Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 00:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad.exe
-
Size
64KB
-
MD5
d85f99d7ed70b69c3fbd2b696f497030
-
SHA1
9f3490fbbe9c908dcf55fb064bc0f25136eade1e
-
SHA256
91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad
-
SHA512
ecf8fc16da914cedb5bf0f422f8e60644c62f797f250ef33d302b2e2531070167b91cf05ea23c8f12aa142978dcf1ac0fe3a928fef8fc6a4536e31af3ccfbb28
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdY:ymb3NkkiQ3mdBjF0yMl9
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4648-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-77-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/4648-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2740-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4908-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2684-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/824-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4908-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/984-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/528-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2936-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2852-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4188-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1444-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2196-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4564-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2616-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4124-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/884-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3200-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3828-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2744-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2708-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/448-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2948-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4388-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3712-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/984-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2740 jdpjp.exe 4908 fffrlfl.exe 824 hhbttt.exe 2684 ppppp.exe 3712 3djdv.exe 984 rrlfxxf.exe 4388 hnnnth.exe 528 tnbbnb.exe 1524 djpvp.exe 3040 rlxrllf.exe 2948 llllfll.exe 448 tthnhh.exe 2936 nbbbnn.exe 2708 jddjj.exe 2744 dvvpd.exe 1808 rlxlfff.exe 3828 3lffxrl.exe 3200 1xrxrrr.exe 2852 9btnnt.exe 884 hhnbtb.exe 3124 9djjd.exe 4124 pjpdd.exe 2616 xxrrxxl.exe 4564 rlfxrrr.exe 4188 hhbbhh.exe 2080 bbbttn.exe 2196 vpjpp.exe 404 ddjjd.exe 4916 vjpjd.exe 1444 xfxxxfx.exe 3888 xrlfffx.exe 1268 1hhnhh.exe 1644 bnttnb.exe 3908 tntbtt.exe 1576 5jpjv.exe 2800 1jjdd.exe 4880 rlllfff.exe 4224 nbhbnn.exe 4200 htntbh.exe 5036 dvdvd.exe 4928 5ffxrll.exe 1212 lfxxrrl.exe 4476 nhnnnn.exe 3516 ntttnt.exe 4764 vvvvj.exe 4468 lffxxxr.exe 1560 lfffxlf.exe 1352 bhthbt.exe 4284 dvppd.exe 4020 lffxxxf.exe 2148 nhnhhh.exe 4688 btnhtn.exe 4800 tnnnnn.exe 1472 tnnbth.exe 4120 vppjd.exe 4540 lfrlffx.exe 5100 tnbbnn.exe 3632 jjjjv.exe 2208 jjpjp.exe 1904 rllfrrl.exe 4344 hhhthb.exe 3856 tnbnbb.exe 756 vvddj.exe 1916 djdvd.exe -
resource yara_rule behavioral2/memory/4648-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-44-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 2740 4648 91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad.exe 81 PID 4648 wrote to memory of 2740 4648 91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad.exe 81 PID 4648 wrote to memory of 2740 4648 91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad.exe 81 PID 2740 wrote to memory of 4908 2740 jdpjp.exe 82 PID 2740 wrote to memory of 4908 2740 jdpjp.exe 82 PID 2740 wrote to memory of 4908 2740 jdpjp.exe 82 PID 4908 wrote to memory of 824 4908 fffrlfl.exe 83 PID 4908 wrote to memory of 824 4908 fffrlfl.exe 83 PID 4908 wrote to memory of 824 4908 fffrlfl.exe 83 PID 824 wrote to memory of 2684 824 hhbttt.exe 84 PID 824 wrote to memory of 2684 824 hhbttt.exe 84 PID 824 wrote to memory of 2684 824 hhbttt.exe 84 PID 2684 wrote to memory of 3712 2684 ppppp.exe 85 PID 2684 wrote to memory of 3712 2684 ppppp.exe 85 PID 2684 wrote to memory of 3712 2684 ppppp.exe 85 PID 3712 wrote to memory of 984 3712 3djdv.exe 86 PID 3712 wrote to memory of 984 3712 3djdv.exe 86 PID 3712 wrote to memory of 984 3712 3djdv.exe 86 PID 984 wrote to memory of 4388 984 rrlfxxf.exe 87 PID 984 wrote to memory of 4388 984 rrlfxxf.exe 87 PID 984 wrote to memory of 4388 984 rrlfxxf.exe 87 PID 4388 wrote to memory of 528 4388 hnnnth.exe 88 PID 4388 wrote to memory of 528 4388 hnnnth.exe 88 PID 4388 wrote to memory of 528 4388 hnnnth.exe 88 PID 528 wrote to memory of 1524 528 tnbbnb.exe 89 PID 528 wrote to memory of 1524 528 tnbbnb.exe 89 PID 528 wrote to memory of 1524 528 tnbbnb.exe 89 PID 1524 wrote to memory of 3040 1524 djpvp.exe 90 PID 1524 wrote to memory of 3040 1524 djpvp.exe 90 PID 1524 wrote to memory of 3040 1524 djpvp.exe 90 PID 3040 wrote to memory of 2948 3040 rlxrllf.exe 91 PID 3040 wrote to memory of 2948 3040 rlxrllf.exe 91 PID 3040 wrote to memory of 2948 3040 rlxrllf.exe 91 PID 2948 wrote to memory of 448 2948 llllfll.exe 92 PID 2948 wrote to memory of 448 2948 llllfll.exe 92 PID 2948 wrote to memory of 448 2948 llllfll.exe 92 PID 448 wrote to memory of 2936 448 tthnhh.exe 93 PID 448 wrote to memory of 2936 448 tthnhh.exe 93 PID 448 wrote to memory of 2936 448 tthnhh.exe 93 PID 2936 wrote to memory of 2708 2936 nbbbnn.exe 94 PID 2936 wrote to memory of 2708 2936 nbbbnn.exe 94 PID 2936 wrote to memory of 2708 2936 nbbbnn.exe 94 PID 2708 wrote to memory of 2744 2708 jddjj.exe 95 PID 2708 wrote to memory of 2744 2708 jddjj.exe 95 PID 2708 wrote to memory of 2744 2708 jddjj.exe 95 PID 2744 wrote to memory of 1808 2744 dvvpd.exe 96 PID 2744 wrote to memory of 1808 2744 dvvpd.exe 96 PID 2744 wrote to memory of 1808 2744 dvvpd.exe 96 PID 1808 wrote to memory of 3828 1808 rlxlfff.exe 97 PID 1808 wrote to memory of 3828 1808 rlxlfff.exe 97 PID 1808 wrote to memory of 3828 1808 rlxlfff.exe 97 PID 3828 wrote to memory of 3200 3828 3lffxrl.exe 98 PID 3828 wrote to memory of 3200 3828 3lffxrl.exe 98 PID 3828 wrote to memory of 3200 3828 3lffxrl.exe 98 PID 3200 wrote to memory of 2852 3200 1xrxrrr.exe 99 PID 3200 wrote to memory of 2852 3200 1xrxrrr.exe 99 PID 3200 wrote to memory of 2852 3200 1xrxrrr.exe 99 PID 2852 wrote to memory of 884 2852 9btnnt.exe 100 PID 2852 wrote to memory of 884 2852 9btnnt.exe 100 PID 2852 wrote to memory of 884 2852 9btnnt.exe 100 PID 884 wrote to memory of 3124 884 hhnbtb.exe 101 PID 884 wrote to memory of 3124 884 hhnbtb.exe 101 PID 884 wrote to memory of 3124 884 hhnbtb.exe 101 PID 3124 wrote to memory of 4124 3124 9djjd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad.exe"C:\Users\Admin\AppData\Local\Temp\91f745951ad6f914a937127f46688479fc0d52119c8fa7920928c7a50db022ad.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\jdpjp.exec:\jdpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fffrlfl.exec:\fffrlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\hhbttt.exec:\hhbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\ppppp.exec:\ppppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3djdv.exec:\3djdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\hnnnth.exec:\hnnnth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\tnbbnb.exec:\tnbbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\djpvp.exec:\djpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\rlxrllf.exec:\rlxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\llllfll.exec:\llllfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\tthnhh.exec:\tthnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nbbbnn.exec:\nbbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jddjj.exec:\jddjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dvvpd.exec:\dvvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rlxlfff.exec:\rlxlfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\3lffxrl.exec:\3lffxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\1xrxrrr.exec:\1xrxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\9btnnt.exec:\9btnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\hhnbtb.exec:\hhnbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\9djjd.exec:\9djjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pjpdd.exec:\pjpdd.exe23⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe24⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe25⤵
- Executes dropped EXE
PID:4564 -
\??\c:\hhbbhh.exec:\hhbbhh.exe26⤵
- Executes dropped EXE
PID:4188 -
\??\c:\bbbttn.exec:\bbbttn.exe27⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vpjpp.exec:\vpjpp.exe28⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ddjjd.exec:\ddjjd.exe29⤵
- Executes dropped EXE
PID:404 -
\??\c:\vjpjd.exec:\vjpjd.exe30⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xfxxxfx.exec:\xfxxxfx.exe31⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xrlfffx.exec:\xrlfffx.exe32⤵
- Executes dropped EXE
PID:3888 -
\??\c:\1hhnhh.exec:\1hhnhh.exe33⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bnttnb.exec:\bnttnb.exe34⤵
- Executes dropped EXE
PID:1644 -
\??\c:\tntbtt.exec:\tntbtt.exe35⤵
- Executes dropped EXE
PID:3908 -
\??\c:\5jpjv.exec:\5jpjv.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\1jjdd.exec:\1jjdd.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rlllfff.exec:\rlllfff.exe38⤵
- Executes dropped EXE
PID:4880 -
\??\c:\nbhbnn.exec:\nbhbnn.exe39⤵
- Executes dropped EXE
PID:4224 -
\??\c:\htntbh.exec:\htntbh.exe40⤵
- Executes dropped EXE
PID:4200 -
\??\c:\dvdvd.exec:\dvdvd.exe41⤵
- Executes dropped EXE
PID:5036 -
\??\c:\5ffxrll.exec:\5ffxrll.exe42⤵
- Executes dropped EXE
PID:4928 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe43⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nhnnnn.exec:\nhnnnn.exe44⤵
- Executes dropped EXE
PID:4476 -
\??\c:\ntttnt.exec:\ntttnt.exe45⤵
- Executes dropped EXE
PID:3516 -
\??\c:\vvvvj.exec:\vvvvj.exe46⤵
- Executes dropped EXE
PID:4764 -
\??\c:\lffxxxr.exec:\lffxxxr.exe47⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lfffxlf.exec:\lfffxlf.exe48⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bhthbt.exec:\bhthbt.exe49⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dvppd.exec:\dvppd.exe50⤵
- Executes dropped EXE
PID:4284 -
\??\c:\lffxxxf.exec:\lffxxxf.exe51⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nhnhhh.exec:\nhnhhh.exe52⤵
- Executes dropped EXE
PID:2148 -
\??\c:\btnhtn.exec:\btnhtn.exe53⤵
- Executes dropped EXE
PID:4688 -
\??\c:\tnnnnn.exec:\tnnnnn.exe54⤵
- Executes dropped EXE
PID:4800 -
\??\c:\tnnbth.exec:\tnnbth.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vppjd.exec:\vppjd.exe56⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lfrlffx.exec:\lfrlffx.exe57⤵
- Executes dropped EXE
PID:4540 -
\??\c:\tnbbnn.exec:\tnbbnn.exe58⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jjjjv.exec:\jjjjv.exe59⤵
- Executes dropped EXE
PID:3632 -
\??\c:\jjpjp.exec:\jjpjp.exe60⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rllfrrl.exec:\rllfrrl.exe61⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hhhthb.exec:\hhhthb.exe62⤵
- Executes dropped EXE
PID:4344 -
\??\c:\tnbnbb.exec:\tnbnbb.exe63⤵
- Executes dropped EXE
PID:3856 -
\??\c:\vvddj.exec:\vvddj.exe64⤵
- Executes dropped EXE
PID:756 -
\??\c:\djdvd.exec:\djdvd.exe65⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5xrlflf.exec:\5xrlflf.exe66⤵PID:1612
-
\??\c:\bnhhhh.exec:\bnhhhh.exe67⤵PID:412
-
\??\c:\vppjd.exec:\vppjd.exe68⤵PID:1524
-
\??\c:\jvdpj.exec:\jvdpj.exe69⤵PID:2156
-
\??\c:\lfxrrrf.exec:\lfxrrrf.exe70⤵PID:3752
-
\??\c:\xllfxff.exec:\xllfxff.exe71⤵PID:2620
-
\??\c:\3tnnhn.exec:\3tnnhn.exe72⤵PID:2844
-
\??\c:\dvjdd.exec:\dvjdd.exe73⤵PID:3852
-
\??\c:\dpddd.exec:\dpddd.exe74⤵PID:220
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe75⤵PID:320
-
\??\c:\bhnbtt.exec:\bhnbtt.exe76⤵PID:1312
-
\??\c:\vjjdv.exec:\vjjdv.exe77⤵PID:400
-
\??\c:\lrrrllf.exec:\lrrrllf.exe78⤵PID:4196
-
\??\c:\vpdjp.exec:\vpdjp.exe79⤵PID:4448
-
\??\c:\vpvvv.exec:\vpvvv.exe80⤵PID:732
-
\??\c:\pjpjd.exec:\pjpjd.exe81⤵PID:3092
-
\??\c:\frlxlrl.exec:\frlxlrl.exe82⤵PID:3576
-
\??\c:\1bnhtt.exec:\1bnhtt.exe83⤵PID:4260
-
\??\c:\jvdpv.exec:\jvdpv.exe84⤵PID:4456
-
\??\c:\3vvjd.exec:\3vvjd.exe85⤵PID:4808
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe86⤵PID:2496
-
\??\c:\bttnbb.exec:\bttnbb.exe87⤵PID:2376
-
\??\c:\3ddpj.exec:\3ddpj.exe88⤵PID:1644
-
\??\c:\rlrlrxx.exec:\rlrlrxx.exe89⤵PID:5088
-
\??\c:\vjjpp.exec:\vjjpp.exe90⤵PID:4864
-
\??\c:\bbtbbn.exec:\bbtbbn.exe91⤵PID:3544
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe92⤵PID:4212
-
\??\c:\bhnnhb.exec:\bhnnhb.exe93⤵PID:3816
-
\??\c:\dppvv.exec:\dppvv.exe94⤵PID:3720
-
\??\c:\3lllflf.exec:\3lllflf.exe95⤵PID:2404
-
\??\c:\tbhhbb.exec:\tbhhbb.exe96⤵PID:2336
-
\??\c:\rxlfxrl.exec:\rxlfxrl.exe97⤵PID:4224
-
\??\c:\vvjdp.exec:\vvjdp.exe98⤵PID:4868
-
\??\c:\lrlfffx.exec:\lrlfffx.exe99⤵PID:4940
-
\??\c:\btbttn.exec:\btbttn.exe100⤵PID:4432
-
\??\c:\1dddd.exec:\1dddd.exe101⤵PID:3920
-
\??\c:\jvpvv.exec:\jvpvv.exe102⤵PID:1248
-
\??\c:\lxxrflf.exec:\lxxrflf.exe103⤵PID:4784
-
\??\c:\htbbtn.exec:\htbbtn.exe104⤵PID:2100
-
\??\c:\7hbtnn.exec:\7hbtnn.exe105⤵PID:2300
-
\??\c:\vvpjd.exec:\vvpjd.exe106⤵PID:4296
-
\??\c:\lrxxrlf.exec:\lrxxrlf.exe107⤵PID:3668
-
\??\c:\tnhnbb.exec:\tnhnbb.exe108⤵PID:3528
-
\??\c:\jpvpj.exec:\jpvpj.exe109⤵PID:3492
-
\??\c:\jdjjj.exec:\jdjjj.exe110⤵PID:2740
-
\??\c:\rflxlfx.exec:\rflxlfx.exe111⤵PID:1720
-
\??\c:\llffrll.exec:\llffrll.exe112⤵PID:3948
-
\??\c:\bnnhbt.exec:\bnnhbt.exe113⤵PID:4908
-
\??\c:\dpvvv.exec:\dpvvv.exe114⤵PID:2072
-
\??\c:\xffxfll.exec:\xffxfll.exe115⤵PID:4540
-
\??\c:\hnbthn.exec:\hnbthn.exe116⤵PID:5100
-
\??\c:\thnhbb.exec:\thnhbb.exe117⤵PID:984
-
\??\c:\pjddv.exec:\pjddv.exe118⤵PID:3484
-
\??\c:\frrfrlf.exec:\frrfrlf.exe119⤵PID:2208
-
\??\c:\nhnntt.exec:\nhnntt.exe120⤵PID:468
-
\??\c:\hhbthh.exec:\hhbthh.exe121⤵PID:3168
-
\??\c:\7ppjd.exec:\7ppjd.exe122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-