Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 00:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10.exe
-
Size
56KB
-
MD5
74a907cb15cd3d113450636803ff5011
-
SHA1
b06d03f8eb620791b69c9a8f2a663fbe602b13f0
-
SHA256
99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10
-
SHA512
449b04a93453fa15721f079029fa3eea71219cdb5839e774f3ab93af660a66a3e617c8f550a05f84ae8121dade39caa98115b42f9b935c2fa81980128f768efb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVn8:ymb3NkkiQ3mdBjF0cr8
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4776-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/4776-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1676-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/700-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3484-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2620-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1540-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1072-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1636-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1060-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2200-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1240-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4616-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3144-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2804-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4436-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4660-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/528-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1652-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5008-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1468-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1676 3xxrlfl.exe 700 nnnhht.exe 3484 xllrxxx.exe 2460 fffflll.exe 4992 bbbthh.exe 3568 pjjdd.exe 848 frrfxxr.exe 4836 bhttnn.exe 3288 ddjjv.exe 2620 xfxxrrx.exe 1540 nbbtnn.exe 1072 pjpdp.exe 1636 djdvp.exe 2572 fxxrlxr.exe 4828 hbhbbb.exe 1060 9ddvp.exe 2200 lfxxllf.exe 1240 3tnnhn.exe 4616 nnnhtt.exe 3144 pvpdp.exe 2804 frxrrll.exe 3688 bhnbhn.exe 4436 5thhtb.exe 4660 vvvpv.exe 528 lfrlffr.exe 3832 nnhhbb.exe 1652 hbttnh.exe 5008 1jddp.exe 1468 lfrlrll.exe 1228 xflfffx.exe 2204 htbbbb.exe 944 jdjjv.exe 4656 xlfrlll.exe 2404 flxffll.exe 1132 httnht.exe 4344 pjjjj.exe 2244 vvjvp.exe 464 flrlxxr.exe 1920 tnhnbb.exe 4416 vpdvv.exe 4820 jdjdd.exe 4764 frlrrxr.exe 1380 5hnnnn.exe 5080 ppddd.exe 2960 pppjp.exe 2548 rrrlffx.exe 3188 9hhhbt.exe 4672 bnhbnh.exe 848 jvjjv.exe 3664 flrrllf.exe 3228 bbbtnh.exe 1980 nntnhh.exe 4796 1vdvv.exe 1956 vvjjv.exe 3216 tnbbnh.exe 4156 ntnbtt.exe 4460 pjvpd.exe 2256 xxfxrrl.exe 4036 1xxrlff.exe 2796 hbhbhb.exe 3816 hnhbtt.exe 2932 vdvvp.exe 2452 rrrlxlr.exe 4100 hntttt.exe -
resource yara_rule behavioral2/memory/4776-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4776 wrote to memory of 1676 4776 99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10.exe 83 PID 4776 wrote to memory of 1676 4776 99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10.exe 83 PID 4776 wrote to memory of 1676 4776 99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10.exe 83 PID 1676 wrote to memory of 700 1676 3xxrlfl.exe 84 PID 1676 wrote to memory of 700 1676 3xxrlfl.exe 84 PID 1676 wrote to memory of 700 1676 3xxrlfl.exe 84 PID 700 wrote to memory of 3484 700 nnnhht.exe 85 PID 700 wrote to memory of 3484 700 nnnhht.exe 85 PID 700 wrote to memory of 3484 700 nnnhht.exe 85 PID 3484 wrote to memory of 2460 3484 xllrxxx.exe 86 PID 3484 wrote to memory of 2460 3484 xllrxxx.exe 86 PID 3484 wrote to memory of 2460 3484 xllrxxx.exe 86 PID 2460 wrote to memory of 4992 2460 fffflll.exe 87 PID 2460 wrote to memory of 4992 2460 fffflll.exe 87 PID 2460 wrote to memory of 4992 2460 fffflll.exe 87 PID 4992 wrote to memory of 3568 4992 bbbthh.exe 88 PID 4992 wrote to memory of 3568 4992 bbbthh.exe 88 PID 4992 wrote to memory of 3568 4992 bbbthh.exe 88 PID 3568 wrote to memory of 848 3568 pjjdd.exe 89 PID 3568 wrote to memory of 848 3568 pjjdd.exe 89 PID 3568 wrote to memory of 848 3568 pjjdd.exe 89 PID 848 wrote to memory of 4836 848 frrfxxr.exe 90 PID 848 wrote to memory of 4836 848 frrfxxr.exe 90 PID 848 wrote to memory of 4836 848 frrfxxr.exe 90 PID 4836 wrote to memory of 3288 4836 bhttnn.exe 91 PID 4836 wrote to memory of 3288 4836 bhttnn.exe 91 PID 4836 wrote to memory of 3288 4836 bhttnn.exe 91 PID 3288 wrote to memory of 2620 3288 ddjjv.exe 92 PID 3288 wrote to memory of 2620 3288 ddjjv.exe 92 PID 3288 wrote to memory of 2620 3288 ddjjv.exe 92 PID 2620 wrote to memory of 1540 2620 xfxxrrx.exe 93 PID 2620 wrote to memory of 1540 2620 xfxxrrx.exe 93 PID 2620 wrote to memory of 1540 2620 xfxxrrx.exe 93 PID 1540 wrote to memory of 1072 1540 nbbtnn.exe 94 PID 1540 wrote to memory of 1072 1540 nbbtnn.exe 94 PID 1540 wrote to memory of 1072 1540 nbbtnn.exe 94 PID 1072 wrote to memory of 1636 1072 pjpdp.exe 95 PID 1072 wrote to memory of 1636 1072 pjpdp.exe 95 PID 1072 wrote to memory of 1636 1072 pjpdp.exe 95 PID 1636 wrote to memory of 2572 1636 djdvp.exe 96 PID 1636 wrote to memory of 2572 1636 djdvp.exe 96 PID 1636 wrote to memory of 2572 1636 djdvp.exe 96 PID 2572 wrote to memory of 4828 2572 fxxrlxr.exe 97 PID 2572 wrote to memory of 4828 2572 fxxrlxr.exe 97 PID 2572 wrote to memory of 4828 2572 fxxrlxr.exe 97 PID 4828 wrote to memory of 1060 4828 hbhbbb.exe 98 PID 4828 wrote to memory of 1060 4828 hbhbbb.exe 98 PID 4828 wrote to memory of 1060 4828 hbhbbb.exe 98 PID 1060 wrote to memory of 2200 1060 9ddvp.exe 99 PID 1060 wrote to memory of 2200 1060 9ddvp.exe 99 PID 1060 wrote to memory of 2200 1060 9ddvp.exe 99 PID 2200 wrote to memory of 1240 2200 lfxxllf.exe 100 PID 2200 wrote to memory of 1240 2200 lfxxllf.exe 100 PID 2200 wrote to memory of 1240 2200 lfxxllf.exe 100 PID 1240 wrote to memory of 4616 1240 3tnnhn.exe 101 PID 1240 wrote to memory of 4616 1240 3tnnhn.exe 101 PID 1240 wrote to memory of 4616 1240 3tnnhn.exe 101 PID 4616 wrote to memory of 3144 4616 nnnhtt.exe 102 PID 4616 wrote to memory of 3144 4616 nnnhtt.exe 102 PID 4616 wrote to memory of 3144 4616 nnnhtt.exe 102 PID 3144 wrote to memory of 2804 3144 pvpdp.exe 103 PID 3144 wrote to memory of 2804 3144 pvpdp.exe 103 PID 3144 wrote to memory of 2804 3144 pvpdp.exe 103 PID 2804 wrote to memory of 3688 2804 frxrrll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10.exe"C:\Users\Admin\AppData\Local\Temp\99fb0fbb49f0f2fa1f665cb59992d1be8adfaae7a71238f59bdebb3ddbb78d10.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\3xxrlfl.exec:\3xxrlfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\nnnhht.exec:\nnnhht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\xllrxxx.exec:\xllrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\fffflll.exec:\fffflll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\bbbthh.exec:\bbbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\pjjdd.exec:\pjjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\frrfxxr.exec:\frrfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\bhttnn.exec:\bhttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\ddjjv.exec:\ddjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\xfxxrrx.exec:\xfxxrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nbbtnn.exec:\nbbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\pjpdp.exec:\pjpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\djdvp.exec:\djdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\fxxrlxr.exec:\fxxrlxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hbhbbb.exec:\hbhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\9ddvp.exec:\9ddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\lfxxllf.exec:\lfxxllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\3tnnhn.exec:\3tnnhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\nnnhtt.exec:\nnnhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\pvpdp.exec:\pvpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\frxrrll.exec:\frxrrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bhnbhn.exec:\bhnbhn.exe23⤵
- Executes dropped EXE
PID:3688 -
\??\c:\5thhtb.exec:\5thhtb.exe24⤵
- Executes dropped EXE
PID:4436 -
\??\c:\vvvpv.exec:\vvvpv.exe25⤵
- Executes dropped EXE
PID:4660 -
\??\c:\lfrlffr.exec:\lfrlffr.exe26⤵
- Executes dropped EXE
PID:528 -
\??\c:\nnhhbb.exec:\nnhhbb.exe27⤵
- Executes dropped EXE
PID:3832 -
\??\c:\hbttnh.exec:\hbttnh.exe28⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1jddp.exec:\1jddp.exe29⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lfrlrll.exec:\lfrlrll.exe30⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xflfffx.exec:\xflfffx.exe31⤵
- Executes dropped EXE
PID:1228 -
\??\c:\htbbbb.exec:\htbbbb.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jdjjv.exec:\jdjjv.exe33⤵
- Executes dropped EXE
PID:944 -
\??\c:\xlfrlll.exec:\xlfrlll.exe34⤵
- Executes dropped EXE
PID:4656 -
\??\c:\flxffll.exec:\flxffll.exe35⤵
- Executes dropped EXE
PID:2404 -
\??\c:\httnht.exec:\httnht.exe36⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pjjjj.exec:\pjjjj.exe37⤵
- Executes dropped EXE
PID:4344 -
\??\c:\vvjvp.exec:\vvjvp.exe38⤵
- Executes dropped EXE
PID:2244 -
\??\c:\flrlxxr.exec:\flrlxxr.exe39⤵
- Executes dropped EXE
PID:464 -
\??\c:\tnhnbb.exec:\tnhnbb.exe40⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vpdvv.exec:\vpdvv.exe41⤵
- Executes dropped EXE
PID:4416 -
\??\c:\jdjdd.exec:\jdjdd.exe42⤵
- Executes dropped EXE
PID:4820 -
\??\c:\frlrrxr.exec:\frlrrxr.exe43⤵
- Executes dropped EXE
PID:4764 -
\??\c:\5hnnnn.exec:\5hnnnn.exe44⤵
- Executes dropped EXE
PID:1380 -
\??\c:\ppddd.exec:\ppddd.exe45⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pppjp.exec:\pppjp.exe46⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rrrlffx.exec:\rrrlffx.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\9hhhbt.exec:\9hhhbt.exe48⤵
- Executes dropped EXE
PID:3188 -
\??\c:\bnhbnh.exec:\bnhbnh.exe49⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jvjjv.exec:\jvjjv.exe50⤵
- Executes dropped EXE
PID:848 -
\??\c:\flrrllf.exec:\flrrllf.exe51⤵
- Executes dropped EXE
PID:3664 -
\??\c:\bbbtnh.exec:\bbbtnh.exe52⤵
- Executes dropped EXE
PID:3228 -
\??\c:\nntnhh.exec:\nntnhh.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1vdvv.exec:\1vdvv.exe54⤵
- Executes dropped EXE
PID:4796 -
\??\c:\vvjjv.exec:\vvjjv.exe55⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tnbbnh.exec:\tnbbnh.exe56⤵
- Executes dropped EXE
PID:3216 -
\??\c:\ntnbtt.exec:\ntnbtt.exe57⤵
- Executes dropped EXE
PID:4156 -
\??\c:\pjvpd.exec:\pjvpd.exe58⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1xxrlff.exec:\1xxrlff.exe60⤵
- Executes dropped EXE
PID:4036 -
\??\c:\hbhbhb.exec:\hbhbhb.exe61⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hnhbtt.exec:\hnhbtt.exe62⤵
- Executes dropped EXE
PID:3816 -
\??\c:\vdvvp.exec:\vdvvp.exe63⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rrrlxlr.exec:\rrrlxlr.exe64⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hntttt.exec:\hntttt.exe65⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nnnhhb.exec:\nnnhhb.exe66⤵PID:1960
-
\??\c:\ppvpp.exec:\ppvpp.exe67⤵PID:432
-
\??\c:\vvjjj.exec:\vvjjj.exe68⤵PID:2392
-
\??\c:\rlrlfff.exec:\rlrlfff.exe69⤵PID:3028
-
\??\c:\7fffrxr.exec:\7fffrxr.exe70⤵PID:4600
-
\??\c:\tnnnbb.exec:\tnnnbb.exe71⤵PID:4308
-
\??\c:\bhbthh.exec:\bhbthh.exe72⤵PID:3528
-
\??\c:\3pppj.exec:\3pppj.exe73⤵PID:3676
-
\??\c:\xllllll.exec:\xllllll.exe74⤵PID:4568
-
\??\c:\nnbhtt.exec:\nnbhtt.exe75⤵PID:1968
-
\??\c:\bhhbtt.exec:\bhhbtt.exe76⤵PID:4844
-
\??\c:\pvpjd.exec:\pvpjd.exe77⤵PID:4412
-
\??\c:\vjdpp.exec:\vjdpp.exe78⤵PID:4876
-
\??\c:\xxxxfff.exec:\xxxxfff.exe79⤵PID:3444
-
\??\c:\hthnbn.exec:\hthnbn.exe80⤵PID:2444
-
\??\c:\nhnnbh.exec:\nhnnbh.exe81⤵PID:3424
-
\??\c:\vvjvp.exec:\vvjvp.exe82⤵PID:2836
-
\??\c:\9xllfff.exec:\9xllfff.exe83⤵PID:2276
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe84⤵PID:2188
-
\??\c:\nhnnnn.exec:\nhnnnn.exe85⤵PID:644
-
\??\c:\vjpvv.exec:\vjpvv.exe86⤵PID:464
-
\??\c:\llrrfff.exec:\llrrfff.exe87⤵PID:4512
-
\??\c:\xxrrrrx.exec:\xxrrrrx.exe88⤵PID:656
-
\??\c:\nnttnt.exec:\nnttnt.exe89⤵PID:1676
-
\??\c:\tntnbb.exec:\tntnbb.exe90⤵PID:1580
-
\??\c:\dddvd.exec:\dddvd.exe91⤵PID:3572
-
\??\c:\3jvpv.exec:\3jvpv.exe92⤵PID:1096
-
\??\c:\3rxrlrl.exec:\3rxrlrl.exe93⤵PID:452
-
\??\c:\rfllrxx.exec:\rfllrxx.exe94⤵PID:2100
-
\??\c:\bbnhtt.exec:\bbnhtt.exe95⤵PID:2380
-
\??\c:\pjjdp.exec:\pjjdp.exe96⤵PID:764
-
\??\c:\vppjv.exec:\vppjv.exe97⤵PID:1688
-
\??\c:\7lrllrx.exec:\7lrllrx.exe98⤵PID:5000
-
\??\c:\5xrrlrr.exec:\5xrrlrr.exe99⤵PID:3064
-
\??\c:\nttnnn.exec:\nttnnn.exe100⤵PID:3656
-
\??\c:\tbbbbb.exec:\tbbbbb.exe101⤵PID:3848
-
\??\c:\ddddd.exec:\ddddd.exe102⤵PID:1956
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe103⤵PID:1592
-
\??\c:\tbnttt.exec:\tbnttt.exe104⤵PID:4156
-
\??\c:\hbnttb.exec:\hbnttb.exe105⤵PID:1900
-
\??\c:\pdjdd.exec:\pdjdd.exe106⤵PID:2200
-
\??\c:\jpvvp.exec:\jpvvp.exe107⤵PID:1492
-
\??\c:\3xrrlrl.exec:\3xrrlrl.exe108⤵PID:2796
-
\??\c:\flxxffr.exec:\flxxffr.exe109⤵PID:2072
-
\??\c:\btttnn.exec:\btttnn.exe110⤵PID:2932
-
\??\c:\nhnnnt.exec:\nhnnnt.exe111⤵PID:2972
-
\??\c:\pppjj.exec:\pppjj.exe112⤵PID:4100
-
\??\c:\pjpvp.exec:\pjpvp.exe113⤵PID:4548
-
\??\c:\llxrllr.exec:\llxrllr.exe114⤵PID:432
-
\??\c:\3rxlfff.exec:\3rxlfff.exe115⤵PID:2392
-
\??\c:\bbttnn.exec:\bbttnn.exe116⤵PID:4924
-
\??\c:\nntnhn.exec:\nntnhn.exe117⤵PID:2920
-
\??\c:\7jjdv.exec:\7jjdv.exe118⤵PID:4236
-
\??\c:\djpdv.exec:\djpdv.exe119⤵PID:3528
-
\??\c:\flrrrxr.exec:\flrrrxr.exe120⤵PID:3676
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe121⤵PID:4552
-
\??\c:\nhbtht.exec:\nhbtht.exe122⤵PID:1468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-