Overview
overview
10Static
static
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
105s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 17:36
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
RAT/31.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
RAT/XClient.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/file.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
Ransomware/default.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Stealers/lumma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240426-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral10/memory/4816-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4216-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2024-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2360-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4932-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2432-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2232-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4052-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/912-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2112-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4948-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1040-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1648-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1548-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4508-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1988-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4480-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1576-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1560-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4736-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4004-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1212-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3744-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3192-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pvjvj.exevjjjd.exerrlfxrl.exenttnhh.exe3ffrlfx.exe3bbttn.exefffxrrl.exe9htbnt.exebthhhn.exejdpjd.exeffxrlll.exehbhhbb.exerxxfxrl.exejpvvp.exefffrrlf.exevjpvp.exelllrrrr.exetttttt.exevvpvj.exexflffxx.exetnnhbb.exentbthh.exe5bnhtt.exe1nnhtt.exebhttnn.exeffffxrl.exexxrrrrr.exexrlfxrl.exehhtnhh.exehhbhbh.exexxxrxrr.exebhttbb.exe5xffrrl.exenbnhhh.exevjvpp.exexxffffx.exebnhbtn.exedjvpv.exexflfrrl.exenhbbnn.exedvvpj.exetnntht.exevpppp.exevjjdv.exefxxxxrr.exe9btntt.exevdpjj.exerlrxlrr.exelfrfxlf.exe7ntnnn.exepdvdv.exelffxxrr.exefxxxrxr.exe7bhbtt.exe7tnhbb.exe3dddd.exe5xfffff.exerrlfffx.exe1bnntb.exe9tnnth.exe9vvpp.exejjvpv.exerlxrrrl.exebtnnnh.exepid process 4216 pvjvj.exe 2360 vjjjd.exe 2024 rrlfxrl.exe 4932 nttnhh.exe 2432 3ffrlfx.exe 2232 3bbttn.exe 4052 fffxrrl.exe 912 9htbnt.exe 2112 bthhhn.exe 4948 jdpjd.exe 1040 ffxrlll.exe 1648 hbhhbb.exe 1548 rxxfxrl.exe 5048 jpvvp.exe 4508 fffrrlf.exe 1988 vjpvp.exe 4480 lllrrrr.exe 1504 tttttt.exe 1576 vvpvj.exe 3436 xflffxx.exe 1560 tnnhbb.exe 4736 ntbthh.exe 4004 5bnhtt.exe 3228 1nnhtt.exe 1212 bhttnn.exe 4916 ffffxrl.exe 3720 xxrrrrr.exe 3744 xrlfxrl.exe 3188 hhtnhh.exe 3192 hhbhbh.exe 4584 xxxrxrr.exe 1592 bhttbb.exe 4604 5xffrrl.exe 5016 nbnhhh.exe 3484 vjvpp.exe 4440 xxffffx.exe 1312 bnhbtn.exe 2524 djvpv.exe 4216 xflfrrl.exe 2852 nhbbnn.exe 1752 dvvpj.exe 2360 tnntht.exe 4828 vpppp.exe 4712 vjjdv.exe 1656 fxxxxrr.exe 2156 9btntt.exe 1392 vdpjj.exe 3908 rlrxlrr.exe 1884 lfrfxlf.exe 3832 7ntnnn.exe 2112 pdvdv.exe 5116 lffxxrr.exe 4948 fxxxrxr.exe 4408 7bhbtt.exe 3764 7tnhbb.exe 1080 3dddd.exe 2408 5xfffff.exe 4724 rrlfffx.exe 440 1bnntb.exe 1504 9tnnth.exe 4928 9vvpp.exe 4436 jjvpv.exe 4140 rlxrrrl.exe 1560 btnnnh.exe -
Processes:
resource yara_rule behavioral10/memory/4816-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4216-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4216-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2024-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2360-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4932-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2432-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2232-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4052-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/912-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2112-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4948-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1040-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1648-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1548-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4508-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1988-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4480-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1576-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1560-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4736-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4004-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1212-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3744-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3192-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exepvjvj.exevjjjd.exerrlfxrl.exenttnhh.exe3ffrlfx.exe3bbttn.exefffxrrl.exe9htbnt.exebthhhn.exejdpjd.exeffxrlll.exehbhhbb.exerxxfxrl.exejpvvp.exefffrrlf.exevjpvp.exelllrrrr.exetttttt.exevvpvj.exexflffxx.exetnnhbb.exedescription pid process target process PID 4816 wrote to memory of 4216 4816 BlackMoon.exe pvjvj.exe PID 4816 wrote to memory of 4216 4816 BlackMoon.exe pvjvj.exe PID 4816 wrote to memory of 4216 4816 BlackMoon.exe pvjvj.exe PID 4216 wrote to memory of 2360 4216 pvjvj.exe vjjjd.exe PID 4216 wrote to memory of 2360 4216 pvjvj.exe vjjjd.exe PID 4216 wrote to memory of 2360 4216 pvjvj.exe vjjjd.exe PID 2360 wrote to memory of 2024 2360 vjjjd.exe rrlfxrl.exe PID 2360 wrote to memory of 2024 2360 vjjjd.exe rrlfxrl.exe PID 2360 wrote to memory of 2024 2360 vjjjd.exe rrlfxrl.exe PID 2024 wrote to memory of 4932 2024 rrlfxrl.exe nttnhh.exe PID 2024 wrote to memory of 4932 2024 rrlfxrl.exe nttnhh.exe PID 2024 wrote to memory of 4932 2024 rrlfxrl.exe nttnhh.exe PID 4932 wrote to memory of 2432 4932 nttnhh.exe 3ffrlfx.exe PID 4932 wrote to memory of 2432 4932 nttnhh.exe 3ffrlfx.exe PID 4932 wrote to memory of 2432 4932 nttnhh.exe 3ffrlfx.exe PID 2432 wrote to memory of 2232 2432 3ffrlfx.exe 3bbttn.exe PID 2432 wrote to memory of 2232 2432 3ffrlfx.exe 3bbttn.exe PID 2432 wrote to memory of 2232 2432 3ffrlfx.exe 3bbttn.exe PID 2232 wrote to memory of 4052 2232 3bbttn.exe fffxrrl.exe PID 2232 wrote to memory of 4052 2232 3bbttn.exe fffxrrl.exe PID 2232 wrote to memory of 4052 2232 3bbttn.exe fffxrrl.exe PID 4052 wrote to memory of 912 4052 fffxrrl.exe 9htbnt.exe PID 4052 wrote to memory of 912 4052 fffxrrl.exe 9htbnt.exe PID 4052 wrote to memory of 912 4052 fffxrrl.exe 9htbnt.exe PID 912 wrote to memory of 2112 912 9htbnt.exe bthhhn.exe PID 912 wrote to memory of 2112 912 9htbnt.exe bthhhn.exe PID 912 wrote to memory of 2112 912 9htbnt.exe bthhhn.exe PID 2112 wrote to memory of 4948 2112 bthhhn.exe jdpjd.exe PID 2112 wrote to memory of 4948 2112 bthhhn.exe jdpjd.exe PID 2112 wrote to memory of 4948 2112 bthhhn.exe jdpjd.exe PID 4948 wrote to memory of 1040 4948 jdpjd.exe ffxrlll.exe PID 4948 wrote to memory of 1040 4948 jdpjd.exe ffxrlll.exe PID 4948 wrote to memory of 1040 4948 jdpjd.exe ffxrlll.exe PID 1040 wrote to memory of 1648 1040 ffxrlll.exe hbhhbb.exe PID 1040 wrote to memory of 1648 1040 ffxrlll.exe hbhhbb.exe PID 1040 wrote to memory of 1648 1040 ffxrlll.exe hbhhbb.exe PID 1648 wrote to memory of 1548 1648 hbhhbb.exe rxxfxrl.exe PID 1648 wrote to memory of 1548 1648 hbhhbb.exe rxxfxrl.exe PID 1648 wrote to memory of 1548 1648 hbhhbb.exe rxxfxrl.exe PID 1548 wrote to memory of 5048 1548 rxxfxrl.exe jpvvp.exe PID 1548 wrote to memory of 5048 1548 rxxfxrl.exe jpvvp.exe PID 1548 wrote to memory of 5048 1548 rxxfxrl.exe jpvvp.exe PID 5048 wrote to memory of 4508 5048 jpvvp.exe fffrrlf.exe PID 5048 wrote to memory of 4508 5048 jpvvp.exe fffrrlf.exe PID 5048 wrote to memory of 4508 5048 jpvvp.exe fffrrlf.exe PID 4508 wrote to memory of 1988 4508 fffrrlf.exe vjpvp.exe PID 4508 wrote to memory of 1988 4508 fffrrlf.exe vjpvp.exe PID 4508 wrote to memory of 1988 4508 fffrrlf.exe vjpvp.exe PID 1988 wrote to memory of 4480 1988 vjpvp.exe lllrrrr.exe PID 1988 wrote to memory of 4480 1988 vjpvp.exe lllrrrr.exe PID 1988 wrote to memory of 4480 1988 vjpvp.exe lllrrrr.exe PID 4480 wrote to memory of 1504 4480 lllrrrr.exe tttttt.exe PID 4480 wrote to memory of 1504 4480 lllrrrr.exe tttttt.exe PID 4480 wrote to memory of 1504 4480 lllrrrr.exe tttttt.exe PID 1504 wrote to memory of 1576 1504 tttttt.exe vvpvj.exe PID 1504 wrote to memory of 1576 1504 tttttt.exe vvpvj.exe PID 1504 wrote to memory of 1576 1504 tttttt.exe vvpvj.exe PID 1576 wrote to memory of 3436 1576 vvpvj.exe xflffxx.exe PID 1576 wrote to memory of 3436 1576 vvpvj.exe xflffxx.exe PID 1576 wrote to memory of 3436 1576 vvpvj.exe xflffxx.exe PID 3436 wrote to memory of 1560 3436 xflffxx.exe tnnhbb.exe PID 3436 wrote to memory of 1560 3436 xflffxx.exe tnnhbb.exe PID 3436 wrote to memory of 1560 3436 xflffxx.exe tnnhbb.exe PID 1560 wrote to memory of 4736 1560 tnnhbb.exe ntbthh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\pvjvj.exec:\pvjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\vjjjd.exec:\vjjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\nttnhh.exec:\nttnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\3ffrlfx.exec:\3ffrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\3bbttn.exec:\3bbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\fffxrrl.exec:\fffxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\9htbnt.exec:\9htbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\bthhhn.exec:\bthhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\jdpjd.exec:\jdpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\ffxrlll.exec:\ffxrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\hbhhbb.exec:\hbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\rxxfxrl.exec:\rxxfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\jpvvp.exec:\jpvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\fffrrlf.exec:\fffrrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\vjpvp.exec:\vjpvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\lllrrrr.exec:\lllrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\tttttt.exec:\tttttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\vvpvj.exec:\vvpvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xflffxx.exec:\xflffxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\tnnhbb.exec:\tnnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\ntbthh.exec:\ntbthh.exe23⤵
- Executes dropped EXE
PID:4736 -
\??\c:\5bnhtt.exec:\5bnhtt.exe24⤵
- Executes dropped EXE
PID:4004 -
\??\c:\1nnhtt.exec:\1nnhtt.exe25⤵
- Executes dropped EXE
PID:3228 -
\??\c:\bhttnn.exec:\bhttnn.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ffffxrl.exec:\ffffxrl.exe27⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe28⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe29⤵
- Executes dropped EXE
PID:3744 -
\??\c:\hhtnhh.exec:\hhtnhh.exe30⤵
- Executes dropped EXE
PID:3188 -
\??\c:\hhbhbh.exec:\hhbhbh.exe31⤵
- Executes dropped EXE
PID:3192 -
\??\c:\xxxrxrr.exec:\xxxrxrr.exe32⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bhttbb.exec:\bhttbb.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5xffrrl.exec:\5xffrrl.exe34⤵
- Executes dropped EXE
PID:4604 -
\??\c:\nbnhhh.exec:\nbnhhh.exe35⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vjvpp.exec:\vjvpp.exe36⤵
- Executes dropped EXE
PID:3484 -
\??\c:\xxffffx.exec:\xxffffx.exe37⤵
- Executes dropped EXE
PID:4440 -
\??\c:\bnhbtn.exec:\bnhbtn.exe38⤵
- Executes dropped EXE
PID:1312 -
\??\c:\djvpv.exec:\djvpv.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xflfrrl.exec:\xflfrrl.exe40⤵
- Executes dropped EXE
PID:4216 -
\??\c:\nhbbnn.exec:\nhbbnn.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\dvvpj.exec:\dvvpj.exe42⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tnntht.exec:\tnntht.exe43⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vpppp.exec:\vpppp.exe44⤵
- Executes dropped EXE
PID:4828 -
\??\c:\vjjdv.exec:\vjjdv.exe45⤵
- Executes dropped EXE
PID:4712 -
\??\c:\fxxxxrr.exec:\fxxxxrr.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9btntt.exec:\9btntt.exe47⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vdpjj.exec:\vdpjj.exe48⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rlrxlrr.exec:\rlrxlrr.exe49⤵
- Executes dropped EXE
PID:3908 -
\??\c:\lfrfxlf.exec:\lfrfxlf.exe50⤵
- Executes dropped EXE
PID:1884 -
\??\c:\7ntnnn.exec:\7ntnnn.exe51⤵
- Executes dropped EXE
PID:3832 -
\??\c:\pdvdv.exec:\pdvdv.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lffxxrr.exec:\lffxxrr.exe53⤵
- Executes dropped EXE
PID:5116 -
\??\c:\fxxxrxr.exec:\fxxxrxr.exe54⤵
- Executes dropped EXE
PID:4948 -
\??\c:\7bhbtt.exec:\7bhbtt.exe55⤵
- Executes dropped EXE
PID:4408 -
\??\c:\7tnhbb.exec:\7tnhbb.exe56⤵
- Executes dropped EXE
PID:3764 -
\??\c:\3dddd.exec:\3dddd.exe57⤵
- Executes dropped EXE
PID:1080 -
\??\c:\5xfffff.exec:\5xfffff.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rrlfffx.exec:\rrlfffx.exe59⤵
- Executes dropped EXE
PID:4724 -
\??\c:\1bnntb.exec:\1bnntb.exe60⤵
- Executes dropped EXE
PID:440 -
\??\c:\9tnnth.exec:\9tnnth.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\9vvpp.exec:\9vvpp.exe62⤵
- Executes dropped EXE
PID:4928 -
\??\c:\jjvpv.exec:\jjvpv.exe63⤵
- Executes dropped EXE
PID:4436 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe64⤵
- Executes dropped EXE
PID:4140 -
\??\c:\btnnnh.exec:\btnnnh.exe65⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7nhbtn.exec:\7nhbtn.exe66⤵PID:3996
-
\??\c:\pjpjv.exec:\pjpjv.exe67⤵PID:1152
-
\??\c:\7xxrllf.exec:\7xxrllf.exe68⤵PID:4004
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe69⤵PID:3228
-
\??\c:\7nnntb.exec:\7nnntb.exe70⤵PID:2988
-
\??\c:\vdvvp.exec:\vdvvp.exe71⤵PID:3408
-
\??\c:\jdvdp.exec:\jdvdp.exe72⤵PID:4184
-
\??\c:\llrrrrl.exec:\llrrrrl.exe73⤵PID:2712
-
\??\c:\llrlfxr.exec:\llrlfxr.exe74⤵PID:1020
-
\??\c:\btbbbb.exec:\btbbbb.exe75⤵PID:4768
-
\??\c:\3pdvv.exec:\3pdvv.exe76⤵PID:1056
-
\??\c:\rlllflf.exec:\rlllflf.exe77⤵PID:2848
-
\??\c:\llrlffr.exec:\llrlffr.exe78⤵PID:4584
-
\??\c:\hhnnhb.exec:\hhnnhb.exe79⤵PID:4416
-
\??\c:\pdjdv.exec:\pdjdv.exe80⤵PID:1384
-
\??\c:\dvdjv.exec:\dvdjv.exe81⤵PID:4344
-
\??\c:\xrxrlxr.exec:\xrxrlxr.exe82⤵PID:4816
-
\??\c:\nbhtnh.exec:\nbhtnh.exe83⤵PID:3956
-
\??\c:\nttnhh.exec:\nttnhh.exe84⤵PID:636
-
\??\c:\1djjj.exec:\1djjj.exe85⤵PID:4940
-
\??\c:\7llxrlr.exec:\7llxrlr.exe86⤵PID:4024
-
\??\c:\rxlfxrr.exec:\rxlfxrr.exe87⤵PID:3416
-
\??\c:\btnnhn.exec:\btnnhn.exe88⤵PID:1216
-
\??\c:\pdpvp.exec:\pdpvp.exe89⤵PID:4932
-
\??\c:\9jpjp.exec:\9jpjp.exe90⤵PID:4828
-
\??\c:\vjjdv.exec:\vjjdv.exe91⤵PID:2416
-
\??\c:\jpdjd.exec:\jpdjd.exe92⤵PID:4544
-
\??\c:\frxlfxr.exec:\frxlfxr.exe93⤵PID:4676
-
\??\c:\hbbhbt.exec:\hbbhbt.exe94⤵PID:1688
-
\??\c:\7nttnn.exec:\7nttnn.exe95⤵PID:2428
-
\??\c:\pvpjp.exec:\pvpjp.exe96⤵PID:1884
-
\??\c:\lxffxff.exec:\lxffxff.exe97⤵PID:628
-
\??\c:\1ffxlll.exec:\1ffxlll.exe98⤵PID:1100
-
\??\c:\7bbtnn.exec:\7bbtnn.exe99⤵PID:1768
-
\??\c:\vpvjd.exec:\vpvjd.exe100⤵PID:1552
-
\??\c:\jpddd.exec:\jpddd.exe101⤵PID:2152
-
\??\c:\ffrrffr.exec:\ffrrffr.exe102⤵PID:1080
-
\??\c:\bnnhbt.exec:\bnnhbt.exe103⤵PID:4872
-
\??\c:\nnhbtt.exec:\nnhbtt.exe104⤵PID:4724
-
\??\c:\jjpvj.exec:\jjpvj.exe105⤵PID:440
-
\??\c:\flrlffx.exec:\flrlffx.exe106⤵PID:3360
-
\??\c:\nnhbtt.exec:\nnhbtt.exe107⤵PID:876
-
\??\c:\nhtnhb.exec:\nhtnhb.exe108⤵PID:1980
-
\??\c:\vppdv.exec:\vppdv.exe109⤵PID:1344
-
\??\c:\xlxxxrl.exec:\xlxxxrl.exe110⤵PID:3620
-
\??\c:\ththbb.exec:\ththbb.exe111⤵PID:2588
-
\??\c:\ddjvj.exec:\ddjvj.exe112⤵PID:4456
-
\??\c:\ddjdv.exec:\ddjdv.exe113⤵PID:4004
-
\??\c:\9flfllr.exec:\9flfllr.exe114⤵PID:2764
-
\??\c:\7thbtt.exec:\7thbtt.exe115⤵PID:4148
-
\??\c:\vddjp.exec:\vddjp.exe116⤵PID:2468
-
\??\c:\jjpjp.exec:\jjpjp.exe117⤵PID:3720
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe118⤵PID:1620
-
\??\c:\hhnnbh.exec:\hhnnbh.exe119⤵PID:4464
-
\??\c:\jdvpd.exec:\jdvpd.exe120⤵PID:3504
-
\??\c:\3llfllx.exec:\3llfllx.exe121⤵PID:3992
-
\??\c:\3hbnhb.exec:\3hbnhb.exe122⤵PID:1208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-