Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe
-
Size
63KB
-
MD5
ae610220bf3e55e861668d718ea60f7f
-
SHA1
aa3a18aaa60a5f1ed6d4505dc76fe51f74fe478b
-
SHA256
e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38
-
SHA512
ff92e7e2f45c98fd357fda166d5ed3ff1bb5d2174b9d547e715607c7b20239f1c7381d26e01cbe9c6ede82c64da65f4d28365d837bef13cbf4dbef7a5bcf5bc7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh127:ymb3NkkiQ3mdBjFIFdJmA
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2888-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/2888-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3488-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3608-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3568-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5092-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/888-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/336-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/336-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2900-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3928-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2240-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/628-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1504-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2336-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2424-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3440-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3416-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4468-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3308-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2604-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1028-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3488 lfffrrx.exe 4052 btnbnn.exe 3608 3vvvp.exe 3956 ffflxxr.exe 3568 ttnnhh.exe 5092 dvddv.exe 888 rlrlrxx.exe 336 vvdvp.exe 2900 llfxlxr.exe 3928 nhhttb.exe 4996 ffxrflr.exe 2240 nntnnt.exe 628 jpvvv.exe 1504 rrfrflf.exe 5028 ddvjd.exe 2336 frrrxlx.exe 4500 5hhttn.exe 2424 lrxlrxr.exe 3440 rrfxxxf.exe 3416 ntthbn.exe 2420 pjpjv.exe 4468 lxxrxxl.exe 2144 thhtnh.exe 3308 djjjj.exe 2604 1tbhtn.exe 2712 9jvpd.exe 3976 llxxxrr.exe 3192 tnttnn.exe 1028 jdpjj.exe 2716 rllxrlx.exe 4392 jpvdj.exe 2624 xrxrlrr.exe 4840 5btbhn.exe 3532 nnhbbb.exe 1628 vvvpv.exe 1844 xrffxfr.exe 4812 rrrxlfr.exe 4684 nnnhhb.exe 4564 7jpdj.exe 2864 tnthtb.exe 3260 pdppp.exe 4644 jjjjd.exe 4020 xrxxrlf.exe 2688 nnhttt.exe 1848 jpvvj.exe 1664 9rfrfxl.exe 3156 xlfrfxl.exe 3664 btthnt.exe 4064 pdjjj.exe 2028 rxfxxll.exe 2136 btnnnh.exe 1472 ttbttt.exe 452 pvvpp.exe 3636 rrlfxrl.exe 3108 bhtbbh.exe 1888 nhnhhh.exe 5096 jjpjd.exe 1040 xxffxrl.exe 5016 7nnhhh.exe 4084 ppvpv.exe 3856 7vdjd.exe 3924 fxlllrr.exe 1976 ttthhb.exe 968 nbbthh.exe -
resource yara_rule behavioral2/memory/2888-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 3488 2888 e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe 83 PID 2888 wrote to memory of 3488 2888 e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe 83 PID 2888 wrote to memory of 3488 2888 e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe 83 PID 3488 wrote to memory of 4052 3488 lfffrrx.exe 84 PID 3488 wrote to memory of 4052 3488 lfffrrx.exe 84 PID 3488 wrote to memory of 4052 3488 lfffrrx.exe 84 PID 4052 wrote to memory of 3608 4052 btnbnn.exe 85 PID 4052 wrote to memory of 3608 4052 btnbnn.exe 85 PID 4052 wrote to memory of 3608 4052 btnbnn.exe 85 PID 3608 wrote to memory of 3956 3608 3vvvp.exe 86 PID 3608 wrote to memory of 3956 3608 3vvvp.exe 86 PID 3608 wrote to memory of 3956 3608 3vvvp.exe 86 PID 3956 wrote to memory of 3568 3956 ffflxxr.exe 87 PID 3956 wrote to memory of 3568 3956 ffflxxr.exe 87 PID 3956 wrote to memory of 3568 3956 ffflxxr.exe 87 PID 3568 wrote to memory of 5092 3568 ttnnhh.exe 88 PID 3568 wrote to memory of 5092 3568 ttnnhh.exe 88 PID 3568 wrote to memory of 5092 3568 ttnnhh.exe 88 PID 5092 wrote to memory of 888 5092 dvddv.exe 89 PID 5092 wrote to memory of 888 5092 dvddv.exe 89 PID 5092 wrote to memory of 888 5092 dvddv.exe 89 PID 888 wrote to memory of 336 888 rlrlrxx.exe 90 PID 888 wrote to memory of 336 888 rlrlrxx.exe 90 PID 888 wrote to memory of 336 888 rlrlrxx.exe 90 PID 336 wrote to memory of 2900 336 vvdvp.exe 91 PID 336 wrote to memory of 2900 336 vvdvp.exe 91 PID 336 wrote to memory of 2900 336 vvdvp.exe 91 PID 2900 wrote to memory of 3928 2900 llfxlxr.exe 92 PID 2900 wrote to memory of 3928 2900 llfxlxr.exe 92 PID 2900 wrote to memory of 3928 2900 llfxlxr.exe 92 PID 3928 wrote to memory of 4996 3928 nhhttb.exe 93 PID 3928 wrote to memory of 4996 3928 nhhttb.exe 93 PID 3928 wrote to memory of 4996 3928 nhhttb.exe 93 PID 4996 wrote to memory of 2240 4996 ffxrflr.exe 94 PID 4996 wrote to memory of 2240 4996 ffxrflr.exe 94 PID 4996 wrote to memory of 2240 4996 ffxrflr.exe 94 PID 2240 wrote to memory of 628 2240 nntnnt.exe 95 PID 2240 wrote to memory of 628 2240 nntnnt.exe 95 PID 2240 wrote to memory of 628 2240 nntnnt.exe 95 PID 628 wrote to memory of 1504 628 jpvvv.exe 96 PID 628 wrote to memory of 1504 628 jpvvv.exe 96 PID 628 wrote to memory of 1504 628 jpvvv.exe 96 PID 1504 wrote to memory of 5028 1504 rrfrflf.exe 97 PID 1504 wrote to memory of 5028 1504 rrfrflf.exe 97 PID 1504 wrote to memory of 5028 1504 rrfrflf.exe 97 PID 5028 wrote to memory of 2336 5028 ddvjd.exe 98 PID 5028 wrote to memory of 2336 5028 ddvjd.exe 98 PID 5028 wrote to memory of 2336 5028 ddvjd.exe 98 PID 2336 wrote to memory of 4500 2336 frrrxlx.exe 99 PID 2336 wrote to memory of 4500 2336 frrrxlx.exe 99 PID 2336 wrote to memory of 4500 2336 frrrxlx.exe 99 PID 4500 wrote to memory of 2424 4500 5hhttn.exe 100 PID 4500 wrote to memory of 2424 4500 5hhttn.exe 100 PID 4500 wrote to memory of 2424 4500 5hhttn.exe 100 PID 2424 wrote to memory of 3440 2424 lrxlrxr.exe 101 PID 2424 wrote to memory of 3440 2424 lrxlrxr.exe 101 PID 2424 wrote to memory of 3440 2424 lrxlrxr.exe 101 PID 3440 wrote to memory of 3416 3440 rrfxxxf.exe 102 PID 3440 wrote to memory of 3416 3440 rrfxxxf.exe 102 PID 3440 wrote to memory of 3416 3440 rrfxxxf.exe 102 PID 3416 wrote to memory of 2420 3416 ntthbn.exe 103 PID 3416 wrote to memory of 2420 3416 ntthbn.exe 103 PID 3416 wrote to memory of 2420 3416 ntthbn.exe 103 PID 2420 wrote to memory of 4468 2420 pjpjv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe"C:\Users\Admin\AppData\Local\Temp\e3c2408226b42557641f58b5b13798dd41aace3a4d9e9b64cd3554da0931fb38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\lfffrrx.exec:\lfffrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\btnbnn.exec:\btnbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\3vvvp.exec:\3vvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\ffflxxr.exec:\ffflxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\ttnnhh.exec:\ttnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\dvddv.exec:\dvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\rlrlrxx.exec:\rlrlrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\vvdvp.exec:\vvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\llfxlxr.exec:\llfxlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nhhttb.exec:\nhhttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\ffxrflr.exec:\ffxrflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\nntnnt.exec:\nntnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jpvvv.exec:\jpvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\rrfrflf.exec:\rrfrflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\ddvjd.exec:\ddvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\frrrxlx.exec:\frrrxlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\5hhttn.exec:\5hhttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\lrxlrxr.exec:\lrxlrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rrfxxxf.exec:\rrfxxxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\ntthbn.exec:\ntthbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\pjpjv.exec:\pjpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\lxxrxxl.exec:\lxxrxxl.exe23⤵
- Executes dropped EXE
PID:4468 -
\??\c:\thhtnh.exec:\thhtnh.exe24⤵
- Executes dropped EXE
PID:2144 -
\??\c:\djjjj.exec:\djjjj.exe25⤵
- Executes dropped EXE
PID:3308 -
\??\c:\1tbhtn.exec:\1tbhtn.exe26⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9jvpd.exec:\9jvpd.exe27⤵
- Executes dropped EXE
PID:2712 -
\??\c:\llxxxrr.exec:\llxxxrr.exe28⤵
- Executes dropped EXE
PID:3976 -
\??\c:\tnttnn.exec:\tnttnn.exe29⤵
- Executes dropped EXE
PID:3192 -
\??\c:\jdpjj.exec:\jdpjj.exe30⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rllxrlx.exec:\rllxrlx.exe31⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jpvdj.exec:\jpvdj.exe32⤵
- Executes dropped EXE
PID:4392 -
\??\c:\xrxrlrr.exec:\xrxrlrr.exe33⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5btbhn.exec:\5btbhn.exe34⤵
- Executes dropped EXE
PID:4840 -
\??\c:\nnhbbb.exec:\nnhbbb.exe35⤵
- Executes dropped EXE
PID:3532 -
\??\c:\vvvpv.exec:\vvvpv.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xrffxfr.exec:\xrffxfr.exe37⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rrrxlfr.exec:\rrrxlfr.exe38⤵
- Executes dropped EXE
PID:4812 -
\??\c:\nnnhhb.exec:\nnnhhb.exe39⤵
- Executes dropped EXE
PID:4684 -
\??\c:\7jpdj.exec:\7jpdj.exe40⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tnthtb.exec:\tnthtb.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pdppp.exec:\pdppp.exe42⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jjjjd.exec:\jjjjd.exe43⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xrxxrlf.exec:\xrxxrlf.exe44⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nnhttt.exec:\nnhttt.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jpvvj.exec:\jpvvj.exe46⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9rfrfxl.exec:\9rfrfxl.exe47⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe48⤵
- Executes dropped EXE
PID:3156 -
\??\c:\btthnt.exec:\btthnt.exe49⤵
- Executes dropped EXE
PID:3664 -
\??\c:\pdjjj.exec:\pdjjj.exe50⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rxfxxll.exec:\rxfxxll.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\btnnnh.exec:\btnnnh.exe52⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ttbttt.exec:\ttbttt.exe53⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pvvpp.exec:\pvvpp.exe54⤵
- Executes dropped EXE
PID:452 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe55⤵
- Executes dropped EXE
PID:3636 -
\??\c:\bhtbbh.exec:\bhtbbh.exe56⤵
- Executes dropped EXE
PID:3108 -
\??\c:\nhnhhh.exec:\nhnhhh.exe57⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jjpjd.exec:\jjpjd.exe58⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xxffxrl.exec:\xxffxrl.exe59⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7nnhhh.exec:\7nnhhh.exe60⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ppvpv.exec:\ppvpv.exe61⤵
- Executes dropped EXE
PID:4084 -
\??\c:\7vdjd.exec:\7vdjd.exe62⤵
- Executes dropped EXE
PID:3856 -
\??\c:\fxlllrr.exec:\fxlllrr.exe63⤵
- Executes dropped EXE
PID:3924 -
\??\c:\ttthhb.exec:\ttthhb.exe64⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nbbthh.exec:\nbbthh.exe65⤵
- Executes dropped EXE
PID:968 -
\??\c:\lrrrffx.exec:\lrrrffx.exe66⤵PID:2076
-
\??\c:\rlfxflx.exec:\rlfxflx.exe67⤵PID:948
-
\??\c:\hhtbnh.exec:\hhtbnh.exe68⤵PID:4468
-
\??\c:\9pjdj.exec:\9pjdj.exe69⤵PID:2140
-
\??\c:\fxfrflf.exec:\fxfrflf.exe70⤵PID:876
-
\??\c:\thhhth.exec:\thhhth.exe71⤵PID:2604
-
\??\c:\jppvj.exec:\jppvj.exe72⤵PID:2712
-
\??\c:\rfrxffl.exec:\rfrxffl.exe73⤵PID:2360
-
\??\c:\xfrrflr.exec:\xfrrflr.exe74⤵PID:4524
-
\??\c:\hnbttt.exec:\hnbttt.exe75⤵PID:3920
-
\??\c:\jddpp.exec:\jddpp.exe76⤵PID:1088
-
\??\c:\lxrxffx.exec:\lxrxffx.exe77⤵PID:4868
-
\??\c:\fxxlxlr.exec:\fxxlxlr.exe78⤵PID:432
-
\??\c:\thnhtn.exec:\thnhtn.exe79⤵PID:2280
-
\??\c:\jvpdv.exec:\jvpdv.exe80⤵PID:1672
-
\??\c:\rxxrrll.exec:\rxxrrll.exe81⤵PID:1360
-
\??\c:\rfflxlx.exec:\rfflxlx.exe82⤵PID:3036
-
\??\c:\hnntbh.exec:\hnntbh.exe83⤵PID:1992
-
\??\c:\vdppp.exec:\vdppp.exe84⤵PID:2428
-
\??\c:\lflrxlx.exec:\lflrxlx.exe85⤵PID:4316
-
\??\c:\hbnhnh.exec:\hbnhnh.exe86⤵PID:2532
-
\??\c:\thnhtt.exec:\thnhtt.exe87⤵PID:3388
-
\??\c:\jjdvj.exec:\jjdvj.exe88⤵PID:4052
-
\??\c:\tththb.exec:\tththb.exe89⤵PID:2172
-
\??\c:\jvvjd.exec:\jvvjd.exe90⤵PID:1816
-
\??\c:\rfrxflf.exec:\rfrxflf.exe91⤵PID:2080
-
\??\c:\dpddj.exec:\dpddj.exe92⤵PID:2688
-
\??\c:\xrfxrxx.exec:\xrfxrxx.exe93⤵PID:1848
-
\??\c:\bnttbt.exec:\bnttbt.exe94⤵PID:1664
-
\??\c:\pjjjj.exec:\pjjjj.exe95⤵PID:3156
-
\??\c:\fflfxrl.exec:\fflfxrl.exe96⤵PID:4232
-
\??\c:\bhthbt.exec:\bhthbt.exe97⤵PID:3196
-
\??\c:\ttnnht.exec:\ttnnht.exe98⤵PID:464
-
\??\c:\jvjvv.exec:\jvjvv.exe99⤵PID:4336
-
\??\c:\1frllll.exec:\1frllll.exe100⤵PID:2488
-
\??\c:\flrxxxf.exec:\flrxxxf.exe101⤵PID:1904
-
\??\c:\thtntb.exec:\thtntb.exe102⤵PID:5116
-
\??\c:\vvjdd.exec:\vvjdd.exe103⤵PID:1040
-
\??\c:\ddjjj.exec:\ddjjj.exe104⤵PID:5016
-
\??\c:\xrxllll.exec:\xrxllll.exe105⤵PID:1780
-
\??\c:\bnthth.exec:\bnthth.exe106⤵PID:1976
-
\??\c:\bhnbnn.exec:\bhnbnn.exe107⤵PID:968
-
\??\c:\djdvp.exec:\djdvp.exe108⤵PID:2988
-
\??\c:\lxxlxxl.exec:\lxxlxxl.exe109⤵PID:4412
-
\??\c:\xrlllff.exec:\xrlllff.exe110⤵PID:4820
-
\??\c:\nhnnnh.exec:\nhnnnh.exe111⤵PID:3212
-
\??\c:\dddvp.exec:\dddvp.exe112⤵PID:1624
-
\??\c:\llrllll.exec:\llrllll.exe113⤵PID:3860
-
\??\c:\jjjjj.exec:\jjjjj.exe114⤵PID:436
-
\??\c:\jpjvp.exec:\jpjvp.exe115⤵PID:4524
-
\??\c:\lffxxxx.exec:\lffxxxx.exe116⤵PID:3660
-
\??\c:\bnhnhn.exec:\bnhnhn.exe117⤵PID:2968
-
\??\c:\pjvvv.exec:\pjvvv.exe118⤵PID:2724
-
\??\c:\vjvdv.exec:\vjvdv.exe119⤵PID:3540
-
\??\c:\bbhhhh.exec:\bbhhhh.exe120⤵PID:2280
-
\??\c:\pvvvp.exec:\pvvvp.exe121⤵PID:3144
-
\??\c:\5lrrxff.exec:\5lrrxff.exe122⤵PID:1628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-