Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe
-
Size
67KB
-
MD5
a80e634de8e51a464fd354299098f1fd
-
SHA1
494417d36dfe792e50f0bdd44dac8cbc528d61a5
-
SHA256
dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6
-
SHA512
58e5bdfce3dc88e5b0efbda676b515ae4c881d077abdf8175934444464638a70278ea6ce162b0ad1a82c27f700b22e93038bff6478efc966c120cc34c06f2907
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIu:ymb3NkkiQ3mdBjFIFdJ8bG
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/5060-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/184-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/5060-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/184-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5048-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2256-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2224-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2040-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4200-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4200-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4200-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3744-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2388-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1008-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4276-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1656-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4380-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4716-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1932-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4424-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4612-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4684-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2368-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1760-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2236-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 5048 vjppv.exe 184 dvpjd.exe 2256 lffxllf.exe 2224 htbbbb.exe 2040 ttnbnn.exe 3288 jdjdp.exe 4200 fllfxxr.exe 4880 hbthhh.exe 3744 jdjdd.exe 2388 xrxrllf.exe 1008 hthttn.exe 5064 vvppd.exe 4276 rlrlfff.exe 2972 nbhbtt.exe 1656 5pddp.exe 4380 rrfffxf.exe 4868 hthbbb.exe 4716 vppjj.exe 1828 rrlxllf.exe 1932 7bhtnt.exe 4132 pddpj.exe 4424 jdpjd.exe 4612 vpdvj.exe 4684 3llfrrr.exe 2368 lxxrxxf.exe 3300 3bbbbb.exe 1760 dddvp.exe 1640 jvdvp.exe 3476 lrxxxxx.exe 1680 hhhbbn.exe 2236 lxxrffx.exe 2340 bhhbhh.exe 3816 dvddv.exe 4556 ppdpj.exe 4964 fxffrfx.exe 424 rfffxrr.exe 3636 hbnntn.exe 1800 jjpjj.exe 3196 fxrrfff.exe 3460 7hnhbb.exe 4736 pjvvj.exe 2076 rllfxxr.exe 5000 lfffxxx.exe 4816 tnntnb.exe 2104 jjvvj.exe 2856 jddvd.exe 2640 7lxrlrl.exe 4048 3ttttt.exe 1016 tnttnn.exe 692 jvddp.exe 1192 7ffxrxx.exe 3096 rrrrlll.exe 2828 7htbtn.exe 4516 vdjjj.exe 4280 jdddp.exe 3828 1rllxrr.exe 1352 ttnbbb.exe 1896 nhtntt.exe 4088 jdpjd.exe 380 rxlxlxf.exe 2888 nbbttt.exe 2096 htbbtb.exe 1984 vvpjd.exe 3156 5pdvv.exe -
resource yara_rule behavioral2/memory/5060-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5060 wrote to memory of 5048 5060 dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe 84 PID 5060 wrote to memory of 5048 5060 dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe 84 PID 5060 wrote to memory of 5048 5060 dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe 84 PID 5048 wrote to memory of 184 5048 vjppv.exe 85 PID 5048 wrote to memory of 184 5048 vjppv.exe 85 PID 5048 wrote to memory of 184 5048 vjppv.exe 85 PID 184 wrote to memory of 2256 184 dvpjd.exe 86 PID 184 wrote to memory of 2256 184 dvpjd.exe 86 PID 184 wrote to memory of 2256 184 dvpjd.exe 86 PID 2256 wrote to memory of 2224 2256 lffxllf.exe 87 PID 2256 wrote to memory of 2224 2256 lffxllf.exe 87 PID 2256 wrote to memory of 2224 2256 lffxllf.exe 87 PID 2224 wrote to memory of 2040 2224 htbbbb.exe 88 PID 2224 wrote to memory of 2040 2224 htbbbb.exe 88 PID 2224 wrote to memory of 2040 2224 htbbbb.exe 88 PID 2040 wrote to memory of 3288 2040 ttnbnn.exe 89 PID 2040 wrote to memory of 3288 2040 ttnbnn.exe 89 PID 2040 wrote to memory of 3288 2040 ttnbnn.exe 89 PID 3288 wrote to memory of 4200 3288 jdjdp.exe 90 PID 3288 wrote to memory of 4200 3288 jdjdp.exe 90 PID 3288 wrote to memory of 4200 3288 jdjdp.exe 90 PID 4200 wrote to memory of 4880 4200 fllfxxr.exe 91 PID 4200 wrote to memory of 4880 4200 fllfxxr.exe 91 PID 4200 wrote to memory of 4880 4200 fllfxxr.exe 91 PID 4880 wrote to memory of 3744 4880 hbthhh.exe 92 PID 4880 wrote to memory of 3744 4880 hbthhh.exe 92 PID 4880 wrote to memory of 3744 4880 hbthhh.exe 92 PID 3744 wrote to memory of 2388 3744 jdjdd.exe 93 PID 3744 wrote to memory of 2388 3744 jdjdd.exe 93 PID 3744 wrote to memory of 2388 3744 jdjdd.exe 93 PID 2388 wrote to memory of 1008 2388 xrxrllf.exe 94 PID 2388 wrote to memory of 1008 2388 xrxrllf.exe 94 PID 2388 wrote to memory of 1008 2388 xrxrllf.exe 94 PID 1008 wrote to memory of 5064 1008 hthttn.exe 95 PID 1008 wrote to memory of 5064 1008 hthttn.exe 95 PID 1008 wrote to memory of 5064 1008 hthttn.exe 95 PID 5064 wrote to memory of 4276 5064 vvppd.exe 96 PID 5064 wrote to memory of 4276 5064 vvppd.exe 96 PID 5064 wrote to memory of 4276 5064 vvppd.exe 96 PID 4276 wrote to memory of 2972 4276 rlrlfff.exe 97 PID 4276 wrote to memory of 2972 4276 rlrlfff.exe 97 PID 4276 wrote to memory of 2972 4276 rlrlfff.exe 97 PID 2972 wrote to memory of 1656 2972 nbhbtt.exe 98 PID 2972 wrote to memory of 1656 2972 nbhbtt.exe 98 PID 2972 wrote to memory of 1656 2972 nbhbtt.exe 98 PID 1656 wrote to memory of 4380 1656 5pddp.exe 99 PID 1656 wrote to memory of 4380 1656 5pddp.exe 99 PID 1656 wrote to memory of 4380 1656 5pddp.exe 99 PID 4380 wrote to memory of 4868 4380 rrfffxf.exe 100 PID 4380 wrote to memory of 4868 4380 rrfffxf.exe 100 PID 4380 wrote to memory of 4868 4380 rrfffxf.exe 100 PID 4868 wrote to memory of 4716 4868 hthbbb.exe 101 PID 4868 wrote to memory of 4716 4868 hthbbb.exe 101 PID 4868 wrote to memory of 4716 4868 hthbbb.exe 101 PID 4716 wrote to memory of 1828 4716 vppjj.exe 102 PID 4716 wrote to memory of 1828 4716 vppjj.exe 102 PID 4716 wrote to memory of 1828 4716 vppjj.exe 102 PID 1828 wrote to memory of 1932 1828 rrlxllf.exe 103 PID 1828 wrote to memory of 1932 1828 rrlxllf.exe 103 PID 1828 wrote to memory of 1932 1828 rrlxllf.exe 103 PID 1932 wrote to memory of 4132 1932 7bhtnt.exe 104 PID 1932 wrote to memory of 4132 1932 7bhtnt.exe 104 PID 1932 wrote to memory of 4132 1932 7bhtnt.exe 104 PID 4132 wrote to memory of 4424 4132 pddpj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe"C:\Users\Admin\AppData\Local\Temp\dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vjppv.exec:\vjppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\dvpjd.exec:\dvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\lffxllf.exec:\lffxllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\htbbbb.exec:\htbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\ttnbnn.exec:\ttnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jdjdp.exec:\jdjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\fllfxxr.exec:\fllfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\hbthhh.exec:\hbthhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\jdjdd.exec:\jdjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\xrxrllf.exec:\xrxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\hthttn.exec:\hthttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\vvppd.exec:\vvppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\rlrlfff.exec:\rlrlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\nbhbtt.exec:\nbhbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\5pddp.exec:\5pddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rrfffxf.exec:\rrfffxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\hthbbb.exec:\hthbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\vppjj.exec:\vppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\rrlxllf.exec:\rrlxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\7bhtnt.exec:\7bhtnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\pddpj.exec:\pddpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\jdpjd.exec:\jdpjd.exe23⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vpdvj.exec:\vpdvj.exe24⤵
- Executes dropped EXE
PID:4612 -
\??\c:\3llfrrr.exec:\3llfrrr.exe25⤵
- Executes dropped EXE
PID:4684 -
\??\c:\lxxrxxf.exec:\lxxrxxf.exe26⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3bbbbb.exec:\3bbbbb.exe27⤵
- Executes dropped EXE
PID:3300 -
\??\c:\dddvp.exec:\dddvp.exe28⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jvdvp.exec:\jvdvp.exe29⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe30⤵
- Executes dropped EXE
PID:3476 -
\??\c:\hhhbbn.exec:\hhhbbn.exe31⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lxxrffx.exec:\lxxrffx.exe32⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bhhbhh.exec:\bhhbhh.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dvddv.exec:\dvddv.exe34⤵
- Executes dropped EXE
PID:3816 -
\??\c:\ppdpj.exec:\ppdpj.exe35⤵
- Executes dropped EXE
PID:4556 -
\??\c:\fxffrfx.exec:\fxffrfx.exe36⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rfffxrr.exec:\rfffxrr.exe37⤵
- Executes dropped EXE
PID:424 -
\??\c:\hbnntn.exec:\hbnntn.exe38⤵
- Executes dropped EXE
PID:3636 -
\??\c:\jjpjj.exec:\jjpjj.exe39⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxrrfff.exec:\fxrrfff.exe40⤵
- Executes dropped EXE
PID:3196 -
\??\c:\7hnhbb.exec:\7hnhbb.exe41⤵
- Executes dropped EXE
PID:3460 -
\??\c:\pjvvj.exec:\pjvvj.exe42⤵
- Executes dropped EXE
PID:4736 -
\??\c:\rllfxxr.exec:\rllfxxr.exe43⤵
- Executes dropped EXE
PID:2076 -
\??\c:\lfffxxx.exec:\lfffxxx.exe44⤵
- Executes dropped EXE
PID:5000 -
\??\c:\tnntnb.exec:\tnntnb.exe45⤵
- Executes dropped EXE
PID:4816 -
\??\c:\jjvvj.exec:\jjvvj.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jddvd.exec:\jddvd.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7lxrlrl.exec:\7lxrlrl.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3ttttt.exec:\3ttttt.exe49⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tnttnn.exec:\tnttnn.exe50⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jvddp.exec:\jvddp.exe51⤵
- Executes dropped EXE
PID:692 -
\??\c:\7ffxrxx.exec:\7ffxrxx.exe52⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rrrrlll.exec:\rrrrlll.exe53⤵
- Executes dropped EXE
PID:3096 -
\??\c:\7htbtn.exec:\7htbtn.exe54⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vdjjj.exec:\vdjjj.exe55⤵
- Executes dropped EXE
PID:4516 -
\??\c:\jdddp.exec:\jdddp.exe56⤵
- Executes dropped EXE
PID:4280 -
\??\c:\1rllxrr.exec:\1rllxrr.exe57⤵
- Executes dropped EXE
PID:3828 -
\??\c:\ttnbbb.exec:\ttnbbb.exe58⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nhtntt.exec:\nhtntt.exe59⤵
- Executes dropped EXE
PID:1896 -
\??\c:\jdpjd.exec:\jdpjd.exe60⤵
- Executes dropped EXE
PID:4088 -
\??\c:\rxlxlxf.exec:\rxlxlxf.exe61⤵
- Executes dropped EXE
PID:380 -
\??\c:\nbbttt.exec:\nbbttt.exe62⤵
- Executes dropped EXE
PID:2888 -
\??\c:\htbbtb.exec:\htbbtb.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vvpjd.exec:\vvpjd.exe64⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5pdvv.exec:\5pdvv.exe65⤵
- Executes dropped EXE
PID:3156 -
\??\c:\lrrxllf.exec:\lrrxllf.exe66⤵PID:4484
-
\??\c:\bthnhh.exec:\bthnhh.exe67⤵PID:3764
-
\??\c:\jvjdj.exec:\jvjdj.exe68⤵PID:1324
-
\??\c:\rrrrflf.exec:\rrrrflf.exe69⤵PID:3848
-
\??\c:\tthnnn.exec:\tthnnn.exe70⤵PID:4400
-
\??\c:\nhnhbb.exec:\nhnhbb.exe71⤵PID:3556
-
\??\c:\7pdjj.exec:\7pdjj.exe72⤵PID:3116
-
\??\c:\rxllfff.exec:\rxllfff.exe73⤵PID:4952
-
\??\c:\lrrllrl.exec:\lrrllrl.exe74⤵PID:2192
-
\??\c:\1bnhnn.exec:\1bnhnn.exe75⤵PID:3244
-
\??\c:\bbbbnn.exec:\bbbbnn.exe76⤵PID:2848
-
\??\c:\vpddd.exec:\vpddd.exe77⤵PID:2212
-
\??\c:\lllrlrl.exec:\lllrlrl.exe78⤵PID:5080
-
\??\c:\nhttnt.exec:\nhttnt.exe79⤵PID:2316
-
\??\c:\hhnhtb.exec:\hhnhtb.exe80⤵PID:4956
-
\??\c:\pjjdv.exec:\pjjdv.exe81⤵PID:4176
-
\??\c:\rxrxxxx.exec:\rxrxxxx.exe82⤵PID:2912
-
\??\c:\3ffxxlf.exec:\3ffxxlf.exe83⤵PID:5024
-
\??\c:\hbhnnt.exec:\hbhnnt.exe84⤵PID:2496
-
\??\c:\vpvdv.exec:\vpvdv.exe85⤵PID:3380
-
\??\c:\vppvj.exec:\vppvj.exe86⤵PID:5008
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe87⤵PID:2800
-
\??\c:\rlllfff.exec:\rlllfff.exe88⤵PID:3120
-
\??\c:\hhhhhh.exec:\hhhhhh.exe89⤵PID:2400
-
\??\c:\pvpjv.exec:\pvpjv.exe90⤵PID:3104
-
\??\c:\jdvpd.exec:\jdvpd.exe91⤵PID:464
-
\??\c:\xfflfff.exec:\xfflfff.exe92⤵PID:4556
-
\??\c:\hhhntb.exec:\hhhntb.exe93⤵PID:2416
-
\??\c:\bnnhbt.exec:\bnnhbt.exe94⤵PID:4140
-
\??\c:\pjpjp.exec:\pjpjp.exe95⤵PID:3636
-
\??\c:\llxxlff.exec:\llxxlff.exe96⤵PID:1800
-
\??\c:\rfffxxr.exec:\rfffxxr.exe97⤵PID:1004
-
\??\c:\tthtnn.exec:\tthtnn.exe98⤵PID:3340
-
\??\c:\bhbtnn.exec:\bhbtnn.exe99⤵PID:1040
-
\??\c:\dvjdd.exec:\dvjdd.exe100⤵PID:3668
-
\??\c:\xxrlffx.exec:\xxrlffx.exe101⤵PID:1900
-
\??\c:\fxrrllf.exec:\fxrrllf.exe102⤵PID:4912
-
\??\c:\hhtttt.exec:\hhtttt.exe103⤵PID:2472
-
\??\c:\9bbthb.exec:\9bbthb.exe104⤵PID:3972
-
\??\c:\vdpjj.exec:\vdpjj.exe105⤵PID:216
-
\??\c:\pjdjv.exec:\pjdjv.exe106⤵PID:5036
-
\??\c:\3lrrfff.exec:\3lrrfff.exe107⤵PID:1904
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe108⤵PID:2964
-
\??\c:\nhhhbb.exec:\nhhhbb.exe109⤵PID:1312
-
\??\c:\hbtnbb.exec:\hbtnbb.exe110⤵PID:3088
-
\??\c:\ddjjj.exec:\ddjjj.exe111⤵PID:4760
-
\??\c:\fxfxrrx.exec:\fxfxrrx.exe112⤵PID:1684
-
\??\c:\5rffxxr.exec:\5rffxxr.exe113⤵PID:1268
-
\??\c:\btbtnn.exec:\btbtnn.exe114⤵PID:3828
-
\??\c:\ntbtnn.exec:\ntbtnn.exe115⤵PID:4216
-
\??\c:\7pvpj.exec:\7pvpj.exe116⤵PID:4876
-
\??\c:\dvjpj.exec:\dvjpj.exe117⤵PID:4972
-
\??\c:\tnnnhb.exec:\tnnnhb.exe118⤵PID:1008
-
\??\c:\9bbbtt.exec:\9bbbtt.exe119⤵PID:3968
-
\??\c:\1dpjd.exec:\1dpjd.exe120⤵PID:3952
-
\??\c:\vvdjd.exec:\vvdjd.exe121⤵PID:2980
-
\??\c:\llrllxr.exec:\llrllxr.exe122⤵PID:3764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-