Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4.exe
-
Size
88KB
-
MD5
34d98139b962358120d16021585c89ee
-
SHA1
b7a46376673134d2bc84cf60157801ca118f29ea
-
SHA256
3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4
-
SHA512
bd4f086ac26efa597d39f125432947f6a9b7ca2c6ecedd5e7cf68b064a6b804aba11d24a339ba4b06efc75d99915a9870e3de92c5baa4a538c3992411385300c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wV3jaCJ5jH3e79:ymb3NkkiQ3mdBjF+3TU2K3bJZXy
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1256-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral2/memory/1256-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2988-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3972-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4732-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3492-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1400-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/960-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3116-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4236-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1460-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/512-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2240-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1064-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2704-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3172-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1384-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4340-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3664-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2244-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4232-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4028-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2988 pddpj.exe 3972 5xfxrrl.exe 3492 xfrlfxr.exe 4732 3pddv.exe 1400 3pvpp.exe 960 rxrlxxr.exe 2864 hhnnhh.exe 4608 vppjv.exe 3116 7rxxxxx.exe 4236 btbthb.exe 1460 1pvjd.exe 512 pdjjp.exe 5036 lxfrlfx.exe 2240 nnnnhh.exe 1528 ppvvp.exe 1064 7lrfxxr.exe 2704 frxfxxr.exe 3172 nhbnhh.exe 4000 bnhnnn.exe 4700 pjvpd.exe 1356 5rfffll.exe 1384 frrfxrl.exe 844 bthbtn.exe 4340 vjppp.exe 1608 fxffxrf.exe 3380 ttttbh.exe 3664 9nnnnh.exe 4120 dpjdv.exe 2244 jdvpj.exe 4232 xllfxrl.exe 4028 7hhhbb.exe 680 pjjdv.exe 3776 1pjdp.exe 3732 1lrlrrf.exe 2692 ffrlfff.exe 364 btbbbb.exe 3976 nthhtt.exe 4476 1pdvp.exe 536 5fllrrx.exe 4744 ffrxxff.exe 4432 bbtnbb.exe 4444 tthhnt.exe 3008 jjvjj.exe 1032 vjdvj.exe 4332 rrrlfll.exe 4748 rllrfxl.exe 1848 btbbtt.exe 4484 bthtth.exe 2892 dvvvd.exe 1140 rrlfrrl.exe 3448 xrlfrll.exe 3076 7bhtnh.exe 2316 pjjdv.exe 3080 rffrrlf.exe 1460 lrlfrrl.exe 2680 ttbbth.exe 2804 5htthh.exe 1016 1vddj.exe 3108 jdppd.exe 4168 9flfxxr.exe 948 bhtttb.exe 4568 bhtnhh.exe 4252 dvjpp.exe 1556 xxfxrrr.exe -
resource yara_rule behavioral2/memory/1256-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1256 wrote to memory of 2988 1256 3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4.exe 82 PID 1256 wrote to memory of 2988 1256 3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4.exe 82 PID 1256 wrote to memory of 2988 1256 3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4.exe 82 PID 2988 wrote to memory of 3972 2988 pddpj.exe 83 PID 2988 wrote to memory of 3972 2988 pddpj.exe 83 PID 2988 wrote to memory of 3972 2988 pddpj.exe 83 PID 3972 wrote to memory of 3492 3972 5xfxrrl.exe 84 PID 3972 wrote to memory of 3492 3972 5xfxrrl.exe 84 PID 3972 wrote to memory of 3492 3972 5xfxrrl.exe 84 PID 3492 wrote to memory of 4732 3492 xfrlfxr.exe 85 PID 3492 wrote to memory of 4732 3492 xfrlfxr.exe 85 PID 3492 wrote to memory of 4732 3492 xfrlfxr.exe 85 PID 4732 wrote to memory of 1400 4732 3pddv.exe 86 PID 4732 wrote to memory of 1400 4732 3pddv.exe 86 PID 4732 wrote to memory of 1400 4732 3pddv.exe 86 PID 1400 wrote to memory of 960 1400 3pvpp.exe 87 PID 1400 wrote to memory of 960 1400 3pvpp.exe 87 PID 1400 wrote to memory of 960 1400 3pvpp.exe 87 PID 960 wrote to memory of 2864 960 rxrlxxr.exe 88 PID 960 wrote to memory of 2864 960 rxrlxxr.exe 88 PID 960 wrote to memory of 2864 960 rxrlxxr.exe 88 PID 2864 wrote to memory of 4608 2864 hhnnhh.exe 89 PID 2864 wrote to memory of 4608 2864 hhnnhh.exe 89 PID 2864 wrote to memory of 4608 2864 hhnnhh.exe 89 PID 4608 wrote to memory of 3116 4608 vppjv.exe 90 PID 4608 wrote to memory of 3116 4608 vppjv.exe 90 PID 4608 wrote to memory of 3116 4608 vppjv.exe 90 PID 3116 wrote to memory of 4236 3116 7rxxxxx.exe 91 PID 3116 wrote to memory of 4236 3116 7rxxxxx.exe 91 PID 3116 wrote to memory of 4236 3116 7rxxxxx.exe 91 PID 4236 wrote to memory of 1460 4236 btbthb.exe 92 PID 4236 wrote to memory of 1460 4236 btbthb.exe 92 PID 4236 wrote to memory of 1460 4236 btbthb.exe 92 PID 1460 wrote to memory of 512 1460 1pvjd.exe 93 PID 1460 wrote to memory of 512 1460 1pvjd.exe 93 PID 1460 wrote to memory of 512 1460 1pvjd.exe 93 PID 512 wrote to memory of 5036 512 pdjjp.exe 94 PID 512 wrote to memory of 5036 512 pdjjp.exe 94 PID 512 wrote to memory of 5036 512 pdjjp.exe 94 PID 5036 wrote to memory of 2240 5036 lxfrlfx.exe 95 PID 5036 wrote to memory of 2240 5036 lxfrlfx.exe 95 PID 5036 wrote to memory of 2240 5036 lxfrlfx.exe 95 PID 2240 wrote to memory of 1528 2240 nnnnhh.exe 96 PID 2240 wrote to memory of 1528 2240 nnnnhh.exe 96 PID 2240 wrote to memory of 1528 2240 nnnnhh.exe 96 PID 1528 wrote to memory of 1064 1528 ppvvp.exe 97 PID 1528 wrote to memory of 1064 1528 ppvvp.exe 97 PID 1528 wrote to memory of 1064 1528 ppvvp.exe 97 PID 1064 wrote to memory of 2704 1064 7lrfxxr.exe 98 PID 1064 wrote to memory of 2704 1064 7lrfxxr.exe 98 PID 1064 wrote to memory of 2704 1064 7lrfxxr.exe 98 PID 2704 wrote to memory of 3172 2704 frxfxxr.exe 99 PID 2704 wrote to memory of 3172 2704 frxfxxr.exe 99 PID 2704 wrote to memory of 3172 2704 frxfxxr.exe 99 PID 3172 wrote to memory of 4000 3172 nhbnhh.exe 100 PID 3172 wrote to memory of 4000 3172 nhbnhh.exe 100 PID 3172 wrote to memory of 4000 3172 nhbnhh.exe 100 PID 4000 wrote to memory of 4700 4000 bnhnnn.exe 101 PID 4000 wrote to memory of 4700 4000 bnhnnn.exe 101 PID 4000 wrote to memory of 4700 4000 bnhnnn.exe 101 PID 4700 wrote to memory of 1356 4700 pjvpd.exe 102 PID 4700 wrote to memory of 1356 4700 pjvpd.exe 102 PID 4700 wrote to memory of 1356 4700 pjvpd.exe 102 PID 1356 wrote to memory of 1384 1356 5rfffll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4.exe"C:\Users\Admin\AppData\Local\Temp\3bd260d941d668fb8f2b1bb6445caec8b3ad5054fe615c1751b1dbe8e66f85e4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pddpj.exec:\pddpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\3pddv.exec:\3pddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\3pvpp.exec:\3pvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\rxrlxxr.exec:\rxrlxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\hhnnhh.exec:\hhnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vppjv.exec:\vppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\7rxxxxx.exec:\7rxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\btbthb.exec:\btbthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\1pvjd.exec:\1pvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\pdjjp.exec:\pdjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\lxfrlfx.exec:\lxfrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\nnnnhh.exec:\nnnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\ppvvp.exec:\ppvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\7lrfxxr.exec:\7lrfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\frxfxxr.exec:\frxfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhbnhh.exec:\nhbnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\bnhnnn.exec:\bnhnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\pjvpd.exec:\pjvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\5rfffll.exec:\5rfffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\frrfxrl.exec:\frrfxrl.exe23⤵
- Executes dropped EXE
PID:1384 -
\??\c:\bthbtn.exec:\bthbtn.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\vjppp.exec:\vjppp.exe25⤵
- Executes dropped EXE
PID:4340 -
\??\c:\fxffxrf.exec:\fxffxrf.exe26⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ttttbh.exec:\ttttbh.exe27⤵
- Executes dropped EXE
PID:3380 -
\??\c:\9nnnnh.exec:\9nnnnh.exe28⤵
- Executes dropped EXE
PID:3664 -
\??\c:\dpjdv.exec:\dpjdv.exe29⤵
- Executes dropped EXE
PID:4120 -
\??\c:\jdvpj.exec:\jdvpj.exe30⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xllfxrl.exec:\xllfxrl.exe31⤵
- Executes dropped EXE
PID:4232 -
\??\c:\7hhhbb.exec:\7hhhbb.exe32⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pjjdv.exec:\pjjdv.exe33⤵
- Executes dropped EXE
PID:680 -
\??\c:\1pjdp.exec:\1pjdp.exe34⤵
- Executes dropped EXE
PID:3776 -
\??\c:\1lrlrrf.exec:\1lrlrrf.exe35⤵
- Executes dropped EXE
PID:3732 -
\??\c:\ffrlfff.exec:\ffrlfff.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\btbbbb.exec:\btbbbb.exe37⤵
- Executes dropped EXE
PID:364 -
\??\c:\nthhtt.exec:\nthhtt.exe38⤵
- Executes dropped EXE
PID:3976 -
\??\c:\1pdvp.exec:\1pdvp.exe39⤵
- Executes dropped EXE
PID:4476 -
\??\c:\5fllrrx.exec:\5fllrrx.exe40⤵
- Executes dropped EXE
PID:536 -
\??\c:\ffrxxff.exec:\ffrxxff.exe41⤵
- Executes dropped EXE
PID:4744 -
\??\c:\bbtnbb.exec:\bbtnbb.exe42⤵
- Executes dropped EXE
PID:4432 -
\??\c:\tthhnt.exec:\tthhnt.exe43⤵
- Executes dropped EXE
PID:4444 -
\??\c:\jjvjj.exec:\jjvjj.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vjdvj.exec:\vjdvj.exe45⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rrrlfll.exec:\rrrlfll.exe46⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rllrfxl.exec:\rllrfxl.exe47⤵
- Executes dropped EXE
PID:4748 -
\??\c:\btbbtt.exec:\btbbtt.exe48⤵
- Executes dropped EXE
PID:1848 -
\??\c:\bthtth.exec:\bthtth.exe49⤵
- Executes dropped EXE
PID:4484 -
\??\c:\dvvvd.exec:\dvvvd.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe51⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xrlfrll.exec:\xrlfrll.exe52⤵
- Executes dropped EXE
PID:3448 -
\??\c:\7bhtnh.exec:\7bhtnh.exe53⤵
- Executes dropped EXE
PID:3076 -
\??\c:\pjjdv.exec:\pjjdv.exe54⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rffrrlf.exec:\rffrrlf.exe55⤵
- Executes dropped EXE
PID:3080 -
\??\c:\lrlfrrl.exec:\lrlfrrl.exe56⤵
- Executes dropped EXE
PID:1460 -
\??\c:\ttbbth.exec:\ttbbth.exe57⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5htthh.exec:\5htthh.exe58⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1vddj.exec:\1vddj.exe59⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jdppd.exec:\jdppd.exe60⤵
- Executes dropped EXE
PID:3108 -
\??\c:\9flfxxr.exec:\9flfxxr.exe61⤵
- Executes dropped EXE
PID:4168 -
\??\c:\bhtttb.exec:\bhtttb.exe62⤵
- Executes dropped EXE
PID:948 -
\??\c:\bhtnhh.exec:\bhtnhh.exe63⤵
- Executes dropped EXE
PID:4568 -
\??\c:\dvjpp.exec:\dvjpp.exe64⤵
- Executes dropped EXE
PID:4252 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xrrxrrl.exec:\xrrxrrl.exe66⤵PID:1280
-
\??\c:\nbbnnn.exec:\nbbnnn.exe67⤵PID:804
-
\??\c:\vvvdv.exec:\vvvdv.exe68⤵PID:4296
-
\??\c:\vvdvj.exec:\vvdvj.exe69⤵PID:4056
-
\??\c:\1vvpd.exec:\1vvpd.exe70⤵PID:4160
-
\??\c:\xlrllfx.exec:\xlrllfx.exe71⤵PID:2304
-
\??\c:\xlllxff.exec:\xlllxff.exe72⤵PID:444
-
\??\c:\nhhbtn.exec:\nhhbtn.exe73⤵PID:3088
-
\??\c:\ddjjd.exec:\ddjjd.exe74⤵PID:3408
-
\??\c:\jpppj.exec:\jpppj.exe75⤵PID:4848
-
\??\c:\ppdvj.exec:\ppdvj.exe76⤵PID:2032
-
\??\c:\xlxlfff.exec:\xlxlfff.exe77⤵PID:5032
-
\??\c:\xxlxllr.exec:\xxlxllr.exe78⤵PID:1548
-
\??\c:\9nnnhh.exec:\9nnnhh.exe79⤵PID:728
-
\??\c:\jdddp.exec:\jdddp.exe80⤵PID:376
-
\??\c:\jjjdv.exec:\jjjdv.exe81⤵PID:4224
-
\??\c:\lxfxllr.exec:\lxfxllr.exe82⤵PID:3616
-
\??\c:\httttn.exec:\httttn.exe83⤵PID:3732
-
\??\c:\nbbtnt.exec:\nbbtnt.exe84⤵PID:3176
-
\??\c:\ddvpv.exec:\ddvpv.exe85⤵PID:4944
-
\??\c:\3pvpp.exec:\3pvpp.exe86⤵PID:2552
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe87⤵PID:3212
-
\??\c:\nbbnhn.exec:\nbbnhn.exe88⤵PID:1084
-
\??\c:\jdpjd.exec:\jdpjd.exe89⤵PID:3316
-
\??\c:\rlrllfr.exec:\rlrllfr.exe90⤵PID:3456
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe91⤵PID:1200
-
\??\c:\nttnhh.exec:\nttnhh.exe92⤵PID:4600
-
\??\c:\7vvpj.exec:\7vvpj.exe93⤵PID:760
-
\??\c:\ffrlrrr.exec:\ffrlrrr.exe94⤵PID:4708
-
\??\c:\xfllffr.exec:\xfllffr.exe95⤵PID:3144
-
\??\c:\tnnhbb.exec:\tnnhbb.exe96⤵PID:4576
-
\??\c:\bnbbtt.exec:\bnbbtt.exe97⤵PID:2932
-
\??\c:\pvvvp.exec:\pvvvp.exe98⤵PID:4008
-
\??\c:\pjpjd.exec:\pjpjd.exe99⤵PID:1676
-
\??\c:\xxxrllf.exec:\xxxrllf.exe100⤵PID:1396
-
\??\c:\fxllfff.exec:\fxllfff.exe101⤵PID:2764
-
\??\c:\tnttbt.exec:\tnttbt.exe102⤵PID:3948
-
\??\c:\jdjjv.exec:\jdjjv.exe103⤵PID:4652
-
\??\c:\pjdpp.exec:\pjdpp.exe104⤵PID:932
-
\??\c:\xrlxllf.exec:\xrlxllf.exe105⤵PID:1104
-
\??\c:\3xxrlll.exec:\3xxrlll.exe106⤵PID:4396
-
\??\c:\5btnhb.exec:\5btnhb.exe107⤵PID:2748
-
\??\c:\5thnnn.exec:\5thnnn.exe108⤵PID:2704
-
\??\c:\3jdvv.exec:\3jdvv.exe109⤵PID:756
-
\??\c:\9vvjd.exec:\9vvjd.exe110⤵PID:4132
-
\??\c:\lrffxxl.exec:\lrffxxl.exe111⤵PID:1424
-
\??\c:\xlxrxxl.exec:\xlxrxxl.exe112⤵PID:860
-
\??\c:\5hhbhh.exec:\5hhbhh.exe113⤵PID:1096
-
\??\c:\hbbtbt.exec:\hbbtbt.exe114⤵PID:848
-
\??\c:\3dpdd.exec:\3dpdd.exe115⤵PID:3828
-
\??\c:\3vdvp.exec:\3vdvp.exe116⤵PID:1132
-
\??\c:\fxxxfxr.exec:\fxxxfxr.exe117⤵PID:4832
-
\??\c:\bhtttt.exec:\bhtttt.exe118⤵PID:4340
-
\??\c:\btnnhh.exec:\btnnhh.exe119⤵PID:2652
-
\??\c:\7jvjj.exec:\7jvjj.exe120⤵PID:2560
-
\??\c:\jpppj.exec:\jpppj.exe121⤵PID:3664
-
\??\c:\1llxrll.exec:\1llxrll.exe122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-