Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe
-
Size
75KB
-
MD5
a78ca02feaf82b30f52efe14c47b5a36
-
SHA1
c4ca8ff2f4a86a0172e92fac5d31e2ccfeacf6a6
-
SHA256
b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5
-
SHA512
e18433f7261fb95541b1086141fff76937c1e2bc058eb3c678e90260ae3211d73d9b8f39545b2382f33cc4500cb8a3b76d9df53a4dd01d8a1ecf7a93d2b94e63
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8gu3Gno9yvrjKT:ymb3NkkiQ3mdBjFo68t3Gno9Ig
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3136-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/3136-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2624-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/224-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3024-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/64-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3872-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2676-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1008-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1728-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1728-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1728-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2144-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4220-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/636-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2152-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4912-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4800-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3092-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3408-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3660-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1584-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3260-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1036-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4432-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5084-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4008-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2624 frlxrrl.exe 224 1bnnnb.exe 3024 9vdvj.exe 64 llrrrrx.exe 3872 rlfxrrl.exe 3084 ttttbb.exe 2676 7ppjd.exe 1008 jdpvj.exe 1728 7lrllfx.exe 2144 hbtthb.exe 4220 ppjdv.exe 4560 xllffxf.exe 2152 5llrrrl.exe 636 nhtnhh.exe 4912 dpjdj.exe 4800 vvjvp.exe 3092 7lxrffx.exe 3408 nbttnn.exe 3660 7jjvv.exe 3068 rlrlffx.exe 1488 nhhhbb.exe 3008 hnbtnt.exe 1584 jppjd.exe 3260 5fxrrrl.exe 3120 lffxxrr.exe 1036 hhnnnn.exe 1700 3pddd.exe 4432 djvvj.exe 392 rrflxff.exe 5084 nhbtnt.exe 4008 bttnhb.exe 4396 9pjjv.exe 3152 xffffll.exe 3980 lfrfrlx.exe 3420 nbbttt.exe 4692 httntt.exe 3872 pjjjp.exe 3084 dppjd.exe 1704 xfrfxrl.exe 1912 htbnhh.exe 1952 5htnbt.exe 4476 dpjdj.exe 2936 9xlxlfr.exe 3976 frxfrrl.exe 4320 ntbbnb.exe 3776 jjdvj.exe 4328 9jvpj.exe 4324 rrxxlff.exe 4616 hhbbbt.exe 824 9tnbtn.exe 4912 1ddvv.exe 4800 9jjvp.exe 688 lfxrxxr.exe 704 fxfxxxr.exe 4568 bhhhbb.exe 2668 hhthbb.exe 3048 3djpj.exe 2140 pppjj.exe 2428 3xlfxxx.exe 5108 3bbbtn.exe 3784 hhbhbh.exe 1808 ppppd.exe 2500 jpdvj.exe 4860 rfflxxr.exe -
resource yara_rule behavioral2/memory/3136-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3136 wrote to memory of 2624 3136 b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe 83 PID 3136 wrote to memory of 2624 3136 b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe 83 PID 3136 wrote to memory of 2624 3136 b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe 83 PID 2624 wrote to memory of 224 2624 frlxrrl.exe 84 PID 2624 wrote to memory of 224 2624 frlxrrl.exe 84 PID 2624 wrote to memory of 224 2624 frlxrrl.exe 84 PID 224 wrote to memory of 3024 224 1bnnnb.exe 85 PID 224 wrote to memory of 3024 224 1bnnnb.exe 85 PID 224 wrote to memory of 3024 224 1bnnnb.exe 85 PID 3024 wrote to memory of 64 3024 9vdvj.exe 86 PID 3024 wrote to memory of 64 3024 9vdvj.exe 86 PID 3024 wrote to memory of 64 3024 9vdvj.exe 86 PID 64 wrote to memory of 3872 64 llrrrrx.exe 89 PID 64 wrote to memory of 3872 64 llrrrrx.exe 89 PID 64 wrote to memory of 3872 64 llrrrrx.exe 89 PID 3872 wrote to memory of 3084 3872 rlfxrrl.exe 90 PID 3872 wrote to memory of 3084 3872 rlfxrrl.exe 90 PID 3872 wrote to memory of 3084 3872 rlfxrrl.exe 90 PID 3084 wrote to memory of 2676 3084 ttttbb.exe 91 PID 3084 wrote to memory of 2676 3084 ttttbb.exe 91 PID 3084 wrote to memory of 2676 3084 ttttbb.exe 91 PID 2676 wrote to memory of 1008 2676 7ppjd.exe 92 PID 2676 wrote to memory of 1008 2676 7ppjd.exe 92 PID 2676 wrote to memory of 1008 2676 7ppjd.exe 92 PID 1008 wrote to memory of 1728 1008 jdpvj.exe 93 PID 1008 wrote to memory of 1728 1008 jdpvj.exe 93 PID 1008 wrote to memory of 1728 1008 jdpvj.exe 93 PID 1728 wrote to memory of 2144 1728 7lrllfx.exe 94 PID 1728 wrote to memory of 2144 1728 7lrllfx.exe 94 PID 1728 wrote to memory of 2144 1728 7lrllfx.exe 94 PID 2144 wrote to memory of 4220 2144 hbtthb.exe 95 PID 2144 wrote to memory of 4220 2144 hbtthb.exe 95 PID 2144 wrote to memory of 4220 2144 hbtthb.exe 95 PID 4220 wrote to memory of 4560 4220 ppjdv.exe 96 PID 4220 wrote to memory of 4560 4220 ppjdv.exe 96 PID 4220 wrote to memory of 4560 4220 ppjdv.exe 96 PID 4560 wrote to memory of 2152 4560 xllffxf.exe 97 PID 4560 wrote to memory of 2152 4560 xllffxf.exe 97 PID 4560 wrote to memory of 2152 4560 xllffxf.exe 97 PID 2152 wrote to memory of 636 2152 5llrrrl.exe 98 PID 2152 wrote to memory of 636 2152 5llrrrl.exe 98 PID 2152 wrote to memory of 636 2152 5llrrrl.exe 98 PID 636 wrote to memory of 4912 636 nhtnhh.exe 99 PID 636 wrote to memory of 4912 636 nhtnhh.exe 99 PID 636 wrote to memory of 4912 636 nhtnhh.exe 99 PID 4912 wrote to memory of 4800 4912 dpjdj.exe 100 PID 4912 wrote to memory of 4800 4912 dpjdj.exe 100 PID 4912 wrote to memory of 4800 4912 dpjdj.exe 100 PID 4800 wrote to memory of 3092 4800 vvjvp.exe 101 PID 4800 wrote to memory of 3092 4800 vvjvp.exe 101 PID 4800 wrote to memory of 3092 4800 vvjvp.exe 101 PID 3092 wrote to memory of 3408 3092 7lxrffx.exe 102 PID 3092 wrote to memory of 3408 3092 7lxrffx.exe 102 PID 3092 wrote to memory of 3408 3092 7lxrffx.exe 102 PID 3408 wrote to memory of 3660 3408 nbttnn.exe 103 PID 3408 wrote to memory of 3660 3408 nbttnn.exe 103 PID 3408 wrote to memory of 3660 3408 nbttnn.exe 103 PID 3660 wrote to memory of 3068 3660 7jjvv.exe 104 PID 3660 wrote to memory of 3068 3660 7jjvv.exe 104 PID 3660 wrote to memory of 3068 3660 7jjvv.exe 104 PID 3068 wrote to memory of 1488 3068 rlrlffx.exe 105 PID 3068 wrote to memory of 1488 3068 rlrlffx.exe 105 PID 3068 wrote to memory of 1488 3068 rlrlffx.exe 105 PID 1488 wrote to memory of 3008 1488 nhhhbb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe"C:\Users\Admin\AppData\Local\Temp\b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\frlxrrl.exec:\frlxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\1bnnnb.exec:\1bnnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9vdvj.exec:\9vdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\llrrrrx.exec:\llrrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\ttttbb.exec:\ttttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\7ppjd.exec:\7ppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jdpvj.exec:\jdpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\7lrllfx.exec:\7lrllfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\hbtthb.exec:\hbtthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\ppjdv.exec:\ppjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\xllffxf.exec:\xllffxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\5llrrrl.exec:\5llrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\nhtnhh.exec:\nhtnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\dpjdj.exec:\dpjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\vvjvp.exec:\vvjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\7lxrffx.exec:\7lxrffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\nbttnn.exec:\nbttnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\7jjvv.exec:\7jjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\rlrlffx.exec:\rlrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nhhhbb.exec:\nhhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\hnbtnt.exec:\hnbtnt.exe23⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jppjd.exec:\jppjd.exe24⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5fxrrrl.exec:\5fxrrrl.exe25⤵
- Executes dropped EXE
PID:3260 -
\??\c:\lffxxrr.exec:\lffxxrr.exe26⤵
- Executes dropped EXE
PID:3120 -
\??\c:\hhnnnn.exec:\hhnnnn.exe27⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3pddd.exec:\3pddd.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\djvvj.exec:\djvvj.exe29⤵
- Executes dropped EXE
PID:4432 -
\??\c:\rrflxff.exec:\rrflxff.exe30⤵
- Executes dropped EXE
PID:392 -
\??\c:\nhbtnt.exec:\nhbtnt.exe31⤵
- Executes dropped EXE
PID:5084 -
\??\c:\bttnhb.exec:\bttnhb.exe32⤵
- Executes dropped EXE
PID:4008 -
\??\c:\9pjjv.exec:\9pjjv.exe33⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xffffll.exec:\xffffll.exe34⤵
- Executes dropped EXE
PID:3152 -
\??\c:\lfrfrlx.exec:\lfrfrlx.exe35⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nbbttt.exec:\nbbttt.exe36⤵
- Executes dropped EXE
PID:3420 -
\??\c:\httntt.exec:\httntt.exe37⤵
- Executes dropped EXE
PID:4692 -
\??\c:\pjjjp.exec:\pjjjp.exe38⤵
- Executes dropped EXE
PID:3872 -
\??\c:\dppjd.exec:\dppjd.exe39⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xfrfxrl.exec:\xfrfxrl.exe40⤵
- Executes dropped EXE
PID:1704 -
\??\c:\htbnhh.exec:\htbnhh.exe41⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5htnbt.exec:\5htnbt.exe42⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dpjdj.exec:\dpjdj.exe43⤵
- Executes dropped EXE
PID:4476 -
\??\c:\9xlxlfr.exec:\9xlxlfr.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\frxfrrl.exec:\frxfrrl.exe45⤵
- Executes dropped EXE
PID:3976 -
\??\c:\ntbbnb.exec:\ntbbnb.exe46⤵
- Executes dropped EXE
PID:4320 -
\??\c:\jjdvj.exec:\jjdvj.exe47⤵
- Executes dropped EXE
PID:3776 -
\??\c:\9jvpj.exec:\9jvpj.exe48⤵
- Executes dropped EXE
PID:4328 -
\??\c:\rrxxlff.exec:\rrxxlff.exe49⤵
- Executes dropped EXE
PID:4324 -
\??\c:\hhbbbt.exec:\hhbbbt.exe50⤵
- Executes dropped EXE
PID:4616 -
\??\c:\9tnbtn.exec:\9tnbtn.exe51⤵
- Executes dropped EXE
PID:824 -
\??\c:\1ddvv.exec:\1ddvv.exe52⤵
- Executes dropped EXE
PID:4912 -
\??\c:\9jjvp.exec:\9jjvp.exe53⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lfxrxxr.exec:\lfxrxxr.exe54⤵
- Executes dropped EXE
PID:688 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe55⤵
- Executes dropped EXE
PID:704 -
\??\c:\bhhhbb.exec:\bhhhbb.exe56⤵
- Executes dropped EXE
PID:4568 -
\??\c:\hhthbb.exec:\hhthbb.exe57⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3djpj.exec:\3djpj.exe58⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pppjj.exec:\pppjj.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3xlfxxx.exec:\3xlfxxx.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3bbbtn.exec:\3bbbtn.exe61⤵
- Executes dropped EXE
PID:5108 -
\??\c:\hhbhbh.exec:\hhbhbh.exe62⤵
- Executes dropped EXE
PID:3784 -
\??\c:\ppppd.exec:\ppppd.exe63⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jpdvj.exec:\jpdvj.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rfflxxr.exec:\rfflxxr.exe65⤵
- Executes dropped EXE
PID:4860 -
\??\c:\nbnhbb.exec:\nbnhbb.exe66⤵PID:3840
-
\??\c:\bbbbth.exec:\bbbbth.exe67⤵PID:3640
-
\??\c:\jjdvp.exec:\jjdvp.exe68⤵PID:3344
-
\??\c:\9vdpj.exec:\9vdpj.exe69⤵PID:2056
-
\??\c:\ffffxxx.exec:\ffffxxx.exe70⤵PID:4392
-
\??\c:\xxfrxxr.exec:\xxfrxxr.exe71⤵PID:4292
-
\??\c:\hbbthb.exec:\hbbthb.exe72⤵PID:4748
-
\??\c:\tntnnn.exec:\tntnnn.exe73⤵PID:3748
-
\??\c:\pdpjd.exec:\pdpjd.exe74⤵PID:1528
-
\??\c:\jdvvv.exec:\jdvvv.exe75⤵PID:1784
-
\??\c:\7lfxxxf.exec:\7lfxxxf.exe76⤵PID:1832
-
\??\c:\rlffxxl.exec:\rlffxxl.exe77⤵PID:4412
-
\??\c:\hbbbtt.exec:\hbbbtt.exe78⤵PID:4240
-
\??\c:\3httnn.exec:\3httnn.exe79⤵PID:2648
-
\??\c:\ddjdv.exec:\ddjdv.exe80⤵PID:736
-
\??\c:\pjpjj.exec:\pjpjj.exe81⤵PID:1008
-
\??\c:\rrxfxfx.exec:\rrxfxfx.exe82⤵PID:1952
-
\??\c:\xflllrl.exec:\xflllrl.exe83⤵PID:3564
-
\??\c:\nbbtnn.exec:\nbbtnn.exe84⤵PID:4816
-
\??\c:\nnhhbb.exec:\nnhhbb.exe85⤵PID:3880
-
\??\c:\vjjdv.exec:\vjjdv.exe86⤵PID:2308
-
\??\c:\pjvpd.exec:\pjvpd.exe87⤵PID:3044
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe88⤵PID:2120
-
\??\c:\xrrllff.exec:\xrrllff.exe89⤵PID:4180
-
\??\c:\rxlrxxx.exec:\rxlrxxx.exe90⤵PID:4448
-
\??\c:\1hnhtt.exec:\1hnhtt.exe91⤵PID:3540
-
\??\c:\1tnhbh.exec:\1tnhbh.exe92⤵PID:3092
-
\??\c:\1pvvd.exec:\1pvvd.exe93⤵PID:2052
-
\??\c:\pvdpj.exec:\pvdpj.exe94⤵PID:704
-
\??\c:\rrrlllf.exec:\rrrlllf.exe95⤵PID:4104
-
\??\c:\rxrxxxl.exec:\rxrxxxl.exe96⤵PID:3928
-
\??\c:\hbbbbb.exec:\hbbbbb.exe97⤵PID:3048
-
\??\c:\5nnhth.exec:\5nnhth.exe98⤵PID:1584
-
\??\c:\htnhbt.exec:\htnhbt.exe99⤵PID:4216
-
\??\c:\pdvvp.exec:\pdvvp.exe100⤵PID:4848
-
\??\c:\dvpjj.exec:\dvpjj.exe101⤵PID:4224
-
\??\c:\jddvv.exec:\jddvv.exe102⤵PID:1808
-
\??\c:\ffrxrfr.exec:\ffrxrfr.exe103⤵PID:2500
-
\??\c:\7xfxfff.exec:\7xfxfff.exe104⤵PID:3432
-
\??\c:\thnnnn.exec:\thnnnn.exe105⤵PID:1100
-
\??\c:\bttnnn.exec:\bttnnn.exe106⤵PID:3040
-
\??\c:\jjdvp.exec:\jjdvp.exe107⤵PID:432
-
\??\c:\jjjdp.exec:\jjjdp.exe108⤵PID:2056
-
\??\c:\rrfffff.exec:\rrfffff.exe109⤵PID:4388
-
\??\c:\hnhthb.exec:\hnhthb.exe110⤵PID:4292
-
\??\c:\1hthnh.exec:\1hthnh.exe111⤵PID:3152
-
\??\c:\3pvjj.exec:\3pvjj.exe112⤵PID:3980
-
\??\c:\1rrlflf.exec:\1rrlflf.exe113⤵PID:5100
-
\??\c:\fxfxrlr.exec:\fxfxrlr.exe114⤵PID:3144
-
\??\c:\9bhbht.exec:\9bhbht.exe115⤵PID:4108
-
\??\c:\httbtt.exec:\httbtt.exe116⤵PID:4356
-
\??\c:\pjdvp.exec:\pjdvp.exe117⤵PID:3404
-
\??\c:\vpdvp.exec:\vpdvp.exe118⤵PID:2640
-
\??\c:\lxxrlll.exec:\lxxrlll.exe119⤵PID:3952
-
\??\c:\5tbbbh.exec:\5tbbbh.exe120⤵PID:2948
-
\??\c:\dvjvp.exec:\dvjvp.exe121⤵PID:4688
-
\??\c:\jvvpd.exec:\jvvpd.exe122⤵PID:1308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-