Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 19:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2.exe
-
Size
493KB
-
MD5
aad50f7cc69adafb11e611169038d9bd
-
SHA1
4c38464cd5b8fa4ebcdd60693040b8d56ff0ab24
-
SHA256
1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2
-
SHA512
79e41db71d040835c6c9e83b02702fc1a4083dbb993b6a700a02ded4460ed767f9d450fd73a6af7ad95b2fd90e7968e1ee1903532220980b261d59dd0660fb01
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTbWL5wEpOQ9DRRr:n3C9yMo+S0L9xRnoq7H9QYcmeN9Dj
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2968-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/2968-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3188-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3396-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3556-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/60-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/60-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3544-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3544-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3544-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2408-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2408-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1692-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1692-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2432-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2936-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2044-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/844-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2552-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4128-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3164-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1048-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4852-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2568-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2412-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4444-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3188 1btttb.exe 1504 nhnnnt.exe 3396 vvdvv.exe 1348 xrxxxff.exe 3556 dpddd.exe 60 dpjvp.exe 3544 hhnttt.exe 2408 llfffff.exe 2780 nnnnhn.exe 1692 1rxxxff.exe 2432 ffrrrxr.exe 1644 jdddd.exe 2936 5lrrflf.exe 2044 hhnnnt.exe 844 jvjdd.exe 3260 rrrrlff.exe 3056 jjjjj.exe 3980 frrrlff.exe 2552 ppvpv.exe 4128 3rrrflx.exe 3164 flxflrx.exe 4440 1htbbh.exe 660 vvddv.exe 1048 fxfxxxr.exe 2980 ddjjp.exe 4852 lrxxxff.exe 2568 pppvp.exe 2412 tnhbbh.exe 4880 7fxxrrl.exe 4444 1lrlllx.exe 1172 nbnntt.exe 1464 xlfxllf.exe 1244 9ddvp.exe 4616 rxlfxlf.exe 4396 bnbtnn.exe 2920 vjddv.exe 3572 xxlffff.exe 1220 ntbtnn.exe 440 dvddd.exe 1492 rfxfrrr.exe 3504 fxxxfrf.exe 3396 1djjp.exe 3604 rflfxrf.exe 3232 5tbnnb.exe 3168 ppjdj.exe 2440 frfxflf.exe 3700 9thbnh.exe 1264 djpvv.exe 2408 frfxxfx.exe 5016 btbnbt.exe 4100 3vvdj.exe 428 xxxrlll.exe 1400 fffffff.exe 4080 bbbbbh.exe 3648 lflllrr.exe 544 vpddd.exe 4296 lxlfffl.exe 760 httnhb.exe 1360 dvpdv.exe 3260 9xxxxff.exe 2976 llffflr.exe 700 bthbbb.exe 2428 pjppp.exe 5084 5llllrr.exe -
resource yara_rule behavioral2/memory/2968-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3188 2968 1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2.exe 82 PID 2968 wrote to memory of 3188 2968 1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2.exe 82 PID 2968 wrote to memory of 3188 2968 1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2.exe 82 PID 3188 wrote to memory of 1504 3188 1btttb.exe 83 PID 3188 wrote to memory of 1504 3188 1btttb.exe 83 PID 3188 wrote to memory of 1504 3188 1btttb.exe 83 PID 1504 wrote to memory of 3396 1504 nhnnnt.exe 84 PID 1504 wrote to memory of 3396 1504 nhnnnt.exe 84 PID 1504 wrote to memory of 3396 1504 nhnnnt.exe 84 PID 3396 wrote to memory of 1348 3396 vvdvv.exe 85 PID 3396 wrote to memory of 1348 3396 vvdvv.exe 85 PID 3396 wrote to memory of 1348 3396 vvdvv.exe 85 PID 1348 wrote to memory of 3556 1348 xrxxxff.exe 87 PID 1348 wrote to memory of 3556 1348 xrxxxff.exe 87 PID 1348 wrote to memory of 3556 1348 xrxxxff.exe 87 PID 3556 wrote to memory of 60 3556 dpddd.exe 88 PID 3556 wrote to memory of 60 3556 dpddd.exe 88 PID 3556 wrote to memory of 60 3556 dpddd.exe 88 PID 60 wrote to memory of 3544 60 dpjvp.exe 90 PID 60 wrote to memory of 3544 60 dpjvp.exe 90 PID 60 wrote to memory of 3544 60 dpjvp.exe 90 PID 3544 wrote to memory of 2408 3544 hhnttt.exe 91 PID 3544 wrote to memory of 2408 3544 hhnttt.exe 91 PID 3544 wrote to memory of 2408 3544 hhnttt.exe 91 PID 2408 wrote to memory of 2780 2408 llfffff.exe 93 PID 2408 wrote to memory of 2780 2408 llfffff.exe 93 PID 2408 wrote to memory of 2780 2408 llfffff.exe 93 PID 2780 wrote to memory of 1692 2780 nnnnhn.exe 94 PID 2780 wrote to memory of 1692 2780 nnnnhn.exe 94 PID 2780 wrote to memory of 1692 2780 nnnnhn.exe 94 PID 1692 wrote to memory of 2432 1692 1rxxxff.exe 95 PID 1692 wrote to memory of 2432 1692 1rxxxff.exe 95 PID 1692 wrote to memory of 2432 1692 1rxxxff.exe 95 PID 2432 wrote to memory of 1644 2432 ffrrrxr.exe 96 PID 2432 wrote to memory of 1644 2432 ffrrrxr.exe 96 PID 2432 wrote to memory of 1644 2432 ffrrrxr.exe 96 PID 1644 wrote to memory of 2936 1644 jdddd.exe 97 PID 1644 wrote to memory of 2936 1644 jdddd.exe 97 PID 1644 wrote to memory of 2936 1644 jdddd.exe 97 PID 2936 wrote to memory of 2044 2936 5lrrflf.exe 98 PID 2936 wrote to memory of 2044 2936 5lrrflf.exe 98 PID 2936 wrote to memory of 2044 2936 5lrrflf.exe 98 PID 2044 wrote to memory of 844 2044 hhnnnt.exe 99 PID 2044 wrote to memory of 844 2044 hhnnnt.exe 99 PID 2044 wrote to memory of 844 2044 hhnnnt.exe 99 PID 844 wrote to memory of 3260 844 jvjdd.exe 100 PID 844 wrote to memory of 3260 844 jvjdd.exe 100 PID 844 wrote to memory of 3260 844 jvjdd.exe 100 PID 3260 wrote to memory of 3056 3260 rrrrlff.exe 101 PID 3260 wrote to memory of 3056 3260 rrrrlff.exe 101 PID 3260 wrote to memory of 3056 3260 rrrrlff.exe 101 PID 3056 wrote to memory of 3980 3056 jjjjj.exe 102 PID 3056 wrote to memory of 3980 3056 jjjjj.exe 102 PID 3056 wrote to memory of 3980 3056 jjjjj.exe 102 PID 3980 wrote to memory of 2552 3980 frrrlff.exe 103 PID 3980 wrote to memory of 2552 3980 frrrlff.exe 103 PID 3980 wrote to memory of 2552 3980 frrrlff.exe 103 PID 2552 wrote to memory of 4128 2552 ppvpv.exe 104 PID 2552 wrote to memory of 4128 2552 ppvpv.exe 104 PID 2552 wrote to memory of 4128 2552 ppvpv.exe 104 PID 4128 wrote to memory of 3164 4128 3rrrflx.exe 105 PID 4128 wrote to memory of 3164 4128 3rrrflx.exe 105 PID 4128 wrote to memory of 3164 4128 3rrrflx.exe 105 PID 3164 wrote to memory of 4440 3164 flxflrx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2.exe"C:\Users\Admin\AppData\Local\Temp\1bf73a11bdc6e268066415c16dd34acb5ea828f54c8bf1f5ee33a82dd387efe2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1btttb.exec:\1btttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\nhnnnt.exec:\nhnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\vvdvv.exec:\vvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\xrxxxff.exec:\xrxxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\dpddd.exec:\dpddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\dpjvp.exec:\dpjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\hhnttt.exec:\hhnttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\llfffff.exec:\llfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\nnnnhn.exec:\nnnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\1rxxxff.exec:\1rxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\ffrrrxr.exec:\ffrrrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\jdddd.exec:\jdddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\5lrrflf.exec:\5lrrflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\hhnnnt.exec:\hhnnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jvjdd.exec:\jvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rrrrlff.exec:\rrrrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\jjjjj.exec:\jjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\frrrlff.exec:\frrrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\ppvpv.exec:\ppvpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3rrrflx.exec:\3rrrflx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\flxflrx.exec:\flxflrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\1htbbh.exec:\1htbbh.exe23⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vvddv.exec:\vvddv.exe24⤵
- Executes dropped EXE
PID:660 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe25⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ddjjp.exec:\ddjjp.exe26⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lrxxxff.exec:\lrxxxff.exe27⤵
- Executes dropped EXE
PID:4852 -
\??\c:\pppvp.exec:\pppvp.exe28⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tnhbbh.exec:\tnhbbh.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7fxxrrl.exec:\7fxxrrl.exe30⤵
- Executes dropped EXE
PID:4880 -
\??\c:\1lrlllx.exec:\1lrlllx.exe31⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nbnntt.exec:\nbnntt.exe32⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xlfxllf.exec:\xlfxllf.exe33⤵
- Executes dropped EXE
PID:1464 -
\??\c:\9ddvp.exec:\9ddvp.exe34⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rxlfxlf.exec:\rxlfxlf.exe35⤵
- Executes dropped EXE
PID:4616 -
\??\c:\bnbtnn.exec:\bnbtnn.exe36⤵
- Executes dropped EXE
PID:4396 -
\??\c:\vjddv.exec:\vjddv.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xxlffff.exec:\xxlffff.exe38⤵
- Executes dropped EXE
PID:3572 -
\??\c:\ntbtnn.exec:\ntbtnn.exe39⤵
- Executes dropped EXE
PID:1220 -
\??\c:\dvddd.exec:\dvddd.exe40⤵
- Executes dropped EXE
PID:440 -
\??\c:\rfxfrrr.exec:\rfxfrrr.exe41⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxxxfrf.exec:\fxxxfrf.exe42⤵
- Executes dropped EXE
PID:3504 -
\??\c:\1djjp.exec:\1djjp.exe43⤵
- Executes dropped EXE
PID:3396 -
\??\c:\rflfxrf.exec:\rflfxrf.exe44⤵
- Executes dropped EXE
PID:3604 -
\??\c:\5tbnnb.exec:\5tbnnb.exe45⤵
- Executes dropped EXE
PID:3232 -
\??\c:\ppjdj.exec:\ppjdj.exe46⤵
- Executes dropped EXE
PID:3168 -
\??\c:\frfxflf.exec:\frfxflf.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9thbnh.exec:\9thbnh.exe48⤵
- Executes dropped EXE
PID:3700 -
\??\c:\djpvv.exec:\djpvv.exe49⤵
- Executes dropped EXE
PID:1264 -
\??\c:\frfxxfx.exec:\frfxxfx.exe50⤵
- Executes dropped EXE
PID:2408 -
\??\c:\btbnbt.exec:\btbnbt.exe51⤵
- Executes dropped EXE
PID:5016 -
\??\c:\3vvdj.exec:\3vvdj.exe52⤵
- Executes dropped EXE
PID:4100 -
\??\c:\xxxrlll.exec:\xxxrlll.exe53⤵
- Executes dropped EXE
PID:428 -
\??\c:\fffffff.exec:\fffffff.exe54⤵
- Executes dropped EXE
PID:1400 -
\??\c:\bbbbbh.exec:\bbbbbh.exe55⤵
- Executes dropped EXE
PID:4080 -
\??\c:\lflllrr.exec:\lflllrr.exe56⤵
- Executes dropped EXE
PID:3648 -
\??\c:\vpddd.exec:\vpddd.exe57⤵
- Executes dropped EXE
PID:544 -
\??\c:\lxlfffl.exec:\lxlfffl.exe58⤵
- Executes dropped EXE
PID:4296 -
\??\c:\httnhb.exec:\httnhb.exe59⤵
- Executes dropped EXE
PID:760 -
\??\c:\dvpdv.exec:\dvpdv.exe60⤵
- Executes dropped EXE
PID:1360 -
\??\c:\9xxxxff.exec:\9xxxxff.exe61⤵
- Executes dropped EXE
PID:3260 -
\??\c:\llffflr.exec:\llffflr.exe62⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bthbbb.exec:\bthbbb.exe63⤵
- Executes dropped EXE
PID:700 -
\??\c:\pjppp.exec:\pjppp.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5llllrr.exec:\5llllrr.exe65⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nbhnnt.exec:\nbhnnt.exe66⤵PID:1084
-
\??\c:\9hhhhh.exec:\9hhhhh.exe67⤵PID:3864
-
\??\c:\pjpvv.exec:\pjpvv.exe68⤵PID:2864
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe69⤵PID:2144
-
\??\c:\nnnnbb.exec:\nnnnbb.exe70⤵PID:2868
-
\??\c:\5hnnnt.exec:\5hnnnt.exe71⤵PID:1940
-
\??\c:\3vdpd.exec:\3vdpd.exe72⤵PID:3948
-
\??\c:\rrfllfr.exec:\rrfllfr.exe73⤵PID:3760
-
\??\c:\bhthbt.exec:\bhthbt.exe74⤵PID:1908
-
\??\c:\nttttt.exec:\nttttt.exe75⤵PID:5032
-
\??\c:\5pvdd.exec:\5pvdd.exe76⤵PID:4264
-
\??\c:\fxlrxff.exec:\fxlrxff.exe77⤵PID:3868
-
\??\c:\hhbttt.exec:\hhbttt.exe78⤵PID:5048
-
\??\c:\5bhhht.exec:\5bhhht.exe79⤵PID:2136
-
\??\c:\vpjdd.exec:\vpjdd.exe80⤵PID:4492
-
\??\c:\xrxffrr.exec:\xrxffrr.exe81⤵PID:4612
-
\??\c:\rrxffll.exec:\rrxffll.exe82⤵PID:1872
-
\??\c:\nbhhhn.exec:\nbhhhn.exe83⤵PID:1328
-
\??\c:\jdjjv.exec:\jdjjv.exe84⤵PID:4308
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe85⤵PID:440
-
\??\c:\nhhbbh.exec:\nhhbbh.exe86⤵PID:1364
-
\??\c:\hhnhbb.exec:\hhnhbb.exe87⤵PID:1348
-
\??\c:\jjdjv.exec:\jjdjv.exe88⤵PID:3604
-
\??\c:\rlfflfx.exec:\rlfflfx.exe89⤵PID:1984
-
\??\c:\hhnbbn.exec:\hhnbbn.exe90⤵PID:1560
-
\??\c:\ddddj.exec:\ddddj.exe91⤵PID:2880
-
\??\c:\vppvv.exec:\vppvv.exe92⤵PID:3700
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe93⤵PID:4980
-
\??\c:\7hnttt.exec:\7hnttt.exe94⤵PID:2376
-
\??\c:\vpdvd.exec:\vpdvd.exe95⤵PID:1032
-
\??\c:\ppvvj.exec:\ppvvj.exe96⤵PID:4240
-
\??\c:\1rfxxff.exec:\1rfxxff.exe97⤵PID:908
-
\??\c:\bnnnhn.exec:\bnnnhn.exe98⤵PID:3208
-
\??\c:\vjvjv.exec:\vjvjv.exe99⤵PID:4080
-
\??\c:\jdjdd.exec:\jdjdd.exe100⤵PID:4748
-
\??\c:\lrfffll.exec:\lrfffll.exe101⤵PID:544
-
\??\c:\tbhhbh.exec:\tbhhbh.exe102⤵PID:968
-
\??\c:\jdjdj.exec:\jdjdj.exe103⤵PID:5012
-
\??\c:\1rffrxx.exec:\1rffrxx.exe104⤵PID:4592
-
\??\c:\lrxfffl.exec:\lrxfffl.exe105⤵PID:3960
-
\??\c:\bhhhbb.exec:\bhhhbb.exe106⤵PID:3980
-
\??\c:\vddpj.exec:\vddpj.exe107⤵PID:2448
-
\??\c:\xfrxlrf.exec:\xfrxlrf.exe108⤵PID:4808
-
\??\c:\hhhbbb.exec:\hhhbbb.exe109⤵PID:3988
-
\??\c:\dvdjd.exec:\dvdjd.exe110⤵PID:3752
-
\??\c:\rxlllfx.exec:\rxlllfx.exe111⤵PID:3864
-
\??\c:\bbbnbt.exec:\bbbnbt.exe112⤵PID:2864
-
\??\c:\pppvv.exec:\pppvv.exe113⤵PID:2388
-
\??\c:\xrxxxff.exec:\xrxxxff.exe114⤵PID:2868
-
\??\c:\rrlllrl.exec:\rrlllrl.exe115⤵PID:2480
-
\??\c:\hbhbbh.exec:\hbhbbh.exe116⤵PID:2908
-
\??\c:\7djvv.exec:\7djvv.exe117⤵PID:1380
-
\??\c:\fflllrl.exec:\fflllrl.exe118⤵PID:1508
-
\??\c:\ttbbbh.exec:\ttbbbh.exe119⤵PID:432
-
\??\c:\nntbbb.exec:\nntbbb.exe120⤵PID:3764
-
\??\c:\1dvvp.exec:\1dvvp.exe121⤵PID:2324
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe122⤵PID:4272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-