Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe
-
Size
61KB
-
MD5
a97534461296a2b3717f35799cda42db
-
SHA1
75768978304ea13db6f7fc56c5894c46f93a2d45
-
SHA256
613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838
-
SHA512
9e3deef09562d0b3ea8f4208777f5b9eaddbe5777add714aab82c7cfac2c9c540bd59e819554a652edabaeaae6c384e55b131af092fcbd42f478b13b8c39d87a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEz:ymb3NkkiQ3mdBjFII9ZvHKEz
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/1672-5-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-31-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/1672-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1072-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1192-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1380-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/552-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3304-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3612-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4308-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1584-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1992-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/224-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3588-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3580-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3204-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2432-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2692-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1980-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3340-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1656-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3748-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/964-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3608-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4532-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3144-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3092-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1820-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1072 7xxxxff.exe 1192 ppdjd.exe 224 fxfxfxr.exe 1380 lffxfll.exe 1992 hbtttt.exe 552 pjvjd.exe 3304 lrfrxff.exe 3612 lfffxfx.exe 1584 nnntnt.exe 4308 ddvjv.exe 3856 rfrxlll.exe 4036 bbhtnt.exe 3588 pjjdv.exe 3580 lrxxxfl.exe 3204 hhtbtb.exe 2432 dpjvp.exe 2692 tthtbn.exe 1980 9xflflr.exe 3340 hthhhh.exe 632 jdpjp.exe 1656 pvdvj.exe 4356 lfrfxxr.exe 3748 bbbtbh.exe 1344 xrxrlrl.exe 1036 ttbbhn.exe 964 pdjpp.exe 3608 llxxxxf.exe 4532 vvjdd.exe 3144 xxxlxll.exe 3092 ddjdj.exe 1820 xfffrxf.exe 2568 xlrlfrr.exe 2272 tnhhnt.exe 3140 3dppj.exe 1068 flxxffl.exe 4688 1bhnnh.exe 4936 bhhnth.exe 3624 dvddd.exe 5104 lllxflx.exe 4372 tttnbb.exe 4280 rrlrrrr.exe 4980 hhbbhn.exe 1752 hntbhh.exe 3224 jppdv.exe 4116 flfxffl.exe 3648 hnbbtt.exe 2008 jvpdv.exe 4804 fffllll.exe 4524 rfxxxff.exe 1428 tbnnhn.exe 3304 dddvp.exe 4208 djpjd.exe 2076 xxfxxrl.exe 3672 bnbthb.exe 3184 vpdpv.exe 1852 ffxxfrr.exe 208 hthbbt.exe 3168 3vpjd.exe 1200 frlxlfr.exe 2500 tnntbb.exe 660 7jpjj.exe 2884 lfxrrfl.exe 4920 flrlllf.exe 2176 hhbbbb.exe -
resource yara_rule behavioral2/memory/1672-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1072 1672 613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe 83 PID 1672 wrote to memory of 1072 1672 613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe 83 PID 1672 wrote to memory of 1072 1672 613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe 83 PID 1072 wrote to memory of 1192 1072 7xxxxff.exe 84 PID 1072 wrote to memory of 1192 1072 7xxxxff.exe 84 PID 1072 wrote to memory of 1192 1072 7xxxxff.exe 84 PID 1192 wrote to memory of 224 1192 ppdjd.exe 85 PID 1192 wrote to memory of 224 1192 ppdjd.exe 85 PID 1192 wrote to memory of 224 1192 ppdjd.exe 85 PID 224 wrote to memory of 1380 224 fxfxfxr.exe 86 PID 224 wrote to memory of 1380 224 fxfxfxr.exe 86 PID 224 wrote to memory of 1380 224 fxfxfxr.exe 86 PID 1380 wrote to memory of 1992 1380 lffxfll.exe 87 PID 1380 wrote to memory of 1992 1380 lffxfll.exe 87 PID 1380 wrote to memory of 1992 1380 lffxfll.exe 87 PID 1992 wrote to memory of 552 1992 hbtttt.exe 88 PID 1992 wrote to memory of 552 1992 hbtttt.exe 88 PID 1992 wrote to memory of 552 1992 hbtttt.exe 88 PID 552 wrote to memory of 3304 552 pjvjd.exe 89 PID 552 wrote to memory of 3304 552 pjvjd.exe 89 PID 552 wrote to memory of 3304 552 pjvjd.exe 89 PID 3304 wrote to memory of 3612 3304 lrfrxff.exe 90 PID 3304 wrote to memory of 3612 3304 lrfrxff.exe 90 PID 3304 wrote to memory of 3612 3304 lrfrxff.exe 90 PID 3612 wrote to memory of 1584 3612 lfffxfx.exe 91 PID 3612 wrote to memory of 1584 3612 lfffxfx.exe 91 PID 3612 wrote to memory of 1584 3612 lfffxfx.exe 91 PID 1584 wrote to memory of 4308 1584 nnntnt.exe 92 PID 1584 wrote to memory of 4308 1584 nnntnt.exe 92 PID 1584 wrote to memory of 4308 1584 nnntnt.exe 92 PID 4308 wrote to memory of 3856 4308 ddvjv.exe 93 PID 4308 wrote to memory of 3856 4308 ddvjv.exe 93 PID 4308 wrote to memory of 3856 4308 ddvjv.exe 93 PID 3856 wrote to memory of 4036 3856 rfrxlll.exe 94 PID 3856 wrote to memory of 4036 3856 rfrxlll.exe 94 PID 3856 wrote to memory of 4036 3856 rfrxlll.exe 94 PID 4036 wrote to memory of 3588 4036 bbhtnt.exe 95 PID 4036 wrote to memory of 3588 4036 bbhtnt.exe 95 PID 4036 wrote to memory of 3588 4036 bbhtnt.exe 95 PID 3588 wrote to memory of 3580 3588 pjjdv.exe 96 PID 3588 wrote to memory of 3580 3588 pjjdv.exe 96 PID 3588 wrote to memory of 3580 3588 pjjdv.exe 96 PID 3580 wrote to memory of 3204 3580 lrxxxfl.exe 97 PID 3580 wrote to memory of 3204 3580 lrxxxfl.exe 97 PID 3580 wrote to memory of 3204 3580 lrxxxfl.exe 97 PID 3204 wrote to memory of 2432 3204 hhtbtb.exe 98 PID 3204 wrote to memory of 2432 3204 hhtbtb.exe 98 PID 3204 wrote to memory of 2432 3204 hhtbtb.exe 98 PID 2432 wrote to memory of 2692 2432 dpjvp.exe 99 PID 2432 wrote to memory of 2692 2432 dpjvp.exe 99 PID 2432 wrote to memory of 2692 2432 dpjvp.exe 99 PID 2692 wrote to memory of 1980 2692 tthtbn.exe 100 PID 2692 wrote to memory of 1980 2692 tthtbn.exe 100 PID 2692 wrote to memory of 1980 2692 tthtbn.exe 100 PID 1980 wrote to memory of 3340 1980 9xflflr.exe 101 PID 1980 wrote to memory of 3340 1980 9xflflr.exe 101 PID 1980 wrote to memory of 3340 1980 9xflflr.exe 101 PID 3340 wrote to memory of 632 3340 hthhhh.exe 102 PID 3340 wrote to memory of 632 3340 hthhhh.exe 102 PID 3340 wrote to memory of 632 3340 hthhhh.exe 102 PID 632 wrote to memory of 1656 632 jdpjp.exe 103 PID 632 wrote to memory of 1656 632 jdpjp.exe 103 PID 632 wrote to memory of 1656 632 jdpjp.exe 103 PID 1656 wrote to memory of 4356 1656 pvdvj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe"C:\Users\Admin\AppData\Local\Temp\613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\7xxxxff.exec:\7xxxxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\ppdjd.exec:\ppdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\fxfxfxr.exec:\fxfxfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\lffxfll.exec:\lffxfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\hbtttt.exec:\hbtttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pjvjd.exec:\pjvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\lrfrxff.exec:\lrfrxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\lfffxfx.exec:\lfffxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\nnntnt.exec:\nnntnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\ddvjv.exec:\ddvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\rfrxlll.exec:\rfrxlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\bbhtnt.exec:\bbhtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\pjjdv.exec:\pjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\lrxxxfl.exec:\lrxxxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\hhtbtb.exec:\hhtbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\dpjvp.exec:\dpjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tthtbn.exec:\tthtbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9xflflr.exec:\9xflflr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\hthhhh.exec:\hthhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\jdpjp.exec:\jdpjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\pvdvj.exec:\pvdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\lfrfxxr.exec:\lfrfxxr.exe23⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bbbtbh.exec:\bbbtbh.exe24⤵
- Executes dropped EXE
PID:3748 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe25⤵
- Executes dropped EXE
PID:1344 -
\??\c:\ttbbhn.exec:\ttbbhn.exe26⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pdjpp.exec:\pdjpp.exe27⤵
- Executes dropped EXE
PID:964 -
\??\c:\llxxxxf.exec:\llxxxxf.exe28⤵
- Executes dropped EXE
PID:3608 -
\??\c:\vvjdd.exec:\vvjdd.exe29⤵
- Executes dropped EXE
PID:4532 -
\??\c:\xxxlxll.exec:\xxxlxll.exe30⤵
- Executes dropped EXE
PID:3144 -
\??\c:\ddjdj.exec:\ddjdj.exe31⤵
- Executes dropped EXE
PID:3092 -
\??\c:\xfffrxf.exec:\xfffrxf.exe32⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xlrlfrr.exec:\xlrlfrr.exe33⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tnhhnt.exec:\tnhhnt.exe34⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3dppj.exec:\3dppj.exe35⤵
- Executes dropped EXE
PID:3140 -
\??\c:\flxxffl.exec:\flxxffl.exe36⤵
- Executes dropped EXE
PID:1068 -
\??\c:\1bhnnh.exec:\1bhnnh.exe37⤵
- Executes dropped EXE
PID:4688 -
\??\c:\bhhnth.exec:\bhhnth.exe38⤵
- Executes dropped EXE
PID:4936 -
\??\c:\dvddd.exec:\dvddd.exe39⤵
- Executes dropped EXE
PID:3624 -
\??\c:\lllxflx.exec:\lllxflx.exe40⤵
- Executes dropped EXE
PID:5104 -
\??\c:\tttnbb.exec:\tttnbb.exe41⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rrlrrrr.exec:\rrlrrrr.exe42⤵
- Executes dropped EXE
PID:4280 -
\??\c:\hhbbhn.exec:\hhbbhn.exe43⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hntbhh.exec:\hntbhh.exe44⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jppdv.exec:\jppdv.exe45⤵
- Executes dropped EXE
PID:3224 -
\??\c:\flfxffl.exec:\flfxffl.exe46⤵
- Executes dropped EXE
PID:4116 -
\??\c:\hnbbtt.exec:\hnbbtt.exe47⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jvpdv.exec:\jvpdv.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fffllll.exec:\fffllll.exe49⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rfxxxff.exec:\rfxxxff.exe50⤵
- Executes dropped EXE
PID:4524 -
\??\c:\tbnnhn.exec:\tbnnhn.exe51⤵
- Executes dropped EXE
PID:1428 -
\??\c:\dddvp.exec:\dddvp.exe52⤵
- Executes dropped EXE
PID:3304 -
\??\c:\djpjd.exec:\djpjd.exe53⤵
- Executes dropped EXE
PID:4208 -
\??\c:\xxfxxrl.exec:\xxfxxrl.exe54⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bnbthb.exec:\bnbthb.exe55⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vpdpv.exec:\vpdpv.exe56⤵
- Executes dropped EXE
PID:3184 -
\??\c:\ffxxfrr.exec:\ffxxfrr.exe57⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hthbbt.exec:\hthbbt.exe58⤵
- Executes dropped EXE
PID:208 -
\??\c:\3vpjd.exec:\3vpjd.exe59⤵
- Executes dropped EXE
PID:3168 -
\??\c:\frlxlfr.exec:\frlxlfr.exe60⤵
- Executes dropped EXE
PID:1200 -
\??\c:\tnntbb.exec:\tnntbb.exe61⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7jpjj.exec:\7jpjj.exe62⤵
- Executes dropped EXE
PID:660 -
\??\c:\lfxrrfl.exec:\lfxrrfl.exe63⤵
- Executes dropped EXE
PID:2884 -
\??\c:\flrlllf.exec:\flrlllf.exe64⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hhbbbb.exec:\hhbbbb.exe65⤵
- Executes dropped EXE
PID:2176 -
\??\c:\djdpv.exec:\djdpv.exe66⤵PID:1772
-
\??\c:\flxlrxx.exec:\flxlrxx.exe67⤵PID:992
-
\??\c:\nhbtbn.exec:\nhbtbn.exe68⤵PID:5116
-
\??\c:\dvjpp.exec:\dvjpp.exe69⤵PID:1236
-
\??\c:\pdjjd.exec:\pdjjd.exe70⤵PID:4812
-
\??\c:\bhtttt.exec:\bhtttt.exe71⤵PID:2848
-
\??\c:\rxlfrff.exec:\rxlfrff.exe72⤵PID:1728
-
\??\c:\nhbttt.exec:\nhbttt.exe73⤵PID:2132
-
\??\c:\ttttnn.exec:\ttttnn.exe74⤵PID:364
-
\??\c:\dvpdv.exec:\dvpdv.exe75⤵PID:1168
-
\??\c:\xfxflfr.exec:\xfxflfr.exe76⤵PID:5068
-
\??\c:\thtthh.exec:\thtthh.exe77⤵PID:2872
-
\??\c:\5vjdp.exec:\5vjdp.exe78⤵PID:4032
-
\??\c:\xfxrlll.exec:\xfxrlll.exe79⤵PID:4204
-
\??\c:\fllffxf.exec:\fllffxf.exe80⤵PID:1316
-
\??\c:\ttthbh.exec:\ttthbh.exe81⤵PID:2392
-
\??\c:\tnnnnn.exec:\tnnnnn.exe82⤵PID:2272
-
\??\c:\vdjvv.exec:\vdjvv.exe83⤵PID:424
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe84⤵PID:3948
-
\??\c:\1rfllff.exec:\1rfllff.exe85⤵PID:5048
-
\??\c:\nnnnhn.exec:\nnnnhn.exe86⤵PID:3988
-
\??\c:\vppdv.exec:\vppdv.exe87⤵PID:960
-
\??\c:\jpjdd.exec:\jpjdd.exe88⤵PID:4892
-
\??\c:\xrlfffx.exec:\xrlfffx.exe89⤵PID:1816
-
\??\c:\hnnthb.exec:\hnnthb.exe90⤵PID:1688
-
\??\c:\ntnnhn.exec:\ntnnhn.exe91⤵PID:3108
-
\??\c:\xrrrlff.exec:\xrrrlff.exe92⤵PID:1968
-
\??\c:\btntbn.exec:\btntbn.exe93⤵PID:3152
-
\??\c:\dpvpj.exec:\dpvpj.exe94⤵PID:1644
-
\??\c:\pdjvj.exec:\pdjvj.exe95⤵PID:3296
-
\??\c:\nhnhbb.exec:\nhnhbb.exe96⤵PID:2040
-
\??\c:\tthtth.exec:\tthtth.exe97⤵PID:2416
-
\??\c:\vddpd.exec:\vddpd.exe98⤵PID:3616
-
\??\c:\fllfxxx.exec:\fllfxxx.exe99⤵PID:5020
-
\??\c:\tbtbtn.exec:\tbtbtn.exe100⤵PID:4172
-
\??\c:\tttnnh.exec:\tttnnh.exe101⤵PID:3856
-
\??\c:\1pdjd.exec:\1pdjd.exe102⤵PID:1188
-
\??\c:\xlrffrr.exec:\xlrffrr.exe103⤵PID:4036
-
\??\c:\3hhnnt.exec:\3hhnnt.exe104⤵PID:4904
-
\??\c:\pppvp.exec:\pppvp.exe105⤵PID:4088
-
\??\c:\5xxrlff.exec:\5xxrlff.exe106⤵PID:3588
-
\??\c:\fflrrff.exec:\fflrrff.exe107⤵PID:3168
-
\??\c:\btthnb.exec:\btthnb.exe108⤵PID:1200
-
\??\c:\nhtthh.exec:\nhtthh.exe109⤵PID:3068
-
\??\c:\jjpjd.exec:\jjpjd.exe110⤵PID:4680
-
\??\c:\xflflll.exec:\xflflll.exe111⤵PID:2316
-
\??\c:\rrrlflf.exec:\rrrlflf.exe112⤵PID:1772
-
\??\c:\nnnntb.exec:\nnnntb.exe113⤵PID:4440
-
\??\c:\tnbbtt.exec:\tnbbtt.exe114⤵PID:220
-
\??\c:\jjddv.exec:\jjddv.exe115⤵PID:1604
-
\??\c:\xllllrr.exec:\xllllrr.exe116⤵PID:1792
-
\??\c:\ffrrxff.exec:\ffrrxff.exe117⤵PID:4832
-
\??\c:\1nhnbh.exec:\1nhnbh.exe118⤵PID:1760
-
\??\c:\jpvjv.exec:\jpvjv.exe119⤵PID:4000
-
\??\c:\vddjd.exec:\vddjd.exe120⤵PID:3144
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe121⤵PID:3908
-
\??\c:\frxfflf.exec:\frxfflf.exe122⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-