Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-05-2024 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe
-
Size
100KB
-
MD5
4f6a7c7213f94ca1bc7b1f8ae5f7265a
-
SHA1
008de2cbb1653addd6f4597723cce96adcda8546
-
SHA256
fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732
-
SHA512
60d5fe62c99f750dafc660ab1926728216d17faa0c562c6e53a2c7f97e5ed83fc4d80893ec60ff4ca0a556eb16799999f9da51aff0f9a012b35d0ddf1471e5eb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R5l:ymb3NkkiQ3mdBjFodt2zE3l
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3312-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral2/memory/3312-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2496-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2496-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4652-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/520-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/644-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4884-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3372-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2252-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1336-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3708-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2404-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1316-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4168-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4968-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2724-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1164-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2008-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3464-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4656-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5004-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3636-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2344-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3152-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2496 20644.exe 4652 8664626.exe 520 rlffxlf.exe 644 lxxlxrf.exe 4988 68042.exe 4884 q00204.exe 2252 tnnbbt.exe 3372 bththb.exe 4832 04424.exe 1336 tnhnnb.exe 4632 8204082.exe 3708 pdvpj.exe 1452 26262.exe 2404 622200.exe 1316 thbntb.exe 5064 1vpdj.exe 4168 htbnbt.exe 4968 4882448.exe 4292 u008660.exe 2724 hhnhbn.exe 1164 2286042.exe 2008 248260.exe 3464 fxrlxrl.exe 4656 406082.exe 5004 rffrxrf.exe 3636 w42604.exe 1528 lxfrxrl.exe 2344 djpjd.exe 3152 pdjjd.exe 2316 jddvp.exe 1984 hbbtnn.exe 1464 i006004.exe 4948 7ppdv.exe 2332 fxrlffx.exe 4828 48820.exe 1328 3jjjj.exe 4360 82066.exe 4436 hbbnnn.exe 1640 dvppj.exe 4356 g8624.exe 3732 8004822.exe 3628 0404866.exe 4784 6004848.exe 2536 68482.exe 2452 fxxrrrr.exe 1060 nntbnt.exe 892 pjjpd.exe 2216 2064226.exe 3992 1nnnnn.exe 4660 062822.exe 3652 bntnhh.exe 444 nnnhtt.exe 3880 2800446.exe 4936 tntnnn.exe 2956 xlllffx.exe 2664 00626.exe 1724 8408266.exe 2400 2626004.exe 5064 lflfxxr.exe 2312 8224488.exe 3212 5nnnhh.exe 880 ttnhbb.exe 1916 g4448.exe 1172 2804884.exe -
resource yara_rule behavioral2/memory/3312-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3312 wrote to memory of 2496 3312 fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe 83 PID 3312 wrote to memory of 2496 3312 fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe 83 PID 3312 wrote to memory of 2496 3312 fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe 83 PID 2496 wrote to memory of 4652 2496 20644.exe 84 PID 2496 wrote to memory of 4652 2496 20644.exe 84 PID 2496 wrote to memory of 4652 2496 20644.exe 84 PID 4652 wrote to memory of 520 4652 8664626.exe 85 PID 4652 wrote to memory of 520 4652 8664626.exe 85 PID 4652 wrote to memory of 520 4652 8664626.exe 85 PID 520 wrote to memory of 644 520 rlffxlf.exe 86 PID 520 wrote to memory of 644 520 rlffxlf.exe 86 PID 520 wrote to memory of 644 520 rlffxlf.exe 86 PID 644 wrote to memory of 4988 644 lxxlxrf.exe 87 PID 644 wrote to memory of 4988 644 lxxlxrf.exe 87 PID 644 wrote to memory of 4988 644 lxxlxrf.exe 87 PID 4988 wrote to memory of 4884 4988 68042.exe 88 PID 4988 wrote to memory of 4884 4988 68042.exe 88 PID 4988 wrote to memory of 4884 4988 68042.exe 88 PID 4884 wrote to memory of 2252 4884 q00204.exe 89 PID 4884 wrote to memory of 2252 4884 q00204.exe 89 PID 4884 wrote to memory of 2252 4884 q00204.exe 89 PID 2252 wrote to memory of 3372 2252 tnnbbt.exe 90 PID 2252 wrote to memory of 3372 2252 tnnbbt.exe 90 PID 2252 wrote to memory of 3372 2252 tnnbbt.exe 90 PID 3372 wrote to memory of 4832 3372 bththb.exe 91 PID 3372 wrote to memory of 4832 3372 bththb.exe 91 PID 3372 wrote to memory of 4832 3372 bththb.exe 91 PID 4832 wrote to memory of 1336 4832 04424.exe 92 PID 4832 wrote to memory of 1336 4832 04424.exe 92 PID 4832 wrote to memory of 1336 4832 04424.exe 92 PID 1336 wrote to memory of 4632 1336 tnhnnb.exe 93 PID 1336 wrote to memory of 4632 1336 tnhnnb.exe 93 PID 1336 wrote to memory of 4632 1336 tnhnnb.exe 93 PID 4632 wrote to memory of 3708 4632 8204082.exe 94 PID 4632 wrote to memory of 3708 4632 8204082.exe 94 PID 4632 wrote to memory of 3708 4632 8204082.exe 94 PID 3708 wrote to memory of 1452 3708 pdvpj.exe 95 PID 3708 wrote to memory of 1452 3708 pdvpj.exe 95 PID 3708 wrote to memory of 1452 3708 pdvpj.exe 95 PID 1452 wrote to memory of 2404 1452 26262.exe 96 PID 1452 wrote to memory of 2404 1452 26262.exe 96 PID 1452 wrote to memory of 2404 1452 26262.exe 96 PID 2404 wrote to memory of 1316 2404 622200.exe 97 PID 2404 wrote to memory of 1316 2404 622200.exe 97 PID 2404 wrote to memory of 1316 2404 622200.exe 97 PID 1316 wrote to memory of 5064 1316 thbntb.exe 98 PID 1316 wrote to memory of 5064 1316 thbntb.exe 98 PID 1316 wrote to memory of 5064 1316 thbntb.exe 98 PID 5064 wrote to memory of 4168 5064 1vpdj.exe 100 PID 5064 wrote to memory of 4168 5064 1vpdj.exe 100 PID 5064 wrote to memory of 4168 5064 1vpdj.exe 100 PID 4168 wrote to memory of 4968 4168 htbnbt.exe 101 PID 4168 wrote to memory of 4968 4168 htbnbt.exe 101 PID 4168 wrote to memory of 4968 4168 htbnbt.exe 101 PID 4968 wrote to memory of 4292 4968 4882448.exe 102 PID 4968 wrote to memory of 4292 4968 4882448.exe 102 PID 4968 wrote to memory of 4292 4968 4882448.exe 102 PID 4292 wrote to memory of 2724 4292 u008660.exe 103 PID 4292 wrote to memory of 2724 4292 u008660.exe 103 PID 4292 wrote to memory of 2724 4292 u008660.exe 103 PID 2724 wrote to memory of 1164 2724 hhnhbn.exe 104 PID 2724 wrote to memory of 1164 2724 hhnhbn.exe 104 PID 2724 wrote to memory of 1164 2724 hhnhbn.exe 104 PID 1164 wrote to memory of 2008 1164 2286042.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe"C:\Users\Admin\AppData\Local\Temp\fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\20644.exec:\20644.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\8664626.exec:\8664626.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\rlffxlf.exec:\rlffxlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\68042.exec:\68042.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\q00204.exec:\q00204.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\tnnbbt.exec:\tnnbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\bththb.exec:\bththb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\04424.exec:\04424.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\tnhnnb.exec:\tnhnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\8204082.exec:\8204082.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\pdvpj.exec:\pdvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\26262.exec:\26262.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\622200.exec:\622200.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\thbntb.exec:\thbntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\1vpdj.exec:\1vpdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\htbnbt.exec:\htbnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\4882448.exec:\4882448.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\u008660.exec:\u008660.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\hhnhbn.exec:\hhnhbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\2286042.exec:\2286042.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\248260.exec:\248260.exe23⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe24⤵
- Executes dropped EXE
PID:3464 -
\??\c:\406082.exec:\406082.exe25⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rffrxrf.exec:\rffrxrf.exe26⤵
- Executes dropped EXE
PID:5004 -
\??\c:\w42604.exec:\w42604.exe27⤵
- Executes dropped EXE
PID:3636 -
\??\c:\lxfrxrl.exec:\lxfrxrl.exe28⤵
- Executes dropped EXE
PID:1528 -
\??\c:\djpjd.exec:\djpjd.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pdjjd.exec:\pdjjd.exe30⤵
- Executes dropped EXE
PID:3152 -
\??\c:\jddvp.exec:\jddvp.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hbbtnn.exec:\hbbtnn.exe32⤵
- Executes dropped EXE
PID:1984 -
\??\c:\i006004.exec:\i006004.exe33⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7ppdv.exec:\7ppdv.exe34⤵
- Executes dropped EXE
PID:4948 -
\??\c:\fxrlffx.exec:\fxrlffx.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\48820.exec:\48820.exe36⤵
- Executes dropped EXE
PID:4828 -
\??\c:\3jjjj.exec:\3jjjj.exe37⤵
- Executes dropped EXE
PID:1328 -
\??\c:\82066.exec:\82066.exe38⤵
- Executes dropped EXE
PID:4360 -
\??\c:\hbbnnn.exec:\hbbnnn.exe39⤵
- Executes dropped EXE
PID:4436 -
\??\c:\dvppj.exec:\dvppj.exe40⤵
- Executes dropped EXE
PID:1640 -
\??\c:\g8624.exec:\g8624.exe41⤵
- Executes dropped EXE
PID:4356 -
\??\c:\8004822.exec:\8004822.exe42⤵
- Executes dropped EXE
PID:3732 -
\??\c:\0404866.exec:\0404866.exe43⤵
- Executes dropped EXE
PID:3628 -
\??\c:\6004848.exec:\6004848.exe44⤵
- Executes dropped EXE
PID:4784 -
\??\c:\68482.exec:\68482.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nntbnt.exec:\nntbnt.exe47⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pjjpd.exec:\pjjpd.exe48⤵
- Executes dropped EXE
PID:892 -
\??\c:\2064226.exec:\2064226.exe49⤵
- Executes dropped EXE
PID:2216 -
\??\c:\1nnnnn.exec:\1nnnnn.exe50⤵
- Executes dropped EXE
PID:3992 -
\??\c:\062822.exec:\062822.exe51⤵
- Executes dropped EXE
PID:4660 -
\??\c:\bntnhh.exec:\bntnhh.exe52⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nnnhtt.exec:\nnnhtt.exe53⤵
- Executes dropped EXE
PID:444 -
\??\c:\2800446.exec:\2800446.exe54⤵
- Executes dropped EXE
PID:3880 -
\??\c:\tntnnn.exec:\tntnnn.exe55⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xlllffx.exec:\xlllffx.exe56⤵
- Executes dropped EXE
PID:2956 -
\??\c:\00626.exec:\00626.exe57⤵
- Executes dropped EXE
PID:2664 -
\??\c:\8408266.exec:\8408266.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\2626004.exec:\2626004.exe59⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lflfxxr.exec:\lflfxxr.exe60⤵
- Executes dropped EXE
PID:5064 -
\??\c:\8224488.exec:\8224488.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5nnnhh.exec:\5nnnhh.exe62⤵
- Executes dropped EXE
PID:3212 -
\??\c:\ttnhbb.exec:\ttnhbb.exe63⤵
- Executes dropped EXE
PID:880 -
\??\c:\g4448.exec:\g4448.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\2804884.exec:\2804884.exe65⤵
- Executes dropped EXE
PID:1172 -
\??\c:\486628.exec:\486628.exe66⤵PID:2840
-
\??\c:\thhbtt.exec:\thhbtt.exe67⤵PID:3356
-
\??\c:\q88822.exec:\q88822.exe68⤵PID:1656
-
\??\c:\xlxfffl.exec:\xlxfffl.exe69⤵PID:2768
-
\??\c:\280004.exec:\280004.exe70⤵PID:1584
-
\??\c:\2244062.exec:\2244062.exe71⤵PID:3348
-
\??\c:\bttnhb.exec:\bttnhb.exe72⤵PID:4240
-
\??\c:\hhhbtt.exec:\hhhbtt.exe73⤵PID:4560
-
\??\c:\bhhbtt.exec:\bhhbtt.exe74⤵PID:2028
-
\??\c:\vvddd.exec:\vvddd.exe75⤵PID:3384
-
\??\c:\rflxllf.exec:\rflxllf.exe76⤵PID:2432
-
\??\c:\4442664.exec:\4442664.exe77⤵PID:3968
-
\??\c:\8022226.exec:\8022226.exe78⤵PID:1840
-
\??\c:\824406.exec:\824406.exe79⤵PID:3260
-
\??\c:\tbbnhh.exec:\tbbnhh.exe80⤵PID:4072
-
\??\c:\822266.exec:\822266.exe81⤵PID:4252
-
\??\c:\bttnhh.exec:\bttnhh.exe82⤵PID:184
-
\??\c:\hnhhhh.exec:\hnhhhh.exe83⤵PID:3328
-
\??\c:\202222.exec:\202222.exe84⤵PID:4808
-
\??\c:\4282660.exec:\4282660.exe85⤵PID:1020
-
\??\c:\jjpjj.exec:\jjpjj.exe86⤵PID:1456
-
\??\c:\pdjjj.exec:\pdjjj.exe87⤵PID:4284
-
\??\c:\0860006.exec:\0860006.exe88⤵PID:2484
-
\??\c:\280044.exec:\280044.exe89⤵PID:4664
-
\??\c:\4866660.exec:\4866660.exe90⤵PID:3732
-
\??\c:\fxxrlll.exec:\fxxrlll.exe91⤵PID:3628
-
\??\c:\c000444.exec:\c000444.exe92⤵PID:3620
-
\??\c:\0466228.exec:\0466228.exe93⤵PID:2536
-
\??\c:\8448226.exec:\8448226.exe94⤵PID:5104
-
\??\c:\26888.exec:\26888.exe95⤵PID:3560
-
\??\c:\pdpdv.exec:\pdpdv.exe96⤵PID:4912
-
\??\c:\8466000.exec:\8466000.exe97⤵PID:3552
-
\??\c:\7vvpj.exec:\7vvpj.exe98⤵PID:2388
-
\??\c:\9lllxxx.exec:\9lllxxx.exe99⤵PID:1692
-
\??\c:\ppvjd.exec:\ppvjd.exe100⤵PID:1008
-
\??\c:\jdjdj.exec:\jdjdj.exe101⤵PID:1452
-
\??\c:\lrxrllf.exec:\lrxrllf.exe102⤵PID:3468
-
\??\c:\1lrrrrl.exec:\1lrrrrl.exe103⤵PID:3672
-
\??\c:\lfffrxl.exec:\lfffrxl.exe104⤵PID:1824
-
\??\c:\680046.exec:\680046.exe105⤵PID:4732
-
\??\c:\fffxrfl.exec:\fffxrfl.exe106⤵PID:5112
-
\??\c:\hbhhbb.exec:\hbhhbb.exe107⤵PID:4676
-
\??\c:\a6826.exec:\a6826.exe108⤵PID:3792
-
\??\c:\5rlfxrr.exec:\5rlfxrr.exe109⤵PID:1216
-
\??\c:\7xfxfff.exec:\7xfxfff.exe110⤵PID:1472
-
\??\c:\ddppp.exec:\ddppp.exe111⤵PID:3976
-
\??\c:\u406440.exec:\u406440.exe112⤵PID:4692
-
\??\c:\m6888.exec:\m6888.exe113⤵PID:3692
-
\??\c:\606666.exec:\606666.exe114⤵PID:4880
-
\??\c:\a2222.exec:\a2222.exe115⤵PID:3808
-
\??\c:\dppdj.exec:\dppdj.exe116⤵PID:4536
-
\??\c:\nnbnbb.exec:\nnbnbb.exe117⤵PID:3636
-
\??\c:\460488.exec:\460488.exe118⤵PID:556
-
\??\c:\62848.exec:\62848.exe119⤵PID:2028
-
\??\c:\204248.exec:\204248.exe120⤵PID:2316
-
\??\c:\bhnnnh.exec:\bhnnnh.exe121⤵PID:4728
-
\??\c:\40604.exec:\40604.exe122⤵PID:1268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-