Analysis
-
max time kernel
36s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe
-
Size
128KB
-
MD5
358c11d5bdb5f6e34897a1912dea5013
-
SHA1
05d6f838712f4350a08d977aa05eecd8d60cf553
-
SHA256
40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770
-
SHA512
c9b52ed5414a770d8eaa98eb9b7317a5d3ab7d5e2d61d7332273525c3820c0ca7b8d2437ef0a89e656140c56c0803ec6b987ab9f09c02c9be04b04639a0bf322
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3MsVpKFHqZ:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoc
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1480-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5576-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5556-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5724-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5724-34-0x0000000002030000-0x000000000203C000-memory.dmp family_blackmoon behavioral2/memory/4380-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-66-0x0000000000470000-0x000000000047C000-memory.dmp family_blackmoon behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-73-0x0000000001EF0000-0x0000000001F30000-memory.dmp family_blackmoon behavioral2/memory/3272-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5184-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5548-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/1480-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4152-12-0x0000000000650000-0x0000000000690000-memory.dmp UPX behavioral2/memory/4152-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5576-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5556-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5724-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4380-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4648-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3252-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1860-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4932-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/932-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/992-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5184-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5548-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4080-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4340-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2408-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2456-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1236-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2708-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4336-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3236-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4152 bbbnbt.exe 5576 jvjdd.exe 5556 btnbth.exe 5724 5jjpd.exe 4380 lxfxxxx.exe 4648 tnhbtt.exe 3252 pdjvp.exe 400 rrlrxxr.exe 1860 hbnnbb.exe 4996 5vpjj.exe 3272 fxrlllf.exe 4932 ntbbth.exe 932 9vjdp.exe 2128 xxrlxxr.exe 992 httttn.exe 5548 nhtnnn.exe 5184 pjpjp.exe 4080 jvdjd.exe 4340 xrfrffx.exe 4992 hbnttt.exe 4496 dvpjv.exe 2408 lxrfxlf.exe 2456 btttnh.exe 1608 ppppj.exe 3744 lllfrrl.exe 1236 hntnnh.exe 2708 dddvj.exe 4336 vjjvp.exe 4840 xrllxxr.exe 2812 bhtbbh.exe 3236 jdjdv.exe 5204 rxxrlff.exe 3308 nhbtnn.exe 1264 hhbthh.exe 3108 vjpjv.exe 3612 pjvvj.exe 2896 rfxxrrl.exe 448 rxxxrxx.exe 4536 3httnt.exe 1764 nbhbbb.exe 2728 vjjdv.exe 4356 7vdvj.exe 1716 5flfrxr.exe 5220 fflllff.exe 2028 ffflffx.exe 3368 bhbtnn.exe 536 5nbhnt.exe 5392 jdppd.exe 1056 3flflll.exe 3188 frffxrx.exe 2200 thnhtt.exe 2656 bhbbtn.exe 2548 vjpjv.exe 5716 vjdvv.exe 3868 xrrllxr.exe 3708 5fflfrf.exe 3552 frxlfll.exe 2488 hthbbb.exe 460 pjvpd.exe 3600 pjjdv.exe 2204 1jppd.exe 776 1lfxxrf.exe 2916 fxffrrl.exe 920 1bbbtn.exe -
resource yara_rule behavioral2/memory/1480-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5576-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5556-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5724-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5184-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5548-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1480 wrote to memory of 4152 1480 40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe 85 PID 1480 wrote to memory of 4152 1480 40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe 85 PID 1480 wrote to memory of 4152 1480 40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe 85 PID 4152 wrote to memory of 5576 4152 bbbnbt.exe 86 PID 4152 wrote to memory of 5576 4152 bbbnbt.exe 86 PID 4152 wrote to memory of 5576 4152 bbbnbt.exe 86 PID 5576 wrote to memory of 5556 5576 jvjdd.exe 87 PID 5576 wrote to memory of 5556 5576 jvjdd.exe 87 PID 5576 wrote to memory of 5556 5576 jvjdd.exe 87 PID 5556 wrote to memory of 5724 5556 btnbth.exe 88 PID 5556 wrote to memory of 5724 5556 btnbth.exe 88 PID 5556 wrote to memory of 5724 5556 btnbth.exe 88 PID 5724 wrote to memory of 4380 5724 5jjpd.exe 89 PID 5724 wrote to memory of 4380 5724 5jjpd.exe 89 PID 5724 wrote to memory of 4380 5724 5jjpd.exe 89 PID 4380 wrote to memory of 4648 4380 lxfxxxx.exe 90 PID 4380 wrote to memory of 4648 4380 lxfxxxx.exe 90 PID 4380 wrote to memory of 4648 4380 lxfxxxx.exe 90 PID 4648 wrote to memory of 3252 4648 tnhbtt.exe 91 PID 4648 wrote to memory of 3252 4648 tnhbtt.exe 91 PID 4648 wrote to memory of 3252 4648 tnhbtt.exe 91 PID 3252 wrote to memory of 400 3252 pdjvp.exe 92 PID 3252 wrote to memory of 400 3252 pdjvp.exe 92 PID 3252 wrote to memory of 400 3252 pdjvp.exe 92 PID 400 wrote to memory of 1860 400 rrlrxxr.exe 93 PID 400 wrote to memory of 1860 400 rrlrxxr.exe 93 PID 400 wrote to memory of 1860 400 rrlrxxr.exe 93 PID 1860 wrote to memory of 4996 1860 hbnnbb.exe 94 PID 1860 wrote to memory of 4996 1860 hbnnbb.exe 94 PID 1860 wrote to memory of 4996 1860 hbnnbb.exe 94 PID 4996 wrote to memory of 3272 4996 5vpjj.exe 95 PID 4996 wrote to memory of 3272 4996 5vpjj.exe 95 PID 4996 wrote to memory of 3272 4996 5vpjj.exe 95 PID 3272 wrote to memory of 4932 3272 fxrlllf.exe 96 PID 3272 wrote to memory of 4932 3272 fxrlllf.exe 96 PID 3272 wrote to memory of 4932 3272 fxrlllf.exe 96 PID 4932 wrote to memory of 932 4932 ntbbth.exe 97 PID 4932 wrote to memory of 932 4932 ntbbth.exe 97 PID 4932 wrote to memory of 932 4932 ntbbth.exe 97 PID 932 wrote to memory of 2128 932 9vjdp.exe 98 PID 932 wrote to memory of 2128 932 9vjdp.exe 98 PID 932 wrote to memory of 2128 932 9vjdp.exe 98 PID 2128 wrote to memory of 992 2128 xxrlxxr.exe 99 PID 2128 wrote to memory of 992 2128 xxrlxxr.exe 99 PID 2128 wrote to memory of 992 2128 xxrlxxr.exe 99 PID 992 wrote to memory of 5548 992 httttn.exe 101 PID 992 wrote to memory of 5548 992 httttn.exe 101 PID 992 wrote to memory of 5548 992 httttn.exe 101 PID 5548 wrote to memory of 5184 5548 nhtnnn.exe 102 PID 5548 wrote to memory of 5184 5548 nhtnnn.exe 102 PID 5548 wrote to memory of 5184 5548 nhtnnn.exe 102 PID 5184 wrote to memory of 4080 5184 pjpjp.exe 103 PID 5184 wrote to memory of 4080 5184 pjpjp.exe 103 PID 5184 wrote to memory of 4080 5184 pjpjp.exe 103 PID 4080 wrote to memory of 4340 4080 jvdjd.exe 104 PID 4080 wrote to memory of 4340 4080 jvdjd.exe 104 PID 4080 wrote to memory of 4340 4080 jvdjd.exe 104 PID 4340 wrote to memory of 4992 4340 xrfrffx.exe 105 PID 4340 wrote to memory of 4992 4340 xrfrffx.exe 105 PID 4340 wrote to memory of 4992 4340 xrfrffx.exe 105 PID 4992 wrote to memory of 4496 4992 hbnttt.exe 106 PID 4992 wrote to memory of 4496 4992 hbnttt.exe 106 PID 4992 wrote to memory of 4496 4992 hbnttt.exe 106 PID 4496 wrote to memory of 2408 4496 dvpjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe"C:\Users\Admin\AppData\Local\Temp\40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\bbbnbt.exec:\bbbnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\jvjdd.exec:\jvjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
\??\c:\btnbth.exec:\btnbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
\??\c:\5jjpd.exec:\5jjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\tnhbtt.exec:\tnhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\pdjvp.exec:\pdjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\rrlrxxr.exec:\rrlrxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\hbnnbb.exec:\hbnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\5vpjj.exec:\5vpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\fxrlllf.exec:\fxrlllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\ntbbth.exec:\ntbbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\9vjdp.exec:\9vjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\xxrlxxr.exec:\xxrlxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\httttn.exec:\httttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\nhtnnn.exec:\nhtnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
\??\c:\pjpjp.exec:\pjpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
\??\c:\jvdjd.exec:\jvdjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\xrfrffx.exec:\xrfrffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\hbnttt.exec:\hbnttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\dvpjv.exec:\dvpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\lxrfxlf.exec:\lxrfxlf.exe23⤵
- Executes dropped EXE
PID:2408 -
\??\c:\btttnh.exec:\btttnh.exe24⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ppppj.exec:\ppppj.exe25⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lllfrrl.exec:\lllfrrl.exe26⤵
- Executes dropped EXE
PID:3744 -
\??\c:\hntnnh.exec:\hntnnh.exe27⤵
- Executes dropped EXE
PID:1236 -
\??\c:\dddvj.exec:\dddvj.exe28⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vjjvp.exec:\vjjvp.exe29⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xrllxxr.exec:\xrllxxr.exe30⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bhtbbh.exec:\bhtbbh.exe31⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jdjdv.exec:\jdjdv.exe32⤵
- Executes dropped EXE
PID:3236 -
\??\c:\rxxrlff.exec:\rxxrlff.exe33⤵
- Executes dropped EXE
PID:5204 -
\??\c:\nhbtnn.exec:\nhbtnn.exe34⤵
- Executes dropped EXE
PID:3308 -
\??\c:\hhbthh.exec:\hhbthh.exe35⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vjpjv.exec:\vjpjv.exe36⤵
- Executes dropped EXE
PID:3108 -
\??\c:\pjvvj.exec:\pjvvj.exe37⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe39⤵
- Executes dropped EXE
PID:448 -
\??\c:\3httnt.exec:\3httnt.exe40⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nbhbbb.exec:\nbhbbb.exe41⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vjjdv.exec:\vjjdv.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7vdvj.exec:\7vdvj.exe43⤵
- Executes dropped EXE
PID:4356 -
\??\c:\5flfrxr.exec:\5flfrxr.exe44⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fflllff.exec:\fflllff.exe45⤵
- Executes dropped EXE
PID:5220 -
\??\c:\ffflffx.exec:\ffflffx.exe46⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bhbtnn.exec:\bhbtnn.exe47⤵
- Executes dropped EXE
PID:3368 -
\??\c:\5nbhnt.exec:\5nbhnt.exe48⤵
- Executes dropped EXE
PID:536 -
\??\c:\jdppd.exec:\jdppd.exe49⤵
- Executes dropped EXE
PID:5392 -
\??\c:\3flflll.exec:\3flflll.exe50⤵
- Executes dropped EXE
PID:1056 -
\??\c:\frffxrx.exec:\frffxrx.exe51⤵
- Executes dropped EXE
PID:3188 -
\??\c:\thnhtt.exec:\thnhtt.exe52⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bhbbtn.exec:\bhbbtn.exe53⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vjpjv.exec:\vjpjv.exe54⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vjdvv.exec:\vjdvv.exe55⤵
- Executes dropped EXE
PID:5716 -
\??\c:\xrrllxr.exec:\xrrllxr.exe56⤵
- Executes dropped EXE
PID:3868 -
\??\c:\5fflfrf.exec:\5fflfrf.exe57⤵
- Executes dropped EXE
PID:3708 -
\??\c:\frxlfll.exec:\frxlfll.exe58⤵
- Executes dropped EXE
PID:3552 -
\??\c:\hthbbb.exec:\hthbbb.exe59⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjvpd.exec:\pjvpd.exe60⤵
- Executes dropped EXE
PID:460 -
\??\c:\pjjdv.exec:\pjjdv.exe61⤵
- Executes dropped EXE
PID:3600 -
\??\c:\1jppd.exec:\1jppd.exe62⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1lfxxrf.exec:\1lfxxrf.exe63⤵
- Executes dropped EXE
PID:776 -
\??\c:\fxffrrl.exec:\fxffrrl.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1bbbtn.exec:\1bbbtn.exe65⤵
- Executes dropped EXE
PID:920 -
\??\c:\ttthbt.exec:\ttthbt.exe66⤵PID:4720
-
\??\c:\dpjvd.exec:\dpjvd.exe67⤵PID:3360
-
\??\c:\dpjdv.exec:\dpjdv.exe68⤵PID:1748
-
\??\c:\lxxrfff.exec:\lxxrfff.exe69⤵PID:948
-
\??\c:\9rxrfff.exec:\9rxrfff.exe70⤵PID:3120
-
\??\c:\bnnnhh.exec:\bnnnhh.exe71⤵PID:5576
-
\??\c:\nnbthh.exec:\nnbthh.exe72⤵PID:4712
-
\??\c:\pjvpd.exec:\pjvpd.exe73⤵PID:964
-
\??\c:\pjjdv.exec:\pjjdv.exe74⤵PID:3096
-
\??\c:\rllfffx.exec:\rllfffx.exe75⤵PID:3376
-
\??\c:\bbtbtt.exec:\bbtbtt.exe76⤵PID:4380
-
\??\c:\bnnnnh.exec:\bnnnnh.exe77⤵PID:4648
-
\??\c:\pddvv.exec:\pddvv.exe78⤵PID:3712
-
\??\c:\rxxxlll.exec:\rxxxlll.exe79⤵PID:3032
-
\??\c:\flxxxxr.exec:\flxxxxr.exe80⤵PID:4148
-
\??\c:\1tnnhb.exec:\1tnnhb.exe81⤵PID:5832
-
\??\c:\djvpp.exec:\djvpp.exe82⤵PID:5092
-
\??\c:\xrllxxl.exec:\xrllxxl.exe83⤵PID:4328
-
\??\c:\7jpjj.exec:\7jpjj.exe84⤵PID:5172
-
\??\c:\pjppd.exec:\pjppd.exe85⤵PID:1892
-
\??\c:\lrxrlrx.exec:\lrxrlrx.exe86⤵PID:1572
-
\??\c:\btntnn.exec:\btntnn.exe87⤵PID:2528
-
\??\c:\dvvpj.exec:\dvvpj.exe88⤵PID:6004
-
\??\c:\lrxrffx.exec:\lrxrffx.exe89⤵PID:4248
-
\??\c:\7hnnbb.exec:\7hnnbb.exe90⤵PID:1276
-
\??\c:\9jvvj.exec:\9jvvj.exe91⤵PID:3356
-
\??\c:\xffxrrl.exec:\xffxrrl.exe92⤵PID:5244
-
\??\c:\tthbbb.exec:\tthbbb.exe93⤵PID:3660
-
\??\c:\vvvjd.exec:\vvvjd.exe94⤵PID:6100
-
\??\c:\jdpjd.exec:\jdpjd.exe95⤵PID:5460
-
\??\c:\pddpp.exec:\pddpp.exe96⤵PID:5424
-
\??\c:\rffxrrl.exec:\rffxrrl.exe97⤵PID:4496
-
\??\c:\bhtnhh.exec:\bhtnhh.exe98⤵PID:4208
-
\??\c:\jddvd.exec:\jddvd.exe99⤵PID:4348
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe100⤵PID:1620
-
\??\c:\7bnnnt.exec:\7bnnnt.exe101⤵PID:1608
-
\??\c:\pjdvp.exec:\pjdvp.exe102⤵PID:5248
-
\??\c:\pjdvj.exec:\pjdvj.exe103⤵PID:2284
-
\??\c:\lxfflfr.exec:\lxfflfr.exe104⤵PID:4784
-
\??\c:\7rxxffl.exec:\7rxxffl.exe105⤵PID:5300
-
\??\c:\hhhhnn.exec:\hhhhnn.exe106⤵PID:2708
-
\??\c:\dvpjv.exec:\dvpjv.exe107⤵PID:2060
-
\??\c:\jjpdv.exec:\jjpdv.exe108⤵PID:4520
-
\??\c:\rlfffll.exec:\rlfffll.exe109⤵PID:4840
-
\??\c:\fxflffx.exec:\fxflffx.exe110⤵PID:116
-
\??\c:\tnhhbb.exec:\tnhhbb.exe111⤵PID:4156
-
\??\c:\jdjdv.exec:\jdjdv.exe112⤵PID:1128
-
\??\c:\jjppd.exec:\jjppd.exe113⤵PID:2004
-
\??\c:\xllfxxx.exec:\xllfxxx.exe114⤵PID:5888
-
\??\c:\lflfllr.exec:\lflfllr.exe115⤵PID:3564
-
\??\c:\htbtnn.exec:\htbtnn.exe116⤵PID:3624
-
\??\c:\pjjdp.exec:\pjjdp.exe117⤵PID:544
-
\??\c:\vvjdj.exec:\vvjdj.exe118⤵PID:5828
-
\??\c:\nnhthh.exec:\nnhthh.exe119⤵PID:2720
-
\??\c:\jdjjv.exec:\jdjjv.exe120⤵PID:3656
-
\??\c:\5pvdp.exec:\5pvdp.exe121⤵PID:4244
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe122⤵PID:4376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-