Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1.exe
-
Size
247KB
-
MD5
64faf630f2df173f8bc440f5db9f7d72
-
SHA1
db21c91b016f48ef9c2cb6edad8ec2feae322eea
-
SHA256
f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1
-
SHA512
89645a481e32cd947517fa54630185aa6f05ed690fef53d68fcc89c5e17202165e9e29b13e9c13367666a8b5e7812fff1be60d5001e9fe56b298b80a3600134c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR17:n3C9BRo7MlrWKo+lxtvGt17
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/2236-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/2236-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4976-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1684-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4760-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2828-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3524-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3812-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1668-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1508-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3812-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3812-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3724-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/888-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2904-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4532-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4756-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3160-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3940-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4076-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1200-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4112-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/372-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3576 jjpjp.exe 4976 xxrfrlf.exe 4760 bhnhbb.exe 1684 ddpjj.exe 2828 jdvpj.exe 1508 9ppjv.exe 3524 ffxfrfl.exe 1668 hntnnn.exe 3812 bhthnn.exe 3724 pjjdp.exe 1648 flxrfxr.exe 888 bthbhh.exe 32 3flfflf.exe 388 hhbnhh.exe 2904 jdjdv.exe 4520 3lrrlll.exe 4532 bbbhhh.exe 4756 dpjvj.exe 3160 xrfffxx.exe 816 bttnnn.exe 1080 xrrxxfr.exe 4508 fxxrrrr.exe 2556 tnhtbb.exe 2916 xfrfrfl.exe 3940 xllrxfx.exe 4076 bhnnbb.exe 3888 fxxxrrr.exe 1200 xflllxx.exe 4112 1bbttt.exe 3120 xxlrflf.exe 372 bthnbb.exe 2144 ddjjd.exe 1428 lfrfrfx.exe 636 ntttnn.exe 1588 5ddvd.exe 3576 1rxrrrf.exe 4976 xrrfxll.exe 3444 3tbbtb.exe 4916 dpppv.exe 2184 ppjjd.exe 2896 lrxrllf.exe 2480 nnttbb.exe 2032 nnhnnn.exe 4004 pvjdv.exe 1420 7flxrrl.exe 4512 tbtnhb.exe 1132 1vdvj.exe 1544 vdvpj.exe 5064 llfffxf.exe 2112 1nhbnh.exe 888 bhnbth.exe 4016 jppjd.exe 1496 fxxxlrl.exe 2656 frxrxrl.exe 2516 htttnh.exe 2568 1jjdp.exe 3708 7lrxrll.exe 216 bhhbnn.exe 1504 jpppj.exe 2164 rffxrlf.exe 208 1lrxlxf.exe 4580 nbtnhb.exe 1836 bhtbnn.exe 4404 ddjdv.exe -
resource yara_rule behavioral2/memory/2236-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 3576 2236 f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1.exe 83 PID 2236 wrote to memory of 3576 2236 f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1.exe 83 PID 2236 wrote to memory of 3576 2236 f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1.exe 83 PID 3576 wrote to memory of 4976 3576 jjpjp.exe 84 PID 3576 wrote to memory of 4976 3576 jjpjp.exe 84 PID 3576 wrote to memory of 4976 3576 jjpjp.exe 84 PID 4976 wrote to memory of 4760 4976 xxrfrlf.exe 85 PID 4976 wrote to memory of 4760 4976 xxrfrlf.exe 85 PID 4976 wrote to memory of 4760 4976 xxrfrlf.exe 85 PID 4760 wrote to memory of 1684 4760 bhnhbb.exe 86 PID 4760 wrote to memory of 1684 4760 bhnhbb.exe 86 PID 4760 wrote to memory of 1684 4760 bhnhbb.exe 86 PID 1684 wrote to memory of 2828 1684 ddpjj.exe 87 PID 1684 wrote to memory of 2828 1684 ddpjj.exe 87 PID 1684 wrote to memory of 2828 1684 ddpjj.exe 87 PID 2828 wrote to memory of 1508 2828 jdvpj.exe 88 PID 2828 wrote to memory of 1508 2828 jdvpj.exe 88 PID 2828 wrote to memory of 1508 2828 jdvpj.exe 88 PID 1508 wrote to memory of 3524 1508 9ppjv.exe 89 PID 1508 wrote to memory of 3524 1508 9ppjv.exe 89 PID 1508 wrote to memory of 3524 1508 9ppjv.exe 89 PID 3524 wrote to memory of 1668 3524 ffxfrfl.exe 90 PID 3524 wrote to memory of 1668 3524 ffxfrfl.exe 90 PID 3524 wrote to memory of 1668 3524 ffxfrfl.exe 90 PID 1668 wrote to memory of 3812 1668 hntnnn.exe 91 PID 1668 wrote to memory of 3812 1668 hntnnn.exe 91 PID 1668 wrote to memory of 3812 1668 hntnnn.exe 91 PID 3812 wrote to memory of 3724 3812 bhthnn.exe 93 PID 3812 wrote to memory of 3724 3812 bhthnn.exe 93 PID 3812 wrote to memory of 3724 3812 bhthnn.exe 93 PID 3724 wrote to memory of 1648 3724 pjjdp.exe 95 PID 3724 wrote to memory of 1648 3724 pjjdp.exe 95 PID 3724 wrote to memory of 1648 3724 pjjdp.exe 95 PID 1648 wrote to memory of 888 1648 flxrfxr.exe 96 PID 1648 wrote to memory of 888 1648 flxrfxr.exe 96 PID 1648 wrote to memory of 888 1648 flxrfxr.exe 96 PID 888 wrote to memory of 32 888 bthbhh.exe 97 PID 888 wrote to memory of 32 888 bthbhh.exe 97 PID 888 wrote to memory of 32 888 bthbhh.exe 97 PID 32 wrote to memory of 388 32 3flfflf.exe 98 PID 32 wrote to memory of 388 32 3flfflf.exe 98 PID 32 wrote to memory of 388 32 3flfflf.exe 98 PID 388 wrote to memory of 2904 388 hhbnhh.exe 99 PID 388 wrote to memory of 2904 388 hhbnhh.exe 99 PID 388 wrote to memory of 2904 388 hhbnhh.exe 99 PID 2904 wrote to memory of 4520 2904 jdjdv.exe 100 PID 2904 wrote to memory of 4520 2904 jdjdv.exe 100 PID 2904 wrote to memory of 4520 2904 jdjdv.exe 100 PID 4520 wrote to memory of 4532 4520 3lrrlll.exe 101 PID 4520 wrote to memory of 4532 4520 3lrrlll.exe 101 PID 4520 wrote to memory of 4532 4520 3lrrlll.exe 101 PID 4532 wrote to memory of 4756 4532 bbbhhh.exe 103 PID 4532 wrote to memory of 4756 4532 bbbhhh.exe 103 PID 4532 wrote to memory of 4756 4532 bbbhhh.exe 103 PID 4756 wrote to memory of 3160 4756 dpjvj.exe 104 PID 4756 wrote to memory of 3160 4756 dpjvj.exe 104 PID 4756 wrote to memory of 3160 4756 dpjvj.exe 104 PID 3160 wrote to memory of 816 3160 xrfffxx.exe 106 PID 3160 wrote to memory of 816 3160 xrfffxx.exe 106 PID 3160 wrote to memory of 816 3160 xrfffxx.exe 106 PID 816 wrote to memory of 1080 816 bttnnn.exe 107 PID 816 wrote to memory of 1080 816 bttnnn.exe 107 PID 816 wrote to memory of 1080 816 bttnnn.exe 107 PID 1080 wrote to memory of 4508 1080 xrrxxfr.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1.exe"C:\Users\Admin\AppData\Local\Temp\f20519a9c8f70f3e78a1ef5c8a7cedf6dd22ba5776fff8f195a3b85ba645b8f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\jjpjp.exec:\jjpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\xxrfrlf.exec:\xxrfrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\bhnhbb.exec:\bhnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\ddpjj.exec:\ddpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jdvpj.exec:\jdvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\9ppjv.exec:\9ppjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\ffxfrfl.exec:\ffxfrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\hntnnn.exec:\hntnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bhthnn.exec:\bhthnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\pjjdp.exec:\pjjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\flxrfxr.exec:\flxrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\bthbhh.exec:\bthbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\3flfflf.exec:\3flfflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\hhbnhh.exec:\hhbnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\jdjdv.exec:\jdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3lrrlll.exec:\3lrrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\bbbhhh.exec:\bbbhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\dpjvj.exec:\dpjvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\xrfffxx.exec:\xrfffxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\bttnnn.exec:\bttnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\xrrxxfr.exec:\xrrxxfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe23⤵
- Executes dropped EXE
PID:4508 -
\??\c:\tnhtbb.exec:\tnhtbb.exe24⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xfrfrfl.exec:\xfrfrfl.exe25⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xllrxfx.exec:\xllrxfx.exe26⤵
- Executes dropped EXE
PID:3940 -
\??\c:\bhnnbb.exec:\bhnnbb.exe27⤵
- Executes dropped EXE
PID:4076 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe28⤵
- Executes dropped EXE
PID:3888 -
\??\c:\xflllxx.exec:\xflllxx.exe29⤵
- Executes dropped EXE
PID:1200 -
\??\c:\1bbttt.exec:\1bbttt.exe30⤵
- Executes dropped EXE
PID:4112 -
\??\c:\xxlrflf.exec:\xxlrflf.exe31⤵
- Executes dropped EXE
PID:3120 -
\??\c:\bthnbb.exec:\bthnbb.exe32⤵
- Executes dropped EXE
PID:372 -
\??\c:\ddjjd.exec:\ddjjd.exe33⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lfrfrfx.exec:\lfrfrfx.exe34⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ntttnn.exec:\ntttnn.exe35⤵
- Executes dropped EXE
PID:636 -
\??\c:\nbtthn.exec:\nbtthn.exe36⤵PID:4504
-
\??\c:\5ddvd.exec:\5ddvd.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\1rxrrrf.exec:\1rxrrrf.exe38⤵
- Executes dropped EXE
PID:3576 -
\??\c:\xrrfxll.exec:\xrrfxll.exe39⤵
- Executes dropped EXE
PID:4976 -
\??\c:\3tbbtb.exec:\3tbbtb.exe40⤵
- Executes dropped EXE
PID:3444 -
\??\c:\dpppv.exec:\dpppv.exe41⤵
- Executes dropped EXE
PID:4916 -
\??\c:\ppjjd.exec:\ppjjd.exe42⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lrxrllf.exec:\lrxrllf.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nnttbb.exec:\nnttbb.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nnhnnn.exec:\nnhnnn.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pvjdv.exec:\pvjdv.exe46⤵
- Executes dropped EXE
PID:4004 -
\??\c:\7flxrrl.exec:\7flxrrl.exe47⤵
- Executes dropped EXE
PID:1420 -
\??\c:\tbtnhb.exec:\tbtnhb.exe48⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1vdvj.exec:\1vdvj.exe49⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vdvpj.exec:\vdvpj.exe50⤵
- Executes dropped EXE
PID:1544 -
\??\c:\llfffxf.exec:\llfffxf.exe51⤵
- Executes dropped EXE
PID:5064 -
\??\c:\1nhbnh.exec:\1nhbnh.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bhnbth.exec:\bhnbth.exe53⤵
- Executes dropped EXE
PID:888 -
\??\c:\jppjd.exec:\jppjd.exe54⤵
- Executes dropped EXE
PID:4016 -
\??\c:\fxxxlrl.exec:\fxxxlrl.exe55⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frxrxrl.exec:\frxrxrl.exe56⤵
- Executes dropped EXE
PID:2656 -
\??\c:\htttnh.exec:\htttnh.exe57⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1jjdp.exec:\1jjdp.exe58⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7lrxrll.exec:\7lrxrll.exe59⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bhhbnn.exec:\bhhbnn.exe60⤵
- Executes dropped EXE
PID:216 -
\??\c:\jpppj.exec:\jpppj.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rffxrlf.exec:\rffxrlf.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1lrxlxf.exec:\1lrxlxf.exe63⤵
- Executes dropped EXE
PID:208 -
\??\c:\nbtnhb.exec:\nbtnhb.exe64⤵
- Executes dropped EXE
PID:4580 -
\??\c:\bhtbnn.exec:\bhtbnn.exe65⤵
- Executes dropped EXE
PID:1836 -
\??\c:\ddjdv.exec:\ddjdv.exe66⤵
- Executes dropped EXE
PID:4404 -
\??\c:\5rxfrrl.exec:\5rxfrrl.exe67⤵PID:4960
-
\??\c:\tntnhh.exec:\tntnhh.exe68⤵PID:848
-
\??\c:\vvjpv.exec:\vvjpv.exe69⤵PID:1980
-
\??\c:\5rfxffl.exec:\5rfxffl.exe70⤵PID:3600
-
\??\c:\hbhbbt.exec:\hbhbbt.exe71⤵PID:4076
-
\??\c:\9jvvv.exec:\9jvvv.exe72⤵PID:2304
-
\??\c:\3dvjj.exec:\3dvjj.exe73⤵PID:3964
-
\??\c:\5lrxlrx.exec:\5lrxlrx.exe74⤵PID:3588
-
\??\c:\bbhhht.exec:\bbhhht.exe75⤵PID:1712
-
\??\c:\httthb.exec:\httthb.exe76⤵PID:4716
-
\??\c:\jpvvp.exec:\jpvvp.exe77⤵PID:3656
-
\??\c:\frxlxfl.exec:\frxlxfl.exe78⤵PID:1956
-
\??\c:\bhbbbt.exec:\bhbbbt.exe79⤵PID:4488
-
\??\c:\pdppv.exec:\pdppv.exe80⤵PID:2236
-
\??\c:\dpjpj.exec:\dpjpj.exe81⤵PID:4504
-
\??\c:\rlxrllf.exec:\rlxrllf.exe82⤵PID:2160
-
\??\c:\hnnhbb.exec:\hnnhbb.exe83⤵PID:2768
-
\??\c:\tthhbb.exec:\tthhbb.exe84⤵PID:3696
-
\??\c:\jjjpp.exec:\jjjpp.exe85⤵PID:2280
-
\??\c:\frxrllf.exec:\frxrllf.exe86⤵PID:2992
-
\??\c:\thnnhh.exec:\thnnhh.exe87⤵PID:4356
-
\??\c:\pdjvv.exec:\pdjvv.exe88⤵PID:4440
-
\??\c:\3ffxrxx.exec:\3ffxrxx.exe89⤵PID:2244
-
\??\c:\llxlxrr.exec:\llxlxrr.exe90⤵PID:2800
-
\??\c:\thtnhh.exec:\thtnhh.exe91⤵PID:1308
-
\??\c:\1vdpd.exec:\1vdpd.exe92⤵PID:1548
-
\??\c:\rllllxr.exec:\rllllxr.exe93⤵PID:3056
-
\??\c:\frrfxff.exec:\frrfxff.exe94⤵PID:2060
-
\??\c:\frfrfrx.exec:\frfrfrx.exe95⤵PID:3724
-
\??\c:\nhhhbb.exec:\nhhhbb.exe96⤵PID:2700
-
\??\c:\jpvpj.exec:\jpvpj.exe97⤵PID:1444
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe98⤵PID:2268
-
\??\c:\bbhnhn.exec:\bbhnhn.exe99⤵PID:2084
-
\??\c:\jpdjp.exec:\jpdjp.exe100⤵PID:1264
-
\??\c:\rxrxfxf.exec:\rxrxfxf.exe101⤵PID:4072
-
\??\c:\1bhttn.exec:\1bhttn.exe102⤵PID:4980
-
\??\c:\9tbnbb.exec:\9tbnbb.exe103⤵PID:1364
-
\??\c:\jjdvj.exec:\jjdvj.exe104⤵PID:1788
-
\??\c:\rlrxrfx.exec:\rlrxrfx.exe105⤵PID:4084
-
\??\c:\xlxfrrl.exec:\xlxfrrl.exe106⤵PID:2164
-
\??\c:\tbhbnn.exec:\tbhbnn.exe107⤵PID:1196
-
\??\c:\vpjdp.exec:\vpjdp.exe108⤵PID:712
-
\??\c:\rlflrlf.exec:\rlflrlf.exe109⤵PID:912
-
\??\c:\ntbtnh.exec:\ntbtnh.exe110⤵PID:4404
-
\??\c:\ntttnn.exec:\ntttnn.exe111⤵PID:2644
-
\??\c:\vjjdp.exec:\vjjdp.exe112⤵PID:848
-
\??\c:\fflfxxx.exec:\fflfxxx.exe113⤵PID:4140
-
\??\c:\hhhbbb.exec:\hhhbbb.exe114⤵PID:1464
-
\??\c:\nnbtnh.exec:\nnbtnh.exe115⤵PID:2636
-
\??\c:\vvvpj.exec:\vvvpj.exe116⤵PID:1256
-
\??\c:\rlllrll.exec:\rlllrll.exe117⤵PID:2440
-
\??\c:\ntttnh.exec:\ntttnh.exe118⤵PID:4816
-
\??\c:\dpjdv.exec:\dpjdv.exe119⤵PID:1580
-
\??\c:\vpvvv.exec:\vpvvv.exe120⤵PID:4008
-
\??\c:\9xfrrll.exec:\9xfrrll.exe121⤵PID:3828
-
\??\c:\3thttt.exec:\3thttt.exe122⤵PID:1660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-