Analysis
- max time kernel
149s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9.exe
- Size 74KB
- Sample240518-csjmsafg31
- SHA256 b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9
- MD5 2b968dc4056f4dd98e46c9bf417cef3a
- SHA1 f6d6da98920110ee1be71d648fbaa095ae7e99a4
- SHA512 8115a4cc3562b2633e60f09f19f6a28427185adc04e8cf08b750d898090b2bf40c580ef838bedc4ee10f79d8742d6f5ff5462a2feec9d8997c858a48cf2c8162
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqKFx:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqKFx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2152-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/2152-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2152-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3456-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3700-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1416-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1416-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3304-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1032-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1032-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2164-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2124-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/836-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/836-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/836-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4112-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4364-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5104-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2856-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2724-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3756-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4536-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2532-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4532-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4204-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4748-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3632-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3456 pvjdj.exe 3700 xlrfxxx.exe 1416 hnnntt.exe 3304 dpvpp.exe 1032 xlxxlll.exe 2316 7nnhhb.exe 2164 nhtttt.exe 3068 jdppp.exe 2124 lxflfff.exe 836 nthnnn.exe 2284 vppjj.exe 4112 pjjdp.exe 4364 xxxxfxx.exe 5104 nhbthb.exe 2856 ppjjv.exe 2736 xfrlfff.exe 1216 llrxrrl.exe 2724 3bnhhh.exe 2696 tbthhh.exe 3756 vvddp.exe 4536 xffxrxx.exe 2532 fllfxxx.exe 4532 hbhbbb.exe 4988 jpvdv.exe 1752 vpjdd.exe 4204 xlrlffx.exe 4748 btnhbb.exe 4608 tttnnh.exe 3392 jjpdv.exe 3632 fxxrlff.exe 3264 5tbbbb.exe 1424 pvvvp.exe 2980 vvpjp.exe 1048 rxxrfxr.exe 2996 5btnhn.exe 4080 ddjjj.exe 1736 jvjjd.exe 3972 xlrrrxr.exe 1792 bbbbnt.exe 3456 7vjjp.exe 2232 vpppv.exe 3924 hhnntt.exe 1480 bbbnht.exe 716 bhhbnt.exe 1332 ddpvp.exe 3036 jdvpj.exe 2612 rfxrffx.exe 4596 httbbh.exe 3068 vddpd.exe 4992 5vvpj.exe 3428 xllllrr.exe 4528 rxfffff.exe 828 hnhhnt.exe 3244 3nnhbb.exe 3984 vpppj.exe 2856 3lrrrrl.exe 4820 hbnnhb.exe 4540 btttnn.exe 612 dvvpj.exe 2768 ddvvp.exe 3416 3vppp.exe 1484 frffxxr.exe 3576 5lxrxfr.exe 4536 5bbtnn.exe -
resource yara_rule behavioral2/memory/2152-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-203-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 3456 2152 b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9.exe 83 PID 2152 wrote to memory of 3456 2152 b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9.exe 83 PID 2152 wrote to memory of 3456 2152 b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9.exe 83 PID 3456 wrote to memory of 3700 3456 pvjdj.exe 84 PID 3456 wrote to memory of 3700 3456 pvjdj.exe 84 PID 3456 wrote to memory of 3700 3456 pvjdj.exe 84 PID 3700 wrote to memory of 1416 3700 xlrfxxx.exe 85 PID 3700 wrote to memory of 1416 3700 xlrfxxx.exe 85 PID 3700 wrote to memory of 1416 3700 xlrfxxx.exe 85 PID 1416 wrote to memory of 3304 1416 hnnntt.exe 86 PID 1416 wrote to memory of 3304 1416 hnnntt.exe 86 PID 1416 wrote to memory of 3304 1416 hnnntt.exe 86 PID 3304 wrote to memory of 1032 3304 dpvpp.exe 87 PID 3304 wrote to memory of 1032 3304 dpvpp.exe 87 PID 3304 wrote to memory of 1032 3304 dpvpp.exe 87 PID 1032 wrote to memory of 2316 1032 xlxxlll.exe 88 PID 1032 wrote to memory of 2316 1032 xlxxlll.exe 88 PID 1032 wrote to memory of 2316 1032 xlxxlll.exe 88 PID 2316 wrote to memory of 2164 2316 7nnhhb.exe 89 PID 2316 wrote to memory of 2164 2316 7nnhhb.exe 89 PID 2316 wrote to memory of 2164 2316 7nnhhb.exe 89 PID 2164 wrote to memory of 3068 2164 nhtttt.exe 90 PID 2164 wrote to memory of 3068 2164 nhtttt.exe 90 PID 2164 wrote to memory of 3068 2164 nhtttt.exe 90 PID 3068 wrote to memory of 2124 3068 jdppp.exe 91 PID 3068 wrote to memory of 2124 3068 jdppp.exe 91 PID 3068 wrote to memory of 2124 3068 jdppp.exe 91 PID 2124 wrote to memory of 836 2124 lxflfff.exe 92 PID 2124 wrote to memory of 836 2124 lxflfff.exe 92 PID 2124 wrote to memory of 836 2124 lxflfff.exe 92 PID 836 wrote to memory of 2284 836 nthnnn.exe 93 PID 836 wrote to memory of 2284 836 nthnnn.exe 93 PID 836 wrote to memory of 2284 836 nthnnn.exe 93 PID 2284 wrote to memory of 4112 2284 vppjj.exe 94 PID 2284 wrote to memory of 4112 2284 vppjj.exe 94 PID 2284 wrote to memory of 4112 2284 vppjj.exe 94 PID 4112 wrote to memory of 4364 4112 pjjdp.exe 95 PID 4112 wrote to memory of 4364 4112 pjjdp.exe 95 PID 4112 wrote to memory of 4364 4112 pjjdp.exe 95 PID 4364 wrote to memory of 5104 4364 xxxxfxx.exe 96 PID 4364 wrote to memory of 5104 4364 xxxxfxx.exe 96 PID 4364 wrote to memory of 5104 4364 xxxxfxx.exe 96 PID 5104 wrote to memory of 2856 5104 nhbthb.exe 97 PID 5104 wrote to memory of 2856 5104 nhbthb.exe 97 PID 5104 wrote to memory of 2856 5104 nhbthb.exe 97 PID 2856 wrote to memory of 2736 2856 ppjjv.exe 98 PID 2856 wrote to memory of 2736 2856 ppjjv.exe 98 PID 2856 wrote to memory of 2736 2856 ppjjv.exe 98 PID 2736 wrote to memory of 1216 2736 xfrlfff.exe 99 PID 2736 wrote to memory of 1216 2736 xfrlfff.exe 99 PID 2736 wrote to memory of 1216 2736 xfrlfff.exe 99 PID 1216 wrote to memory of 2724 1216 llrxrrl.exe 100 PID 1216 wrote to memory of 2724 1216 llrxrrl.exe 100 PID 1216 wrote to memory of 2724 1216 llrxrrl.exe 100 PID 2724 wrote to memory of 2696 2724 3bnhhh.exe 101 PID 2724 wrote to memory of 2696 2724 3bnhhh.exe 101 PID 2724 wrote to memory of 2696 2724 3bnhhh.exe 101 PID 2696 wrote to memory of 3756 2696 tbthhh.exe 102 PID 2696 wrote to memory of 3756 2696 tbthhh.exe 102 PID 2696 wrote to memory of 3756 2696 tbthhh.exe 102 PID 3756 wrote to memory of 4536 3756 vvddp.exe 103 PID 3756 wrote to memory of 4536 3756 vvddp.exe 103 PID 3756 wrote to memory of 4536 3756 vvddp.exe 103 PID 4536 wrote to memory of 2532 4536 xffxrxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9.exe"C:\Users\Admin\AppData\Local\Temp\b6a3f6259011c03764220549f44ce4ba582ac1218c4bf4b86eee920033634ca9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\pvjdj.exec:\pvjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\xlrfxxx.exec:\xlrfxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\hnnntt.exec:\hnnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\dpvpp.exec:\dpvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\xlxxlll.exec:\xlxxlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\7nnhhb.exec:\7nnhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nhtttt.exec:\nhtttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jdppp.exec:\jdppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\lxflfff.exec:\lxflfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\nthnnn.exec:\nthnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\vppjj.exec:\vppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\pjjdp.exec:\pjjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\xxxxfxx.exec:\xxxxfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\nhbthb.exec:\nhbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\ppjjv.exec:\ppjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xfrlfff.exec:\xfrlfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\llrxrrl.exec:\llrxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\3bnhhh.exec:\3bnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tbthhh.exec:\tbthhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vvddp.exec:\vvddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\xffxrxx.exec:\xffxrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\fllfxxx.exec:\fllfxxx.exe23⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbhbbb.exec:\hbhbbb.exe24⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jpvdv.exec:\jpvdv.exe25⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vpjdd.exec:\vpjdd.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xlrlffx.exec:\xlrlffx.exe27⤵
- Executes dropped EXE
PID:4204 -
\??\c:\btnhbb.exec:\btnhbb.exe28⤵
- Executes dropped EXE
PID:4748 -
\??\c:\tttnnh.exec:\tttnnh.exe29⤵
- Executes dropped EXE
PID:4608 -
\??\c:\jjpdv.exec:\jjpdv.exe30⤵
- Executes dropped EXE
PID:3392 -
\??\c:\fxxrlff.exec:\fxxrlff.exe31⤵
- Executes dropped EXE
PID:3632 -
\??\c:\5tbbbb.exec:\5tbbbb.exe32⤵
- Executes dropped EXE
PID:3264 -
\??\c:\pvvvp.exec:\pvvvp.exe33⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vvpjp.exec:\vvpjp.exe34⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe35⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5btnhn.exec:\5btnhn.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ddjjj.exec:\ddjjj.exe37⤵
- Executes dropped EXE
PID:4080 -
\??\c:\jvjjd.exec:\jvjjd.exe38⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xlrrrxr.exec:\xlrrrxr.exe39⤵
- Executes dropped EXE
PID:3972 -
\??\c:\bbbbnt.exec:\bbbbnt.exe40⤵
- Executes dropped EXE
PID:1792 -
\??\c:\7vjjp.exec:\7vjjp.exe41⤵
- Executes dropped EXE
PID:3456 -
\??\c:\vpppv.exec:\vpppv.exe42⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hhnntt.exec:\hhnntt.exe43⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bbbnht.exec:\bbbnht.exe44⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bhhbnt.exec:\bhhbnt.exe45⤵
- Executes dropped EXE
PID:716 -
\??\c:\ddpvp.exec:\ddpvp.exe46⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jdvpj.exec:\jdvpj.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rfxrffx.exec:\rfxrffx.exe48⤵
- Executes dropped EXE
PID:2612 -
\??\c:\httbbh.exec:\httbbh.exe49⤵
- Executes dropped EXE
PID:4596 -
\??\c:\vddpd.exec:\vddpd.exe50⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5vvpj.exec:\5vvpj.exe51⤵
- Executes dropped EXE
PID:4992 -
\??\c:\xllllrr.exec:\xllllrr.exe52⤵
- Executes dropped EXE
PID:3428 -
\??\c:\rxfffff.exec:\rxfffff.exe53⤵
- Executes dropped EXE
PID:4528 -
\??\c:\hnhhnt.exec:\hnhhnt.exe54⤵
- Executes dropped EXE
PID:828 -
\??\c:\3nnhbb.exec:\3nnhbb.exe55⤵
- Executes dropped EXE
PID:3244 -
\??\c:\vpppj.exec:\vpppj.exe56⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3lrrrrl.exec:\3lrrrrl.exe57⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hbnnhb.exec:\hbnnhb.exe58⤵
- Executes dropped EXE
PID:4820 -
\??\c:\btttnn.exec:\btttnn.exe59⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dvvpj.exec:\dvvpj.exe60⤵
- Executes dropped EXE
PID:612 -
\??\c:\ddvvp.exec:\ddvvp.exe61⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3vppp.exec:\3vppp.exe62⤵
- Executes dropped EXE
PID:3416 -
\??\c:\frffxxr.exec:\frffxxr.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\5lxrxfr.exec:\5lxrxfr.exe64⤵
- Executes dropped EXE
PID:3576 -
\??\c:\5bbtnn.exec:\5bbtnn.exe65⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nhthhb.exec:\nhthhb.exe66⤵PID:4996
-
\??\c:\vvdvp.exec:\vvdvp.exe67⤵PID:4876
-
\??\c:\pjjdv.exec:\pjjdv.exe68⤵PID:2568
-
\??\c:\llxxxxl.exec:\llxxxxl.exe69⤵PID:3668
-
\??\c:\xxfxxfl.exec:\xxfxxfl.exe70⤵PID:5108
-
\??\c:\tnhhtt.exec:\tnhhtt.exe71⤵PID:1908
-
\??\c:\hhtttt.exec:\hhtttt.exe72⤵PID:4956
-
\??\c:\pdjpd.exec:\pdjpd.exe73⤵PID:3364
-
\??\c:\rrffxlr.exec:\rrffxlr.exe74⤵PID:3956
-
\??\c:\fxfrrxl.exec:\fxfrrxl.exe75⤵PID:2652
-
\??\c:\lllrrrr.exec:\lllrrrr.exe76⤵PID:2008
-
\??\c:\bbbbbb.exec:\bbbbbb.exe77⤵PID:5056
-
\??\c:\thbttn.exec:\thbttn.exe78⤵PID:4692
-
\??\c:\jpddv.exec:\jpddv.exe79⤵PID:3708
-
\??\c:\9pjpj.exec:\9pjpj.exe80⤵PID:1888
-
\??\c:\lrxrfff.exec:\lrxrfff.exe81⤵PID:2452
-
\??\c:\bbthhh.exec:\bbthhh.exe82⤵PID:3952
-
\??\c:\hnnnnt.exec:\hnnnnt.exe83⤵PID:2628
-
\??\c:\5ddjj.exec:\5ddjj.exe84⤵PID:2564
-
\??\c:\frrrlrl.exec:\frrrlrl.exe85⤵PID:4504
-
\??\c:\nnnnnn.exec:\nnnnnn.exe86⤵PID:3116
-
\??\c:\ttbbtt.exec:\ttbbtt.exe87⤵PID:2044
-
\??\c:\dvppj.exec:\dvppj.exe88⤵PID:3884
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe89⤵PID:1376
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe90⤵PID:1316
-
\??\c:\hnhbnn.exec:\hnhbnn.exe91⤵PID:1032
-
\??\c:\nnbtbh.exec:\nnbtbh.exe92⤵PID:532
-
\??\c:\vdpvp.exec:\vdpvp.exe93⤵PID:4764
-
\??\c:\pdjjd.exec:\pdjjd.exe94⤵PID:3616
-
\??\c:\5lrrrrf.exec:\5lrrrrf.exe95⤵PID:3948
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe96⤵PID:4596
-
\??\c:\5hbtth.exec:\5hbtth.exe97⤵PID:2720
-
\??\c:\pvjdd.exec:\pvjdd.exe98⤵PID:4212
-
\??\c:\fxxxxff.exec:\fxxxxff.exe99⤵PID:3428
-
\??\c:\hhhhhh.exec:\hhhhhh.exe100⤵PID:2660
-
\??\c:\tnnnnb.exec:\tnnnnb.exe101⤵PID:828
-
\??\c:\tnbbbh.exec:\tnbbbh.exe102⤵PID:3580
-
\??\c:\vjjpj.exec:\vjjpj.exe103⤵PID:1704
-
\??\c:\dvdvv.exec:\dvdvv.exe104⤵PID:4704
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe105⤵PID:4872
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe106⤵PID:2724
-
\??\c:\hhhnnt.exec:\hhhnnt.exe107⤵PID:5084
-
\??\c:\hbnnnn.exec:\hbnnnn.exe108⤵PID:4544
-
\??\c:\9ddvv.exec:\9ddvv.exe109⤵PID:3804
-
\??\c:\fffrlfx.exec:\fffrlfx.exe110⤵PID:400
-
\??\c:\9llfxxr.exec:\9llfxxr.exe111⤵PID:2764
-
\??\c:\hbtnhh.exec:\hbtnhh.exe112⤵PID:2088
-
\??\c:\pvddd.exec:\pvddd.exe113⤵PID:4680
-
\??\c:\pdpjd.exec:\pdpjd.exe114⤵PID:3844
-
\??\c:\ffffxxr.exec:\ffffxxr.exe115⤵PID:1544
-
\??\c:\rlfrrrr.exec:\rlfrrrr.exe116⤵PID:4924
-
\??\c:\nbnnhh.exec:\nbnnhh.exe117⤵PID:1120
-
\??\c:\tntttt.exec:\tntttt.exe118⤵PID:440
-
\??\c:\pdjdj.exec:\pdjdj.exe119⤵PID:864
-
\??\c:\pdppj.exec:\pdppj.exe120⤵PID:1132
-
\??\c:\xrxfxfx.exec:\xrxfxfx.exe121⤵PID:3392
-
\??\c:\nhthnt.exec:\nhthnt.exe122⤵PID:4556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-