Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6.exe
-
Size
57KB
-
MD5
01212db9fcaa9528bf4c20eec6ed42f2
-
SHA1
e4845e81173d8145c391d66090358036369c8d16
-
SHA256
d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6
-
SHA512
790fdcae3f4c4c3abf92afbc0c3bd2644635887e284804bada3a3888383383f09343449ddb2fcdee4c23f8f1aeb9f0fde16a0447b51a788fd932effce0a85dc9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFNb:ymb3NkkiQ3mdBjFIvIFNb
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2020-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-69-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/2020-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4136-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5088-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/644-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3692-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4732-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2596-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3132-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1240-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2508-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1144-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2532-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/864-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2908-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3620-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4040-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2896-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3092-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2476-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1712-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4136 hnnnbb.exe 5088 pvdpj.exe 1112 xrrrrxx.exe 644 djvdv.exe 2636 5ddvv.exe 1888 lfrlllf.exe 3692 djddp.exe 3132 9jvvp.exe 4056 3xffxfx.exe 5044 9bbbbh.exe 4732 nhntnt.exe 1336 ppddj.exe 2596 jjvvj.exe 1608 fxxxrrr.exe 2368 nnhhhb.exe 1240 7htttb.exe 2508 ppppp.exe 1144 lrflrrf.exe 2532 hhbttt.exe 5032 pdpvp.exe 864 hbhthb.exe 2908 pvvjv.exe 4604 xrffxxl.exe 3620 7nhbtt.exe 4040 tnnnbn.exe 2896 dvdjd.exe 4288 bnbhnh.exe 4252 bnthhn.exe 3092 xfrflxf.exe 2476 lxrrrlf.exe 1712 3tbttb.exe 2096 1vjdv.exe 3056 rrllfrf.exe 2296 nbhbhb.exe 728 djdvp.exe 4848 5ppvp.exe 3600 ffllfff.exe 4748 bhnhbh.exe 1920 ppvvp.exe 4136 vvpjj.exe 4012 rxxrrll.exe 208 bhbttt.exe 1532 ttbttt.exe 1124 pjvpp.exe 644 vpvvv.exe 5008 flllrxf.exe 2104 flrlrxl.exe 4536 tthnht.exe 4104 ddpvv.exe 4276 vvjpp.exe 3104 rxfxffl.exe 5044 tbnnnn.exe 4540 7htnhn.exe 1336 dvppv.exe 2240 fllfrfx.exe 5096 lfffffl.exe 4624 bbhtbh.exe 2028 hhbttn.exe 1240 jvjdv.exe 2400 fxfffxx.exe 1816 9ffxxxx.exe 3280 lrxfxff.exe 2868 hntbhn.exe 4188 tbtnbb.exe -
resource yara_rule behavioral2/memory/2020-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 4136 2020 d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6.exe 83 PID 2020 wrote to memory of 4136 2020 d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6.exe 83 PID 2020 wrote to memory of 4136 2020 d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6.exe 83 PID 4136 wrote to memory of 5088 4136 hnnnbb.exe 84 PID 4136 wrote to memory of 5088 4136 hnnnbb.exe 84 PID 4136 wrote to memory of 5088 4136 hnnnbb.exe 84 PID 5088 wrote to memory of 1112 5088 pvdpj.exe 85 PID 5088 wrote to memory of 1112 5088 pvdpj.exe 85 PID 5088 wrote to memory of 1112 5088 pvdpj.exe 85 PID 1112 wrote to memory of 644 1112 xrrrrxx.exe 86 PID 1112 wrote to memory of 644 1112 xrrrrxx.exe 86 PID 1112 wrote to memory of 644 1112 xrrrrxx.exe 86 PID 644 wrote to memory of 2636 644 djvdv.exe 87 PID 644 wrote to memory of 2636 644 djvdv.exe 87 PID 644 wrote to memory of 2636 644 djvdv.exe 87 PID 2636 wrote to memory of 1888 2636 5ddvv.exe 88 PID 2636 wrote to memory of 1888 2636 5ddvv.exe 88 PID 2636 wrote to memory of 1888 2636 5ddvv.exe 88 PID 1888 wrote to memory of 3692 1888 lfrlllf.exe 89 PID 1888 wrote to memory of 3692 1888 lfrlllf.exe 89 PID 1888 wrote to memory of 3692 1888 lfrlllf.exe 89 PID 3692 wrote to memory of 3132 3692 djddp.exe 90 PID 3692 wrote to memory of 3132 3692 djddp.exe 90 PID 3692 wrote to memory of 3132 3692 djddp.exe 90 PID 3132 wrote to memory of 4056 3132 9jvvp.exe 91 PID 3132 wrote to memory of 4056 3132 9jvvp.exe 91 PID 3132 wrote to memory of 4056 3132 9jvvp.exe 91 PID 4056 wrote to memory of 5044 4056 3xffxfx.exe 92 PID 4056 wrote to memory of 5044 4056 3xffxfx.exe 92 PID 4056 wrote to memory of 5044 4056 3xffxfx.exe 92 PID 5044 wrote to memory of 4732 5044 9bbbbh.exe 93 PID 5044 wrote to memory of 4732 5044 9bbbbh.exe 93 PID 5044 wrote to memory of 4732 5044 9bbbbh.exe 93 PID 4732 wrote to memory of 1336 4732 nhntnt.exe 94 PID 4732 wrote to memory of 1336 4732 nhntnt.exe 94 PID 4732 wrote to memory of 1336 4732 nhntnt.exe 94 PID 1336 wrote to memory of 2596 1336 ppddj.exe 95 PID 1336 wrote to memory of 2596 1336 ppddj.exe 95 PID 1336 wrote to memory of 2596 1336 ppddj.exe 95 PID 2596 wrote to memory of 1608 2596 jjvvj.exe 96 PID 2596 wrote to memory of 1608 2596 jjvvj.exe 96 PID 2596 wrote to memory of 1608 2596 jjvvj.exe 96 PID 1608 wrote to memory of 2368 1608 fxxxrrr.exe 97 PID 1608 wrote to memory of 2368 1608 fxxxrrr.exe 97 PID 1608 wrote to memory of 2368 1608 fxxxrrr.exe 97 PID 2368 wrote to memory of 1240 2368 nnhhhb.exe 98 PID 2368 wrote to memory of 1240 2368 nnhhhb.exe 98 PID 2368 wrote to memory of 1240 2368 nnhhhb.exe 98 PID 1240 wrote to memory of 2508 1240 7htttb.exe 99 PID 1240 wrote to memory of 2508 1240 7htttb.exe 99 PID 1240 wrote to memory of 2508 1240 7htttb.exe 99 PID 2508 wrote to memory of 1144 2508 ppppp.exe 100 PID 2508 wrote to memory of 1144 2508 ppppp.exe 100 PID 2508 wrote to memory of 1144 2508 ppppp.exe 100 PID 1144 wrote to memory of 2532 1144 lrflrrf.exe 102 PID 1144 wrote to memory of 2532 1144 lrflrrf.exe 102 PID 1144 wrote to memory of 2532 1144 lrflrrf.exe 102 PID 2532 wrote to memory of 5032 2532 hhbttt.exe 103 PID 2532 wrote to memory of 5032 2532 hhbttt.exe 103 PID 2532 wrote to memory of 5032 2532 hhbttt.exe 103 PID 5032 wrote to memory of 864 5032 pdpvp.exe 104 PID 5032 wrote to memory of 864 5032 pdpvp.exe 104 PID 5032 wrote to memory of 864 5032 pdpvp.exe 104 PID 864 wrote to memory of 2908 864 hbhthb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6.exe"C:\Users\Admin\AppData\Local\Temp\d99b6046bdb797ca2c254f498c86643d307bdca61e6a063234d588ff9838c4d6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\hnnnbb.exec:\hnnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\pvdpj.exec:\pvdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\djvdv.exec:\djvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\5ddvv.exec:\5ddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lfrlllf.exec:\lfrlllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\djddp.exec:\djddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\9jvvp.exec:\9jvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\3xffxfx.exec:\3xffxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\9bbbbh.exec:\9bbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\nhntnt.exec:\nhntnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\ppddj.exec:\ppddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\jjvvj.exec:\jjvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nnhhhb.exec:\nnhhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\7htttb.exec:\7htttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\ppppp.exec:\ppppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\lrflrrf.exec:\lrflrrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\hhbttt.exec:\hhbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pdpvp.exec:\pdpvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\hbhthb.exec:\hbhthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\pvvjv.exec:\pvvjv.exe23⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrffxxl.exec:\xrffxxl.exe24⤵
- Executes dropped EXE
PID:4604 -
\??\c:\7nhbtt.exec:\7nhbtt.exe25⤵
- Executes dropped EXE
PID:3620 -
\??\c:\tnnnbn.exec:\tnnnbn.exe26⤵
- Executes dropped EXE
PID:4040 -
\??\c:\dvdjd.exec:\dvdjd.exe27⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bnbhnh.exec:\bnbhnh.exe28⤵
- Executes dropped EXE
PID:4288 -
\??\c:\bnthhn.exec:\bnthhn.exe29⤵
- Executes dropped EXE
PID:4252 -
\??\c:\xfrflxf.exec:\xfrflxf.exe30⤵
- Executes dropped EXE
PID:3092 -
\??\c:\lxrrrlf.exec:\lxrrrlf.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3tbttb.exec:\3tbttb.exe32⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1vjdv.exec:\1vjdv.exe33⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rrllfrf.exec:\rrllfrf.exe34⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nbhbhb.exec:\nbhbhb.exe35⤵
- Executes dropped EXE
PID:2296 -
\??\c:\djdvp.exec:\djdvp.exe36⤵
- Executes dropped EXE
PID:728 -
\??\c:\5ppvp.exec:\5ppvp.exe37⤵
- Executes dropped EXE
PID:4848 -
\??\c:\ffllfff.exec:\ffllfff.exe38⤵
- Executes dropped EXE
PID:3600 -
\??\c:\bhnhbh.exec:\bhnhbh.exe39⤵
- Executes dropped EXE
PID:4748 -
\??\c:\btnnhn.exec:\btnnhn.exe40⤵PID:960
-
\??\c:\ppvvp.exec:\ppvvp.exe41⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vvpjj.exec:\vvpjj.exe42⤵
- Executes dropped EXE
PID:4136 -
\??\c:\rxxrrll.exec:\rxxrrll.exe43⤵
- Executes dropped EXE
PID:4012 -
\??\c:\bhbttt.exec:\bhbttt.exe44⤵
- Executes dropped EXE
PID:208 -
\??\c:\ttbttt.exec:\ttbttt.exe45⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjvpp.exec:\pjvpp.exe46⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vpvvv.exec:\vpvvv.exe47⤵
- Executes dropped EXE
PID:644 -
\??\c:\flllrxf.exec:\flllrxf.exe48⤵
- Executes dropped EXE
PID:5008 -
\??\c:\flrlrxl.exec:\flrlrxl.exe49⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tthnht.exec:\tthnht.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ddpvv.exec:\ddpvv.exe51⤵
- Executes dropped EXE
PID:4104 -
\??\c:\vvjpp.exec:\vvjpp.exe52⤵
- Executes dropped EXE
PID:4276 -
\??\c:\rxfxffl.exec:\rxfxffl.exe53⤵
- Executes dropped EXE
PID:3104 -
\??\c:\tbnnnn.exec:\tbnnnn.exe54⤵
- Executes dropped EXE
PID:5044 -
\??\c:\7htnhn.exec:\7htnhn.exe55⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dvppv.exec:\dvppv.exe56⤵
- Executes dropped EXE
PID:1336 -
\??\c:\fllfrfx.exec:\fllfrfx.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lfffffl.exec:\lfffffl.exe58⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bbhtbh.exec:\bbhtbh.exe59⤵
- Executes dropped EXE
PID:4624 -
\??\c:\hhbttn.exec:\hhbttn.exe60⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jvjdv.exec:\jvjdv.exe61⤵
- Executes dropped EXE
PID:1240 -
\??\c:\fxfffxx.exec:\fxfffxx.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9ffxxxx.exec:\9ffxxxx.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lrxfxff.exec:\lrxfxff.exe64⤵
- Executes dropped EXE
PID:3280 -
\??\c:\hntbhn.exec:\hntbhn.exe65⤵
- Executes dropped EXE
PID:2868 -
\??\c:\tbtnbb.exec:\tbtnbb.exe66⤵
- Executes dropped EXE
PID:4188 -
\??\c:\dvjjj.exec:\dvjjj.exe67⤵PID:464
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe68⤵PID:3236
-
\??\c:\llfrlrx.exec:\llfrlrx.exe69⤵PID:4604
-
\??\c:\bbhhhn.exec:\bbhhhn.exe70⤵PID:2444
-
\??\c:\nnnttb.exec:\nnnttb.exe71⤵PID:3568
-
\??\c:\jdjjd.exec:\jdjjd.exe72⤵PID:5036
-
\??\c:\9vvjd.exec:\9vvjd.exe73⤵PID:3008
-
\??\c:\llxxrxl.exec:\llxxrxl.exe74⤵PID:4244
-
\??\c:\9rxffff.exec:\9rxffff.exe75⤵PID:4252
-
\??\c:\ttnnhn.exec:\ttnnhn.exe76⤵PID:2224
-
\??\c:\tthnbt.exec:\tthnbt.exe77⤵PID:5024
-
\??\c:\ppdjj.exec:\ppdjj.exe78⤵PID:2728
-
\??\c:\1jppv.exec:\1jppv.exe79⤵PID:1832
-
\??\c:\rxffrrl.exec:\rxffrrl.exe80⤵PID:3760
-
\??\c:\9frllll.exec:\9frllll.exe81⤵PID:4948
-
\??\c:\nhnnnn.exec:\nhnnnn.exe82⤵PID:2296
-
\??\c:\nhhttt.exec:\nhhttt.exe83⤵PID:2024
-
\??\c:\vdpdj.exec:\vdpdj.exe84⤵PID:4548
-
\??\c:\frffrfx.exec:\frffrfx.exe85⤵PID:4320
-
\??\c:\tnhhtn.exec:\tnhhtn.exe86⤵PID:1420
-
\??\c:\hhbthn.exec:\hhbthn.exe87⤵PID:2020
-
\??\c:\1vppj.exec:\1vppj.exe88⤵PID:1496
-
\??\c:\9lrrllf.exec:\9lrrllf.exe89⤵PID:1092
-
\??\c:\bhbbbh.exec:\bhbbbh.exe90⤵PID:1016
-
\??\c:\pjjdv.exec:\pjjdv.exe91⤵PID:1380
-
\??\c:\ffxlfll.exec:\ffxlfll.exe92⤵PID:412
-
\??\c:\tnhhbb.exec:\tnhhbb.exe93⤵PID:3484
-
\??\c:\nnbbbb.exec:\nnbbbb.exe94⤵PID:1588
-
\??\c:\vvvvv.exec:\vvvvv.exe95⤵PID:4008
-
\??\c:\xrrlffr.exec:\xrrlffr.exe96⤵PID:3944
-
\??\c:\tbntnt.exec:\tbntnt.exe97⤵PID:3132
-
\??\c:\bbhnbb.exec:\bbhnbb.exe98⤵PID:2744
-
\??\c:\pjdpp.exec:\pjdpp.exe99⤵PID:2740
-
\??\c:\5rxfxxx.exec:\5rxfxxx.exe100⤵PID:4524
-
\??\c:\fxxffff.exec:\fxxffff.exe101⤵PID:3520
-
\??\c:\nnbnhb.exec:\nnbnhb.exe102⤵PID:3288
-
\??\c:\vddvj.exec:\vddvj.exe103⤵PID:2184
-
\??\c:\pjvvv.exec:\pjvvv.exe104⤵PID:4344
-
\??\c:\fxxrlxx.exec:\fxxrlxx.exe105⤵PID:1216
-
\??\c:\fffxfxx.exec:\fffxfxx.exe106⤵PID:1032
-
\??\c:\hbhnth.exec:\hbhnth.exe107⤵PID:400
-
\??\c:\7vvdd.exec:\7vvdd.exe108⤵PID:3240
-
\??\c:\ppddj.exec:\ppddj.exe109⤵PID:4416
-
\??\c:\9dpdv.exec:\9dpdv.exe110⤵PID:4448
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe111⤵PID:4156
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe112⤵PID:1960
-
\??\c:\htnnnt.exec:\htnnnt.exe113⤵PID:1036
-
\??\c:\ntnnnn.exec:\ntnnnn.exe114⤵PID:3588
-
\??\c:\vvjdj.exec:\vvjdj.exe115⤵PID:4740
-
\??\c:\9pddv.exec:\9pddv.exe116⤵PID:2088
-
\??\c:\tttthn.exec:\tttthn.exe117⤵PID:1968
-
\??\c:\hthtnt.exec:\hthtnt.exe118⤵PID:2080
-
\??\c:\ddddj.exec:\ddddj.exe119⤵PID:1788
-
\??\c:\ppdvp.exec:\ppdvp.exe120⤵PID:404
-
\??\c:\lflffxx.exec:\lflffxx.exe121⤵PID:3900
-
\??\c:\bhhhhb.exec:\bhhhhb.exe122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-