Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
- Target 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe
- Size 224KB
- Sample240519-2qadrsfb61
- SHA256 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24
- MD5 c34a6d6d5a19c8125a85ff4f89dc499d
- SHA1 58a9aaa0a1fd469566ce6822e269ed3c76120c01
- SHA512 3d34f9e751106b82fbeba83be8063c62d1fcea14733e48900fa76c468e81f8d20fc5676fe33511c4daac57eb6e9c5691704d5fd03564d141001359427f0417c8
- SSDEEP 3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xL7m:n3C9BRo7MlrWKo+lxKy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 33 IoCs
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/752-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3348-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4504-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4956-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4956-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4956-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2208-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2524-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4596-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3180-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1752-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3876-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/224-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2644-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3208-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2580-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3740-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/984-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3860 5tnhbn.exe 752 7xfrxrl.exe 3348 nnnhhb.exe 3956 rflfxrl.exe 4504 3nnhhn.exe 1348 jdddv.exe 4956 3hntnh.exe 2208 djdpj.exe 3272 lxlxrfl.exe 2524 hthtnt.exe 4596 pvpjv.exe 968 nbbthh.exe 2136 3vpvp.exe 3180 1djdp.exe 1752 rxxfxlf.exe 4996 nnnhtt.exe 1032 rrrrlfl.exe 3876 3hhbtn.exe 1608 vpvpp.exe 224 lffrlfx.exe 4076 bhbtnn.exe 4016 pjjpd.exe 2644 lflfxxf.exe 4848 bhnhtt.exe 4868 vjvjj.exe 3208 rrxrrfx.exe 2580 bthnhb.exe 4288 1jpjv.exe 3740 xlllffl.exe 984 vppvp.exe 3388 xflfrfr.exe 2536 bthtbb.exe 4968 ntbbtn.exe 940 vdjdv.exe 1416 rlfrlfr.exe 2372 3tnhtt.exe 900 bhhtnh.exe 4292 vpjpd.exe 3264 7xfrlxr.exe 4188 lrxlfxr.exe 3860 ntbbtn.exe 2796 1tnbtt.exe 4024 pdjvd.exe 5000 lrxlxlr.exe 2132 bnnbtn.exe 1624 bhhbhh.exe 1800 vppdd.exe 1512 5xfxrrl.exe 4444 fxffxrx.exe 4956 hhnhtn.exe 1524 dvdvv.exe 3856 dppvp.exe 4668 lxlfrll.exe 1792 fxrrfxr.exe 4440 1nhhbb.exe 4596 vjppj.exe 1596 7xxrfxx.exe 2136 xxfrlfx.exe 3180 9nnnhh.exe 2948 dpvvj.exe 4656 rlfffxf.exe 4644 bnhnhb.exe 1032 vpjdv.exe 444 frfrlxr.exe -
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-201-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 3860 3076 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe 82 PID 3076 wrote to memory of 3860 3076 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe 82 PID 3076 wrote to memory of 3860 3076 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe 82 PID 3860 wrote to memory of 752 3860 5tnhbn.exe 83 PID 3860 wrote to memory of 752 3860 5tnhbn.exe 83 PID 3860 wrote to memory of 752 3860 5tnhbn.exe 83 PID 752 wrote to memory of 3348 752 7xfrxrl.exe 84 PID 752 wrote to memory of 3348 752 7xfrxrl.exe 84 PID 752 wrote to memory of 3348 752 7xfrxrl.exe 84 PID 3348 wrote to memory of 3956 3348 nnnhhb.exe 85 PID 3348 wrote to memory of 3956 3348 nnnhhb.exe 85 PID 3348 wrote to memory of 3956 3348 nnnhhb.exe 85 PID 3956 wrote to memory of 4504 3956 rflfxrl.exe 86 PID 3956 wrote to memory of 4504 3956 rflfxrl.exe 86 PID 3956 wrote to memory of 4504 3956 rflfxrl.exe 86 PID 4504 wrote to memory of 1348 4504 3nnhhn.exe 87 PID 4504 wrote to memory of 1348 4504 3nnhhn.exe 87 PID 4504 wrote to memory of 1348 4504 3nnhhn.exe 87 PID 1348 wrote to memory of 4956 1348 jdddv.exe 88 PID 1348 wrote to memory of 4956 1348 jdddv.exe 88 PID 1348 wrote to memory of 4956 1348 jdddv.exe 88 PID 4956 wrote to memory of 2208 4956 3hntnh.exe 89 PID 4956 wrote to memory of 2208 4956 3hntnh.exe 89 PID 4956 wrote to memory of 2208 4956 3hntnh.exe 89 PID 2208 wrote to memory of 3272 2208 djdpj.exe 91 PID 2208 wrote to memory of 3272 2208 djdpj.exe 91 PID 2208 wrote to memory of 3272 2208 djdpj.exe 91 PID 3272 wrote to memory of 2524 3272 lxlxrfl.exe 92 PID 3272 wrote to memory of 2524 3272 lxlxrfl.exe 92 PID 3272 wrote to memory of 2524 3272 lxlxrfl.exe 92 PID 2524 wrote to memory of 4596 2524 hthtnt.exe 93 PID 2524 wrote to memory of 4596 2524 hthtnt.exe 93 PID 2524 wrote to memory of 4596 2524 hthtnt.exe 93 PID 4596 wrote to memory of 968 4596 pvpjv.exe 94 PID 4596 wrote to memory of 968 4596 pvpjv.exe 94 PID 4596 wrote to memory of 968 4596 pvpjv.exe 94 PID 968 wrote to memory of 2136 968 nbbthh.exe 95 PID 968 wrote to memory of 2136 968 nbbthh.exe 95 PID 968 wrote to memory of 2136 968 nbbthh.exe 95 PID 2136 wrote to memory of 3180 2136 3vpvp.exe 96 PID 2136 wrote to memory of 3180 2136 3vpvp.exe 96 PID 2136 wrote to memory of 3180 2136 3vpvp.exe 96 PID 3180 wrote to memory of 1752 3180 1djdp.exe 97 PID 3180 wrote to memory of 1752 3180 1djdp.exe 97 PID 3180 wrote to memory of 1752 3180 1djdp.exe 97 PID 1752 wrote to memory of 4996 1752 rxxfxlf.exe 98 PID 1752 wrote to memory of 4996 1752 rxxfxlf.exe 98 PID 1752 wrote to memory of 4996 1752 rxxfxlf.exe 98 PID 4996 wrote to memory of 1032 4996 nnnhtt.exe 100 PID 4996 wrote to memory of 1032 4996 nnnhtt.exe 100 PID 4996 wrote to memory of 1032 4996 nnnhtt.exe 100 PID 1032 wrote to memory of 3876 1032 rrrrlfl.exe 101 PID 1032 wrote to memory of 3876 1032 rrrrlfl.exe 101 PID 1032 wrote to memory of 3876 1032 rrrrlfl.exe 101 PID 3876 wrote to memory of 1608 3876 3hhbtn.exe 102 PID 3876 wrote to memory of 1608 3876 3hhbtn.exe 102 PID 3876 wrote to memory of 1608 3876 3hhbtn.exe 102 PID 1608 wrote to memory of 224 1608 vpvpp.exe 103 PID 1608 wrote to memory of 224 1608 vpvpp.exe 103 PID 1608 wrote to memory of 224 1608 vpvpp.exe 103 PID 224 wrote to memory of 4076 224 lffrlfx.exe 104 PID 224 wrote to memory of 4076 224 lffrlfx.exe 104 PID 224 wrote to memory of 4076 224 lffrlfx.exe 104 PID 4076 wrote to memory of 4016 4076 bhbtnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe"C:\Users\Admin\AppData\Local\Temp\68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\5tnhbn.exec:\5tnhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\7xfrxrl.exec:\7xfrxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\nnnhhb.exec:\nnnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\rflfxrl.exec:\rflfxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\3nnhhn.exec:\3nnhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\jdddv.exec:\jdddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\3hntnh.exec:\3hntnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\djdpj.exec:\djdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\lxlxrfl.exec:\lxlxrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\hthtnt.exec:\hthtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pvpjv.exec:\pvpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\nbbthh.exec:\nbbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\3vpvp.exec:\3vpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\1djdp.exec:\1djdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\rxxfxlf.exec:\rxxfxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\nnnhtt.exec:\nnnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rrrrlfl.exec:\rrrrlfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\3hhbtn.exec:\3hhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\vpvpp.exec:\vpvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lffrlfx.exec:\lffrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\bhbtnn.exec:\bhbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\pjjpd.exec:\pjjpd.exe23⤵
- Executes dropped EXE
PID:4016 -
\??\c:\lflfxxf.exec:\lflfxxf.exe24⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bhnhtt.exec:\bhnhtt.exe25⤵
- Executes dropped EXE
PID:4848 -
\??\c:\vjvjj.exec:\vjvjj.exe26⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe27⤵
- Executes dropped EXE
PID:3208 -
\??\c:\bthnhb.exec:\bthnhb.exe28⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1jpjv.exec:\1jpjv.exe29⤵
- Executes dropped EXE
PID:4288 -
\??\c:\xlllffl.exec:\xlllffl.exe30⤵
- Executes dropped EXE
PID:3740 -
\??\c:\vppvp.exec:\vppvp.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\xflfrfr.exec:\xflfrfr.exe32⤵
- Executes dropped EXE
PID:3388 -
\??\c:\bthtbb.exec:\bthtbb.exe33⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ntbbtn.exec:\ntbbtn.exe34⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vdjdv.exec:\vdjdv.exe35⤵
- Executes dropped EXE
PID:940 -
\??\c:\rlfrlfr.exec:\rlfrlfr.exe36⤵
- Executes dropped EXE
PID:1416 -
\??\c:\3tnhtt.exec:\3tnhtt.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bhhtnh.exec:\bhhtnh.exe38⤵
- Executes dropped EXE
PID:900 -
\??\c:\vpjpd.exec:\vpjpd.exe39⤵
- Executes dropped EXE
PID:4292 -
\??\c:\7xfrlxr.exec:\7xfrlxr.exe40⤵
- Executes dropped EXE
PID:3264 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe41⤵
- Executes dropped EXE
PID:4188 -
\??\c:\ntbbtn.exec:\ntbbtn.exe42⤵
- Executes dropped EXE
PID:3860 -
\??\c:\1tnbtt.exec:\1tnbtt.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pdjvd.exec:\pdjvd.exe44⤵
- Executes dropped EXE
PID:4024 -
\??\c:\lrxlxlr.exec:\lrxlxlr.exe45⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bnnbtn.exec:\bnnbtn.exe46⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bhhbhh.exec:\bhhbhh.exe47⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vppdd.exec:\vppdd.exe48⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe49⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fxffxrx.exec:\fxffxrx.exe50⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hhnhtn.exec:\hhnhtn.exe51⤵
- Executes dropped EXE
PID:4956 -
\??\c:\dvdvv.exec:\dvdvv.exe52⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dppvp.exec:\dppvp.exe53⤵
- Executes dropped EXE
PID:3856 -
\??\c:\lxlfrll.exec:\lxlfrll.exe54⤵
- Executes dropped EXE
PID:4668 -
\??\c:\fxrrfxr.exec:\fxrrfxr.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1nhhbb.exec:\1nhhbb.exe56⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vjppj.exec:\vjppj.exe57⤵
- Executes dropped EXE
PID:4596 -
\??\c:\7xxrfxx.exec:\7xxrfxx.exe58⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xxfrlfx.exec:\xxfrlfx.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9nnnhh.exec:\9nnnhh.exe60⤵
- Executes dropped EXE
PID:3180 -
\??\c:\dpvvj.exec:\dpvvj.exe61⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rlfffxf.exec:\rlfffxf.exe62⤵
- Executes dropped EXE
PID:4656 -
\??\c:\bnhnhb.exec:\bnhnhb.exe63⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vpjdv.exec:\vpjdv.exe64⤵
- Executes dropped EXE
PID:1032 -
\??\c:\frfrlxr.exec:\frfrlxr.exe65⤵
- Executes dropped EXE
PID:444 -
\??\c:\5xxrffl.exec:\5xxrffl.exe66⤵PID:4036
-
\??\c:\tbhbtt.exec:\tbhbtt.exe67⤵PID:964
-
\??\c:\pdddv.exec:\pdddv.exe68⤵PID:216
-
\??\c:\rffxxlf.exec:\rffxxlf.exe69⤵PID:1708
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe70⤵PID:3688
-
\??\c:\nhhhtt.exec:\nhhhtt.exe71⤵PID:4180
-
\??\c:\jdjjj.exec:\jdjjj.exe72⤵PID:4792
-
\??\c:\pdpdj.exec:\pdpdj.exe73⤵PID:3024
-
\??\c:\rrrlrrl.exec:\rrrlrrl.exe74⤵PID:1548
-
\??\c:\xfrfxrl.exec:\xfrfxrl.exe75⤵PID:2060
-
\??\c:\nnnnnn.exec:\nnnnnn.exe76⤵PID:3208
-
\??\c:\jjvpd.exec:\jjvpd.exe77⤵PID:4060
-
\??\c:\xffxrlx.exec:\xffxrlx.exe78⤵PID:4612
-
\??\c:\bttnnh.exec:\bttnnh.exe79⤵PID:3680
-
\??\c:\nbntnh.exec:\nbntnh.exe80⤵PID:4988
-
\??\c:\dpvpd.exec:\dpvpd.exe81⤵PID:3528
-
\??\c:\flxfrrf.exec:\flxfrrf.exe82⤵PID:2924
-
\??\c:\1nhbbb.exec:\1nhbbb.exe83⤵PID:2076
-
\??\c:\5pjjd.exec:\5pjjd.exe84⤵PID:2848
-
\??\c:\llxfrll.exec:\llxfrll.exe85⤵PID:4252
-
\??\c:\1llxxrl.exec:\1llxxrl.exe86⤵PID:2712
-
\??\c:\htntht.exec:\htntht.exe87⤵PID:4448
-
\??\c:\vpvpp.exec:\vpvpp.exe88⤵PID:4280
-
\??\c:\ppddd.exec:\ppddd.exe89⤵PID:3076
-
\??\c:\frxrffr.exec:\frxrffr.exe90⤵PID:3300
-
\??\c:\frxrrrr.exec:\frxrrrr.exe91⤵PID:764
-
\??\c:\btnhbt.exec:\btnhbt.exe92⤵PID:992
-
\??\c:\jvjpj.exec:\jvjpj.exe93⤵PID:4496
-
\??\c:\vvppv.exec:\vvppv.exe94⤵PID:1820
-
\??\c:\9xxrrrf.exec:\9xxrrrf.exe95⤵PID:3152
-
\??\c:\5xrllrf.exec:\5xrllrf.exe96⤵PID:4168
-
\??\c:\ntbhht.exec:\ntbhht.exe97⤵PID:4208
-
\??\c:\vpppp.exec:\vpppp.exe98⤵PID:2180
-
\??\c:\9jjdd.exec:\9jjdd.exe99⤵PID:4624
-
\??\c:\lflffrr.exec:\lflffrr.exe100⤵PID:3272
-
\??\c:\5xlllrl.exec:\5xlllrl.exe101⤵PID:2240
-
\??\c:\bbhhhh.exec:\bbhhhh.exe102⤵PID:5016
-
\??\c:\hhbbbb.exec:\hhbbbb.exe103⤵PID:1072
-
\??\c:\ddvpd.exec:\ddvpd.exe104⤵PID:968
-
\??\c:\pdddd.exec:\pdddd.exe105⤵PID:2984
-
\??\c:\hnbttt.exec:\hnbttt.exe106⤵PID:3220
-
\??\c:\9dvvv.exec:\9dvvv.exe107⤵PID:4576
-
\??\c:\lfffxxx.exec:\lfffxxx.exe108⤵PID:5084
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe109⤵PID:3960
-
\??\c:\7bbbbn.exec:\7bbbbn.exe110⤵PID:1032
-
\??\c:\9pjdj.exec:\9pjdj.exe111⤵PID:1504
-
\??\c:\pjdpv.exec:\pjdpv.exe112⤵PID:1400
-
\??\c:\5fllfll.exec:\5fllfll.exe113⤵PID:2636
-
\??\c:\hbthbb.exec:\hbthbb.exe114⤵PID:4484
-
\??\c:\nhnhtt.exec:\nhnhtt.exe115⤵PID:3688
-
\??\c:\jjppp.exec:\jjppp.exe116⤵PID:3020
-
\??\c:\ppppj.exec:\ppppj.exe117⤵PID:4512
-
\??\c:\rlrllrl.exec:\rlrllrl.exe118⤵PID:464
-
\??\c:\3lllfll.exec:\3lllfll.exe119⤵PID:484
-
\??\c:\htbttt.exec:\htbttt.exe120⤵PID:4060
-
\??\c:\jddvv.exec:\jddvv.exe121⤵PID:2160
-
\??\c:\9pdvj.exec:\9pdvj.exe122⤵PID:3140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-