2476 wrote to memory of 2500 2476 1bbnht.exe 33 PID 2500 wrote to memory of 2852 2500 bttttt.exe 34 PID 2500 wrote to memory of 2852 2500 bttttt.exe 34 PID 2500 wrote to memory of 2852 2500 bttttt.exe 34 PID 2500 wrote to memory of 2852 2500 bttttt.exe 34 PID 2852 wrote to memory of 2788 2852 dvdjp.exe 35 PID 2852 wrote to memory of 2788 2852 dvdjp.exe 35 PID 2852 wrote to memory of 2788 2852 dvdjp.exe 35 PID 2852 wrote to memory of 2788 2852 dvdjp.exe 35 PID 2788 wrote to memory of 2600 2788 pjvpv.exe 36 PID 2788 wrote to memory of 2600 2788 pjvpv.exe 36 PID 2788 wrote to memory of 2600 2788 pjvpv.exe 36 PID 2788 wrote to memory of 2600 2788 pjvpv.exe 36 PID 2600 wrote to memory of 2992 2600 fxxflxf.exe 37 PID 2600 wrote to memory of 2992 2600 fxxflxf.exe 37 PID 2600 wrote to memory of 2992 2600 fxxflxf.exe 37 PID 2600 wrote to memory of 2992 2600 fxxflxf.exe 37 PID 2992 wrote to memory of 2800 2992 nhhthh.exe 38 PID 2992 wrote to memory of 2800 2992 nhhthh.exe 38 PID 2992 wrote to memory of 2800 2992 nhhthh.exe 38 PID 2992 wrote to memory of 2800 2992 nhhthh.exe 38 PID 2800 wrote to memory of 2652 2800 jdvvv.exe 39 PID 2800 wrote to memory of 2652 2800 jdvvv.exe 39 PID 2800 wrote to memory of 2652 2800 jdvvv.exe 39 PID 2800 wrote to memory of 2652 2800 jdvvv.exe 39 PID 2652 wrote to memory of 1076 2652 7bbntn.exe 40 PID 2652 wrote to memory of 1076 2652 7bbntn.exe 40 PID 2652 wrote to memory of 1076 2652 7bbntn.exe 40 PID 2652 wrote to memory of 1076 2652 7bbntn.exe 40 PID 1076 wrote to memory of 1560 1076 jjpdv.exe 41 PID 1076 wrote to memory of 1560 1076 jjpdv.exe 41 PID 1076 wrote to memory of 1560 1076 jjpdv.exe 41 PID 1076 wrote to memory of 1560 1076 jjpdv.exe 41 PID 1560 wrote to memory of 2032 1560 ttntnt.exe 42 PID 1560 wrote to memory of 2032 1560 ttntnt.exe 42 PID 1560 wrote to memory of 2032 1560 ttntnt.exe 42 PID 1560 wrote to memory of 2032 1560 ttntnt.exe 42 PID 2032 wrote to memory of 2872 2032 tbbnbn.exe 43 PID 2032 wrote to memory of 2872 2032 tbbnbn.exe 43 PID 2032 wrote to memory of 2872 2032 tbbnbn.exe 43 PID 2032 wrote to memory of 2872 2032 tbbnbn.exe 43 PID 2872 wrote to memory of 2996 2872 xxfxxll.exe 44 PID 2872 wrote to memory of 2996 2872 xxfxxll.exe 44 PID 2872 wrote to memory of 2996 2872 xxfxxll.exe 44 PID 2872 wrote to memory of 2996 2872 xxfxxll.exe 44 PID 2996 wrote to memory of 1628 2996 hnhbnb.exe 45 PID 2996 wrote to memory of 1628 2996 hnhbnb.exe 45 PID 2996 wrote to memory of 1628 2996 hnhbnb.exe 45 PID 2996 wrote to memory of 1628 2996 hnhbnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8d32d58c62504ec10559113f782eb50N.exe"C:\Users\Admin\AppData\Local\Temp\b8d32d58c62504ec10559113f782eb50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\1dvvp.exec:\1dvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\1bbnht.exec:\1bbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bttttt.exec:\bttttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\dvdjp.exec:\dvdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\pjvpv.exec:\pjvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\fxxflxf.exec:\fxxflxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nhhthh.exec:\nhhthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jdvvv.exec:\jdvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\7bbntn.exec:\7bbntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jjpdv.exec:\jjpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\ttntnt.exec:\ttntnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\tbbnbn.exec:\tbbnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xxfxxll.exec:\xxfxxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hnhbnb.exec:\hnhbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xrlxrxl.exec:\xrlxrxl.exe17⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1tbbbh.exec:\1tbbbh.exe18⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lxlrlrx.exec:\lxlrlrx.exe19⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rrflxfr.exec:\rrflxfr.exe20⤵
- Executes dropped EXE
PID:284 -
\??\c:\hhtnbh.exec:\hhtnbh.exe21⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rrfrxlr.exec:\rrfrxlr.exe22⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pppvd.exec:\pppvd.exe23⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vppdp.exec:\vppdp.exe24⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1nnnbh.exec:\1nnnbh.exe25⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jdjpv.exec:\jdjpv.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hhbnth.exec:\hhbnth.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lflrlrl.exec:\lflrlrl.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ntbtth.exec:\ntbtth.exe30⤵
- Executes dropped EXE
PID:2452 -
\??\c:\flxfrfl.exec:\flxfrfl.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bnbhth.exec:\bnbhth.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\lffrrxr.exec:\lffrrxr.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tnttbh.exec:\tnttbh.exe34⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dpppj.exec:\dpppj.exe35⤵
- Executes dropped EXE
PID:884 -
\??\c:\9jvvd.exec:\9jvvd.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fxlrffr.exec:\fxlrffr.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nhbnnt.exec:\nhbnnt.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vvpdj.exec:\vvpdj.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jjdjp.exec:\jjdjp.exe40⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxxfxrl.exec:\xxxfxrl.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nhbhtb.exec:\nhbhtb.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pjvjv.exec:\pjvjv.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjjdj.exec:\pjjdj.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rlllrxf.exec:\rlllrxf.exe45⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3ntbhh.exec:\3ntbhh.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5jdjj.exec:\5jdjj.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pdddp.exec:\pdddp.exe48⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ffflrxr.exec:\ffflrxr.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nhthnt.exec:\nhthnt.exe50⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jdvdp.exec:\jdvdp.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\9jjjj.exec:\9jjjj.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlffflr.exec:\rlffflr.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7btnbn.exec:\7btnbn.exe54⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7vpdv.exec:\7vpdv.exe55⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jjppp.exec:\jjppp.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3hbbtb.exec:\3hbbtb.exe58⤵
- Executes dropped EXE
PID:1328 -
\??\c:\btntnt.exec:\btntnt.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rrllxlx.exec:\rrllxlx.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xrlfrfl.exec:\xrlfrfl.exe61⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ttbtth.exec:\ttbtth.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5vpvd.exec:\5vpvd.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vpdpj.exec:\vpdpj.exe64⤵
- Executes dropped EXE
PID:408 -
\??\c:\nnhtnb.exec:\nnhtnb.exe65⤵
- Executes dropped EXE
PID:956 -
\??\c:\vjdpd.exec:\vjdpd.exe66⤵PID:1260
-
\??\c:\pjdjd.exec:\pjdjd.exe67⤵PID:2140
-
\??\c:\rlxfllx.exec:\rlxfllx.exe68⤵PID:1760
-
\??\c:\hhntht.exec:\hhntht.exe69⤵PID:2208
-
\??\c:\ttntnt.exec:\ttntnt.exe70⤵PID:1624
-
\??\c:\5rxrxrr.exec:\5rxrxrr.exe71⤵PID:2452
-
\??\c:\llrrlff.exec:\llrrlff.exe72⤵PID:2004
-
\??\c:\hhtnhn.exec:\hhtnhn.exe73⤵PID:2576
-
\??\c:\vdpvp.exec:\vdpvp.exe74⤵PID:1924
-
\??\c:\rrlrllx.exec:\rrlrllx.exe75⤵PID:1220
-
\??\c:\rlrflrx.exec:\rlrflrx.exe76⤵PID:1992
-
\??\c:\nhbnbb.exec:\nhbnbb.exe77⤵PID:2216
-
\??\c:\vpjvj.exec:\vpjvj.exe78⤵PID:2432
-
\??\c:\rlflrfx.exec:\rlflrfx.exe79⤵PID:2492
-
\??\c:\9lfrrrx.exec:\9lfrrrx.exe80⤵PID:2464
-
\??\c:\nhbnhn.exec:\nhbnhn.exe81⤵PID:2864
-
\??\c:\jpddd.exec:\jpddd.exe82⤵PID:2780
-
\??\c:\rlxflrx.exec:\rlxflrx.exe83⤵PID:2924
-
\??\c:\lfrrxrf.exec:\lfrrxrf.exe84⤵PID:2752
-
\??\c:\btbnbh.exec:\btbnbh.exe85⤵PID:2676
-
\??\c:\dvvvd.exec:\dvvvd.exe86⤵PID:2284
-
\??\c:\flflxxf.exec:\flflxxf.exe87⤵PID:2712
-
\??\c:\xffrrrx.exec:\xffrrrx.exe88⤵PID:2368
-
\??\c:\hbhnbb.exec:\hbhnbb.exe89⤵PID:600
-
\??\c:\9jpjj.exec:\9jpjj.exe90⤵PID:2968
-
\??\c:\fflfxrf.exec:\fflfxrf.exe91⤵PID:1740
-
\??\c:\nnhnbh.exec:\nnhnbh.exe92⤵PID:2032
-
\??\c:\tnthnb.exec:\tnthnb.exe93⤵PID:2872
-
\??\c:\vvpdj.exec:\vvpdj.exe94⤵PID:2724
-
\??\c:\rfxxlrf.exec:\rfxxlrf.exe95⤵PID:1224
-
\??\c:\hbbhtb.exec:\hbbhtb.exe96⤵PID:1628
-
\??\c:\hbnttb.exec:\hbnttb.exe97⤵PID:840
-
\??\c:\dppvp.exec:\dppvp.exe98⤵PID:1276
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe99⤵PID:1972
-
\??\c:\bbhbbt.exec:\bbhbbt.exe100⤵PID:2260
-
\??\c:\btnbht.exec:\btnbht.exe101⤵PID:2532
-
\??\c:\jdpdv.exec:\jdpdv.exe102⤵PID:2428
-
\??\c:\xxfxrfx.exec:\xxfxrfx.exe103⤵PID:2180
-
\??\c:\rrlxxxr.exec:\rrlxxxr.exe104⤵PID:1012
-
\??\c:\hnnhtn.exec:\hnnhtn.exe105⤵PID:2732
-
\??\c:\dpjpp.exec:\dpjpp.exe106⤵PID:1204
-
\??\c:\rllxfxx.exec:\rllxfxx.exe107⤵PID:2024
-
\??\c:\llxlfrl.exec:\llxlfrl.exe108⤵PID:956
-
\??\c:\tntthh.exec:\tntthh.exe109⤵PID:2204
-
\??\c:\ddpjd.exec:\ddpjd.exe110⤵PID:2244
-
\??\c:\ppjvv.exec:\ppjvv.exe111⤵PID:712
-
\??\c:\frlrxrr.exec:\frlrxrr.exe112⤵PID:1664
-
\??\c:\hbbhtb.exec:\hbbhtb.exe113⤵PID:1148
-
\??\c:\vvpjd.exec:\vvpjd.exe114⤵PID:1440
-
\??\c:\fffllxl.exec:\fffllxl.exe115⤵PID:848
-
\??\c:\hbnbbh.exec:\hbnbbh.exe116⤵PID:1464
-
\??\c:\ddvpj.exec:\ddvpj.exe117⤵PID:1556
-
\??\c:\xfflfrl.exec:\xfflfrl.exe118⤵PID:2512
-
\??\c:\bnhhnt.exec:\bnhhnt.exe119⤵PID:2300
-
\??\c:\vvvjd.exec:\vvvjd.exe120⤵PID:2264
-
\??\c:\lflxlxf.exec:\lflxlxf.exe121⤵PID:2856
-
\??\c:\1btbtt.exec:\1btbtt.exe122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-