Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa.exe
-
Size
65KB
-
MD5
1530a5d886fcdb79652394453b2ae139
-
SHA1
536935f1c33c361a7140957f5668203154f0ee83
-
SHA256
8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa
-
SHA512
e2b44f181d0b65755591a7e194ed7ec82a4191b701c5158260c17ea99956de41da3b41742bb28f6e97adc2a5e08bbd03747b4a9a010afeee478acf9693b5fdc0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqf5:ymb3NkkiQ3mdBjFI4Vt
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3592-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/3592-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4220-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3248-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3644-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1800-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/664-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/664-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/664-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1256-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2836-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2124-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2124-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2264-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3324-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2964-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3972-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/756-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2484-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4596-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3928-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/880-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/376-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2536-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/320-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2436-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2960-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4220 xrrrlfx.exe 3248 nhhbtt.exe 3644 pjvvv.exe 1800 lrfxfrl.exe 664 thtbhh.exe 3892 xlxfflr.exe 2372 hhttnb.exe 1256 dvvvv.exe 2836 rlrfllf.exe 2124 hthntt.exe 2264 vdddj.exe 848 fxrlrrr.exe 3324 hhnnnt.exe 3196 fxrlxxl.exe 2964 7frrllx.exe 3972 hhhtnn.exe 3628 jjjdd.exe 2568 7rfffrx.exe 4016 ttttth.exe 60 3tbtnt.exe 756 jdjdj.exe 4596 ffxxfff.exe 2484 ffflrxf.exe 3928 hthhnt.exe 880 ttbbhn.exe 3124 lfrxxxx.exe 376 rrxxfff.exe 2536 5nbnth.exe 320 jpppj.exe 2436 ppvvj.exe 2960 nbhhbb.exe 1368 hbntth.exe 3332 vjppp.exe 2864 xflllrr.exe 4684 xrlxlrx.exe 1648 thnnnh.exe 1904 vjvpp.exe 4416 jdddd.exe 1708 lxfffff.exe 3240 fflrlrr.exe 4220 nbnntb.exe 1308 5djdv.exe 1800 lfxlxfl.exe 1064 3tttbh.exe 4768 nnnhnh.exe 4692 vvjpv.exe 4732 llrxrrr.exe 1420 rrffrfx.exe 100 hnnnnn.exe 1348 hbhbtn.exe 4916 7jjjd.exe 1596 ffllrfl.exe 4196 rlxxffl.exe 3128 tthhtt.exe 2476 5nbttt.exe 4988 jjpjj.exe 4452 vpvpj.exe 4200 1fllfll.exe 2364 bbtbnn.exe 2348 btnhbh.exe 2568 pjvvp.exe 3452 vvvvv.exe 652 rrlfflf.exe 1104 xlxxxff.exe -
resource yara_rule behavioral2/memory/3592-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3592 wrote to memory of 4220 3592 8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa.exe 83 PID 3592 wrote to memory of 4220 3592 8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa.exe 83 PID 3592 wrote to memory of 4220 3592 8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa.exe 83 PID 4220 wrote to memory of 3248 4220 xrrrlfx.exe 84 PID 4220 wrote to memory of 3248 4220 xrrrlfx.exe 84 PID 4220 wrote to memory of 3248 4220 xrrrlfx.exe 84 PID 3248 wrote to memory of 3644 3248 nhhbtt.exe 85 PID 3248 wrote to memory of 3644 3248 nhhbtt.exe 85 PID 3248 wrote to memory of 3644 3248 nhhbtt.exe 85 PID 3644 wrote to memory of 1800 3644 pjvvv.exe 86 PID 3644 wrote to memory of 1800 3644 pjvvv.exe 86 PID 3644 wrote to memory of 1800 3644 pjvvv.exe 86 PID 1800 wrote to memory of 664 1800 lrfxfrl.exe 87 PID 1800 wrote to memory of 664 1800 lrfxfrl.exe 87 PID 1800 wrote to memory of 664 1800 lrfxfrl.exe 87 PID 664 wrote to memory of 3892 664 thtbhh.exe 88 PID 664 wrote to memory of 3892 664 thtbhh.exe 88 PID 664 wrote to memory of 3892 664 thtbhh.exe 88 PID 3892 wrote to memory of 2372 3892 xlxfflr.exe 89 PID 3892 wrote to memory of 2372 3892 xlxfflr.exe 89 PID 3892 wrote to memory of 2372 3892 xlxfflr.exe 89 PID 2372 wrote to memory of 1256 2372 hhttnb.exe 90 PID 2372 wrote to memory of 1256 2372 hhttnb.exe 90 PID 2372 wrote to memory of 1256 2372 hhttnb.exe 90 PID 1256 wrote to memory of 2836 1256 dvvvv.exe 91 PID 1256 wrote to memory of 2836 1256 dvvvv.exe 91 PID 1256 wrote to memory of 2836 1256 dvvvv.exe 91 PID 2836 wrote to memory of 2124 2836 rlrfllf.exe 92 PID 2836 wrote to memory of 2124 2836 rlrfllf.exe 92 PID 2836 wrote to memory of 2124 2836 rlrfllf.exe 92 PID 2124 wrote to memory of 2264 2124 hthntt.exe 93 PID 2124 wrote to memory of 2264 2124 hthntt.exe 93 PID 2124 wrote to memory of 2264 2124 hthntt.exe 93 PID 2264 wrote to memory of 848 2264 vdddj.exe 94 PID 2264 wrote to memory of 848 2264 vdddj.exe 94 PID 2264 wrote to memory of 848 2264 vdddj.exe 94 PID 848 wrote to memory of 3324 848 fxrlrrr.exe 95 PID 848 wrote to memory of 3324 848 fxrlrrr.exe 95 PID 848 wrote to memory of 3324 848 fxrlrrr.exe 95 PID 3324 wrote to memory of 3196 3324 hhnnnt.exe 96 PID 3324 wrote to memory of 3196 3324 hhnnnt.exe 96 PID 3324 wrote to memory of 3196 3324 hhnnnt.exe 96 PID 3196 wrote to memory of 2964 3196 fxrlxxl.exe 97 PID 3196 wrote to memory of 2964 3196 fxrlxxl.exe 97 PID 3196 wrote to memory of 2964 3196 fxrlxxl.exe 97 PID 2964 wrote to memory of 3972 2964 7frrllx.exe 98 PID 2964 wrote to memory of 3972 2964 7frrllx.exe 98 PID 2964 wrote to memory of 3972 2964 7frrllx.exe 98 PID 3972 wrote to memory of 3628 3972 hhhtnn.exe 99 PID 3972 wrote to memory of 3628 3972 hhhtnn.exe 99 PID 3972 wrote to memory of 3628 3972 hhhtnn.exe 99 PID 3628 wrote to memory of 2568 3628 jjjdd.exe 100 PID 3628 wrote to memory of 2568 3628 jjjdd.exe 100 PID 3628 wrote to memory of 2568 3628 jjjdd.exe 100 PID 2568 wrote to memory of 4016 2568 7rfffrx.exe 101 PID 2568 wrote to memory of 4016 2568 7rfffrx.exe 101 PID 2568 wrote to memory of 4016 2568 7rfffrx.exe 101 PID 4016 wrote to memory of 60 4016 ttttth.exe 102 PID 4016 wrote to memory of 60 4016 ttttth.exe 102 PID 4016 wrote to memory of 60 4016 ttttth.exe 102 PID 60 wrote to memory of 756 60 3tbtnt.exe 103 PID 60 wrote to memory of 756 60 3tbtnt.exe 103 PID 60 wrote to memory of 756 60 3tbtnt.exe 103 PID 756 wrote to memory of 4596 756 jdjdj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa.exe"C:\Users\Admin\AppData\Local\Temp\8d4fab20b863424a805a869cf0342191a3c4e2c4252f6e70ff27d4dc66392bfa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\xrrrlfx.exec:\xrrrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\nhhbtt.exec:\nhhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\pjvvv.exec:\pjvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\lrfxfrl.exec:\lrfxfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\thtbhh.exec:\thtbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\xlxfflr.exec:\xlxfflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\hhttnb.exec:\hhttnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\dvvvv.exec:\dvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\rlrfllf.exec:\rlrfllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hthntt.exec:\hthntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vdddj.exec:\vdddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\fxrlrrr.exec:\fxrlrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\hhnnnt.exec:\hhnnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\fxrlxxl.exec:\fxrlxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\7frrllx.exec:\7frrllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\hhhtnn.exec:\hhhtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jjjdd.exec:\jjjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\7rfffrx.exec:\7rfffrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ttttth.exec:\ttttth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\3tbtnt.exec:\3tbtnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\jdjdj.exec:\jdjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\ffxxfff.exec:\ffxxfff.exe23⤵
- Executes dropped EXE
PID:4596 -
\??\c:\ffflrxf.exec:\ffflrxf.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hthhnt.exec:\hthhnt.exe25⤵
- Executes dropped EXE
PID:3928 -
\??\c:\ttbbhn.exec:\ttbbhn.exe26⤵
- Executes dropped EXE
PID:880 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe27⤵
- Executes dropped EXE
PID:3124 -
\??\c:\rrxxfff.exec:\rrxxfff.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\5nbnth.exec:\5nbnth.exe29⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jpppj.exec:\jpppj.exe30⤵
- Executes dropped EXE
PID:320 -
\??\c:\ppvvj.exec:\ppvvj.exe31⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nbhhbb.exec:\nbhhbb.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbntth.exec:\hbntth.exe33⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vjppp.exec:\vjppp.exe34⤵
- Executes dropped EXE
PID:3332 -
\??\c:\xflllrr.exec:\xflllrr.exe35⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe36⤵
- Executes dropped EXE
PID:4684 -
\??\c:\thnnnh.exec:\thnnnh.exe37⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vjvpp.exec:\vjvpp.exe38⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdddd.exec:\jdddd.exe39⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lxfffff.exec:\lxfffff.exe40⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fflrlrr.exec:\fflrlrr.exe41⤵
- Executes dropped EXE
PID:3240 -
\??\c:\nbnntb.exec:\nbnntb.exe42⤵
- Executes dropped EXE
PID:4220 -
\??\c:\5djdv.exec:\5djdv.exe43⤵
- Executes dropped EXE
PID:1308 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3tttbh.exec:\3tttbh.exe45⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nnnhnh.exec:\nnnhnh.exe46⤵
- Executes dropped EXE
PID:4768 -
\??\c:\vvjpv.exec:\vvjpv.exe47⤵
- Executes dropped EXE
PID:4692 -
\??\c:\llrxrrr.exec:\llrxrrr.exe48⤵
- Executes dropped EXE
PID:4732 -
\??\c:\rrffrfx.exec:\rrffrfx.exe49⤵
- Executes dropped EXE
PID:1420 -
\??\c:\hnnnnn.exec:\hnnnnn.exe50⤵
- Executes dropped EXE
PID:100 -
\??\c:\hbhbtn.exec:\hbhbtn.exe51⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7jjjd.exec:\7jjjd.exe52⤵
- Executes dropped EXE
PID:4916 -
\??\c:\ffllrfl.exec:\ffllrfl.exe53⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rlxxffl.exec:\rlxxffl.exe54⤵
- Executes dropped EXE
PID:4196 -
\??\c:\tthhtt.exec:\tthhtt.exe55⤵
- Executes dropped EXE
PID:3128 -
\??\c:\5nbttt.exec:\5nbttt.exe56⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jjpjj.exec:\jjpjj.exe57⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vpvpj.exec:\vpvpj.exe58⤵
- Executes dropped EXE
PID:4452 -
\??\c:\1fllfll.exec:\1fllfll.exe59⤵
- Executes dropped EXE
PID:4200 -
\??\c:\bbtbnn.exec:\bbtbnn.exe60⤵
- Executes dropped EXE
PID:2364 -
\??\c:\btnhbh.exec:\btnhbh.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pjvvp.exec:\pjvvp.exe62⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vvvvv.exec:\vvvvv.exe63⤵
- Executes dropped EXE
PID:3452 -
\??\c:\rrlfflf.exec:\rrlfflf.exe64⤵
- Executes dropped EXE
PID:652 -
\??\c:\xlxxxff.exec:\xlxxxff.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe66⤵PID:1404
-
\??\c:\nbnnhh.exec:\nbnnhh.exe67⤵PID:1724
-
\??\c:\bnnnnt.exec:\bnnnnt.exe68⤵PID:3708
-
\??\c:\vvddp.exec:\vvddp.exe69⤵PID:1300
-
\??\c:\jpdpp.exec:\jpdpp.exe70⤵PID:4472
-
\??\c:\5rxxxfr.exec:\5rxxxfr.exe71⤵PID:4808
-
\??\c:\xrffllf.exec:\xrffllf.exe72⤵PID:4128
-
\??\c:\9nttnt.exec:\9nttnt.exe73⤵PID:4912
-
\??\c:\7bbbbh.exec:\7bbbbh.exe74⤵PID:1536
-
\??\c:\vvjdd.exec:\vvjdd.exe75⤵PID:544
-
\??\c:\vvvvv.exec:\vvvvv.exe76⤵PID:3996
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe77⤵PID:5020
-
\??\c:\rxrrxxl.exec:\rxrrxxl.exe78⤵PID:3572
-
\??\c:\btbbhn.exec:\btbbhn.exe79⤵PID:4492
-
\??\c:\hthhhh.exec:\hthhhh.exe80⤵PID:5012
-
\??\c:\vpppj.exec:\vpppj.exe81⤵PID:680
-
\??\c:\pvjjd.exec:\pvjjd.exe82⤵PID:4684
-
\??\c:\lrxrxfr.exec:\lrxrxfr.exe83⤵PID:1416
-
\??\c:\xlllrlr.exec:\xlllrlr.exe84⤵PID:4340
-
\??\c:\nnhnnt.exec:\nnhnnt.exe85⤵PID:3816
-
\??\c:\ddpjv.exec:\ddpjv.exe86⤵PID:1556
-
\??\c:\pjvdv.exec:\pjvdv.exe87⤵PID:3968
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe88⤵PID:1684
-
\??\c:\ffxxxrl.exec:\ffxxxrl.exe89⤵PID:1036
-
\??\c:\bttnbt.exec:\bttnbt.exe90⤵PID:1072
-
\??\c:\tttnhb.exec:\tttnhb.exe91⤵PID:4784
-
\??\c:\ddjjv.exec:\ddjjv.exe92⤵PID:4292
-
\??\c:\jjjdv.exec:\jjjdv.exe93⤵PID:1944
-
\??\c:\llrlllf.exec:\llrlllf.exe94⤵PID:2480
-
\??\c:\7hnnnn.exec:\7hnnnn.exe95⤵PID:1076
-
\??\c:\7hbtnn.exec:\7hbtnn.exe96⤵PID:872
-
\??\c:\jdjdp.exec:\jdjdp.exe97⤵PID:3604
-
\??\c:\pddvj.exec:\pddvj.exe98⤵PID:2264
-
\??\c:\9fxxxxf.exec:\9fxxxxf.exe99⤵PID:4564
-
\??\c:\tnnttb.exec:\tnnttb.exe100⤵PID:3952
-
\??\c:\dpvdd.exec:\dpvdd.exe101⤵PID:5092
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe102⤵PID:4704
-
\??\c:\7nnhbb.exec:\7nnhbb.exe103⤵PID:624
-
\??\c:\nhbbtt.exec:\nhbbtt.exe104⤵PID:3980
-
\??\c:\vvvpp.exec:\vvvpp.exe105⤵PID:1916
-
\??\c:\vddjd.exec:\vddjd.exe106⤵PID:736
-
\??\c:\7lllfll.exec:\7lllfll.exe107⤵PID:1720
-
\??\c:\frfrrrx.exec:\frfrrrx.exe108⤵PID:4144
-
\??\c:\nntnnt.exec:\nntnnt.exe109⤵PID:740
-
\??\c:\tnbtnt.exec:\tnbtnt.exe110⤵PID:1676
-
\??\c:\pvpjj.exec:\pvpjj.exe111⤵PID:1840
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe112⤵PID:1404
-
\??\c:\1bnbtn.exec:\1bnbtn.exe113⤵PID:1724
-
\??\c:\vdppd.exec:\vdppd.exe114⤵PID:3708
-
\??\c:\rfxxlxf.exec:\rfxxlxf.exe115⤵PID:1300
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe116⤵PID:3752
-
\??\c:\bhnttt.exec:\bhnttt.exe117⤵PID:2644
-
\??\c:\nnbbbh.exec:\nnbbbh.exe118⤵PID:4128
-
\??\c:\jjdjj.exec:\jjdjj.exe119⤵PID:2536
-
\??\c:\dddvv.exec:\dddvv.exe120⤵PID:3964
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe121⤵PID:2292
-
\??\c:\1bbbbb.exec:\1bbbbb.exe122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-