Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
- Target 76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097.exe
- Size 307KB
- Sample240606-bdgn7sdc4w
- SHA256 76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097
- MD5 28342102048a3bd1c26d98a42da93307
- SHA1 f08b28d7b59d15f4f61255806fe44f158e63b833
- SHA512 9fedde58b17c92d5ce8b948643ce788f1bfb20454b3a37197cf2000b4f306a5507943d62428cc7be8e6bcb85dc40a7e91cc9151370b225e5a94171b25126b985
- SSDEEP 3072:ymb3NkkiQ3mdBjFo7LAIRUohDLS0k+sLiiBVS0ILlMcGGW7sRCl9eMMG:n3C9BRo/AIuunS3+sOiBVSXxMxTsm9eq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4480-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-48-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/4480-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2040-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1964-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3740-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/8-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3608-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2576-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3368-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4916-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4916-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4916-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3656-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4704-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4748-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/636-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3216-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3004-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3696-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2772-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4408-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3720-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1932-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1668-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3756-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4824-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1504-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3304-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2040 pdjjj.exe 3740 nthbbb.exe 1964 1nbbhn.exe 2576 jdjdd.exe 3608 rxllxxf.exe 8 rlxrllf.exe 3368 bnhttt.exe 4916 pvjjj.exe 3656 jjjjj.exe 4016 llfflll.exe 4704 tbhtnh.exe 4356 vddpd.exe 4748 rrrlfff.exe 636 dpvvp.exe 3216 vppjd.exe 3004 rlxrrlf.exe 3696 jjddd.exe 2772 lrfffff.exe 4408 btbttt.exe 3720 vvjpj.exe 3036 rflxrrr.exe 1932 httnbn.exe 3460 vvvvd.exe 3592 flrrlrr.exe 1668 btttnn.exe 3756 pppvv.exe 4824 rrxrlxx.exe 3408 bhbthn.exe 1504 vdvpd.exe 4684 5fflffr.exe 3304 3bnhhb.exe 3008 hhtntt.exe 2320 lllflll.exe 2692 ttttnb.exe 3392 jjpjd.exe 2448 9pvpj.exe 4908 tthhbt.exe 4788 3bhhbb.exe 5076 ddpjd.exe 4388 rrrrxxr.exe 1988 nhnnnn.exe 3740 1djjj.exe 2012 dddvv.exe 4428 xxflfxx.exe 4948 hnbthh.exe 3920 djdvd.exe 4544 vvjjd.exe 724 3xrlfff.exe 3136 bbnnbb.exe 2852 bttnht.exe 3352 pvvpv.exe 3432 jjvpp.exe 2660 ffrfxlf.exe 3040 9nttnn.exe 1280 tnhhbh.exe 2816 9vdvp.exe 1436 ffxrffr.exe 1008 rrrrxxl.exe 4768 bhnnnn.exe 2876 pdddv.exe 4564 pjppp.exe 5112 9fxrlrl.exe 3188 tthhtt.exe 4212 vpdvp.exe -
resource yara_rule behavioral2/memory/4480-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2040 4480 76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097.exe 81 PID 4480 wrote to memory of 2040 4480 76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097.exe 81 PID 4480 wrote to memory of 2040 4480 76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097.exe 81 PID 2040 wrote to memory of 3740 2040 pdjjj.exe 82 PID 2040 wrote to memory of 3740 2040 pdjjj.exe 82 PID 2040 wrote to memory of 3740 2040 pdjjj.exe 82 PID 3740 wrote to memory of 1964 3740 nthbbb.exe 83 PID 3740 wrote to memory of 1964 3740 nthbbb.exe 83 PID 3740 wrote to memory of 1964 3740 nthbbb.exe 83 PID 1964 wrote to memory of 2576 1964 1nbbhn.exe 84 PID 1964 wrote to memory of 2576 1964 1nbbhn.exe 84 PID 1964 wrote to memory of 2576 1964 1nbbhn.exe 84 PID 2576 wrote to memory of 3608 2576 jdjdd.exe 85 PID 2576 wrote to memory of 3608 2576 jdjdd.exe 85 PID 2576 wrote to memory of 3608 2576 jdjdd.exe 85 PID 3608 wrote to memory of 8 3608 rxllxxf.exe 86 PID 3608 wrote to memory of 8 3608 rxllxxf.exe 86 PID 3608 wrote to memory of 8 3608 rxllxxf.exe 86 PID 8 wrote to memory of 3368 8 rlxrllf.exe 87 PID 8 wrote to memory of 3368 8 rlxrllf.exe 87 PID 8 wrote to memory of 3368 8 rlxrllf.exe 87 PID 3368 wrote to memory of 4916 3368 bnhttt.exe 88 PID 3368 wrote to memory of 4916 3368 bnhttt.exe 88 PID 3368 wrote to memory of 4916 3368 bnhttt.exe 88 PID 4916 wrote to memory of 3656 4916 pvjjj.exe 89 PID 4916 wrote to memory of 3656 4916 pvjjj.exe 89 PID 4916 wrote to memory of 3656 4916 pvjjj.exe 89 PID 3656 wrote to memory of 4016 3656 jjjjj.exe 90 PID 3656 wrote to memory of 4016 3656 jjjjj.exe 90 PID 3656 wrote to memory of 4016 3656 jjjjj.exe 90 PID 4016 wrote to memory of 4704 4016 llfflll.exe 91 PID 4016 wrote to memory of 4704 4016 llfflll.exe 91 PID 4016 wrote to memory of 4704 4016 llfflll.exe 91 PID 4704 wrote to memory of 4356 4704 tbhtnh.exe 92 PID 4704 wrote to memory of 4356 4704 tbhtnh.exe 92 PID 4704 wrote to memory of 4356 4704 tbhtnh.exe 92 PID 4356 wrote to memory of 4748 4356 vddpd.exe 94 PID 4356 wrote to memory of 4748 4356 vddpd.exe 94 PID 4356 wrote to memory of 4748 4356 vddpd.exe 94 PID 4748 wrote to memory of 636 4748 rrrlfff.exe 95 PID 4748 wrote to memory of 636 4748 rrrlfff.exe 95 PID 4748 wrote to memory of 636 4748 rrrlfff.exe 95 PID 636 wrote to memory of 3216 636 dpvvp.exe 96 PID 636 wrote to memory of 3216 636 dpvvp.exe 96 PID 636 wrote to memory of 3216 636 dpvvp.exe 96 PID 3216 wrote to memory of 3004 3216 vppjd.exe 98 PID 3216 wrote to memory of 3004 3216 vppjd.exe 98 PID 3216 wrote to memory of 3004 3216 vppjd.exe 98 PID 3004 wrote to memory of 3696 3004 rlxrrlf.exe 99 PID 3004 wrote to memory of 3696 3004 rlxrrlf.exe 99 PID 3004 wrote to memory of 3696 3004 rlxrrlf.exe 99 PID 3696 wrote to memory of 2772 3696 jjddd.exe 101 PID 3696 wrote to memory of 2772 3696 jjddd.exe 101 PID 3696 wrote to memory of 2772 3696 jjddd.exe 101 PID 2772 wrote to memory of 4408 2772 lrfffff.exe 102 PID 2772 wrote to memory of 4408 2772 lrfffff.exe 102 PID 2772 wrote to memory of 4408 2772 lrfffff.exe 102 PID 4408 wrote to memory of 3720 4408 btbttt.exe 103 PID 4408 wrote to memory of 3720 4408 btbttt.exe 103 PID 4408 wrote to memory of 3720 4408 btbttt.exe 103 PID 3720 wrote to memory of 3036 3720 vvjpj.exe 104 PID 3720 wrote to memory of 3036 3720 vvjpj.exe 104 PID 3720 wrote to memory of 3036 3720 vvjpj.exe 104 PID 3036 wrote to memory of 1932 3036 rflxrrr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097.exe"C:\Users\Admin\AppData\Local\Temp\76bd2f8043e3e7813400927ab9746d989a714b3e7eb3109fa3571b2a7a535097.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\pdjjj.exec:\pdjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nthbbb.exec:\nthbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\1nbbhn.exec:\1nbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\jdjdd.exec:\jdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\rxllxxf.exec:\rxllxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\rlxrllf.exec:\rlxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\bnhttt.exec:\bnhttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\pvjjj.exec:\pvjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\jjjjj.exec:\jjjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\llfflll.exec:\llfflll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\tbhtnh.exec:\tbhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\vddpd.exec:\vddpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\rrrlfff.exec:\rrrlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\dpvvp.exec:\dpvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\vppjd.exec:\vppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\rlxrrlf.exec:\rlxrrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jjddd.exec:\jjddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\lrfffff.exec:\lrfffff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\btbttt.exec:\btbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\vvjpj.exec:\vvjpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\rflxrrr.exec:\rflxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\httnbn.exec:\httnbn.exe23⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vvvvd.exec:\vvvvd.exe24⤵
- Executes dropped EXE
PID:3460 -
\??\c:\flrrlrr.exec:\flrrlrr.exe25⤵
- Executes dropped EXE
PID:3592 -
\??\c:\btttnn.exec:\btttnn.exe26⤵
- Executes dropped EXE
PID:1668 -
\??\c:\pppvv.exec:\pppvv.exe27⤵
- Executes dropped EXE
PID:3756 -
\??\c:\rrxrlxx.exec:\rrxrlxx.exe28⤵
- Executes dropped EXE
PID:4824 -
\??\c:\bhbthn.exec:\bhbthn.exe29⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vdvpd.exec:\vdvpd.exe30⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5fflffr.exec:\5fflffr.exe31⤵
- Executes dropped EXE
PID:4684 -
\??\c:\3bnhhb.exec:\3bnhhb.exe32⤵
- Executes dropped EXE
PID:3304 -
\??\c:\hhtntt.exec:\hhtntt.exe33⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lllflll.exec:\lllflll.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ttttnb.exec:\ttttnb.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjpjd.exec:\jjpjd.exe36⤵
- Executes dropped EXE
PID:3392 -
\??\c:\9pvpj.exec:\9pvpj.exe37⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tthhbt.exec:\tthhbt.exe38⤵
- Executes dropped EXE
PID:4908 -
\??\c:\3bhhbb.exec:\3bhhbb.exe39⤵
- Executes dropped EXE
PID:4788 -
\??\c:\ddpjd.exec:\ddpjd.exe40⤵
- Executes dropped EXE
PID:5076 -
\??\c:\rrrrxxr.exec:\rrrrxxr.exe41⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nhnnnn.exec:\nhnnnn.exe42⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1djjj.exec:\1djjj.exe43⤵
- Executes dropped EXE
PID:3740 -
\??\c:\dddvv.exec:\dddvv.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xxflfxx.exec:\xxflfxx.exe45⤵
- Executes dropped EXE
PID:4428 -
\??\c:\hnbthh.exec:\hnbthh.exe46⤵
- Executes dropped EXE
PID:4948 -
\??\c:\djdvd.exec:\djdvd.exe47⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vvjjd.exec:\vvjjd.exe48⤵
- Executes dropped EXE
PID:4544 -
\??\c:\3xrlfff.exec:\3xrlfff.exe49⤵
- Executes dropped EXE
PID:724 -
\??\c:\bbnnbb.exec:\bbnnbb.exe50⤵
- Executes dropped EXE
PID:3136 -
\??\c:\bttnht.exec:\bttnht.exe51⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pvvpv.exec:\pvvpv.exe52⤵
- Executes dropped EXE
PID:3352 -
\??\c:\jjvpp.exec:\jjvpp.exe53⤵
- Executes dropped EXE
PID:3432 -
\??\c:\ffrfxlf.exec:\ffrfxlf.exe54⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9nttnn.exec:\9nttnn.exe55⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tnhhbh.exec:\tnhhbh.exe56⤵
- Executes dropped EXE
PID:1280 -
\??\c:\9vdvp.exec:\9vdvp.exe57⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ffxrffr.exec:\ffxrffr.exe58⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rrrrxxl.exec:\rrrrxxl.exe59⤵
- Executes dropped EXE
PID:1008 -
\??\c:\bhnnnn.exec:\bhnnnn.exe60⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pdddv.exec:\pdddv.exe61⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjppp.exec:\pjppp.exe62⤵
- Executes dropped EXE
PID:4564 -
\??\c:\9fxrlrl.exec:\9fxrlrl.exe63⤵
- Executes dropped EXE
PID:5112 -
\??\c:\tthhtt.exec:\tthhtt.exe64⤵
- Executes dropped EXE
PID:3188 -
\??\c:\vpdvp.exec:\vpdvp.exe65⤵
- Executes dropped EXE
PID:4212 -
\??\c:\ffxrlxr.exec:\ffxrlxr.exe66⤵PID:2772
-
\??\c:\5rffxfx.exec:\5rffxfx.exe67⤵PID:5116
-
\??\c:\bbtthh.exec:\bbtthh.exe68⤵PID:3848
-
\??\c:\ppjjp.exec:\ppjjp.exe69⤵PID:3012
-
\??\c:\jjvvp.exec:\jjvvp.exe70⤵PID:3036
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe71⤵PID:1932
-
\??\c:\hbbbbb.exec:\hbbbbb.exe72⤵PID:2992
-
\??\c:\jvddd.exec:\jvddd.exe73⤵PID:4100
-
\??\c:\jvjdv.exec:\jvjdv.exe74⤵PID:1644
-
\??\c:\llxrrll.exec:\llxrrll.exe75⤵PID:2556
-
\??\c:\bbhhnt.exec:\bbhhnt.exe76⤵PID:3644
-
\??\c:\5jppj.exec:\5jppj.exe77⤵PID:1820
-
\??\c:\pddvv.exec:\pddvv.exe78⤵PID:1016
-
\??\c:\frfxffl.exec:\frfxffl.exe79⤵PID:4716
-
\??\c:\9bnttb.exec:\9bnttb.exe80⤵PID:4164
-
\??\c:\7thbnn.exec:\7thbnn.exe81⤵PID:3320
-
\??\c:\vvpdp.exec:\vvpdp.exe82⤵PID:2840
-
\??\c:\5llfflr.exec:\5llfflr.exe83⤵PID:4980
-
\??\c:\bbnntb.exec:\bbnntb.exe84⤵PID:1960
-
\??\c:\vpdvd.exec:\vpdvd.exe85⤵PID:3008
-
\??\c:\dvdpj.exec:\dvdpj.exe86⤵PID:4724
-
\??\c:\lfrlffx.exec:\lfrlffx.exe87⤵PID:1796
-
\??\c:\lrrlllf.exec:\lrrlllf.exe88⤵PID:2448
-
\??\c:\tthbnn.exec:\tthbnn.exe89⤵PID:4908
-
\??\c:\vpjpp.exec:\vpjpp.exe90⤵PID:2288
-
\??\c:\9xxrrxx.exec:\9xxrrxx.exe91⤵PID:1168
-
\??\c:\lllffff.exec:\lllffff.exe92⤵PID:4388
-
\??\c:\3tbbbt.exec:\3tbbbt.exe93⤵PID:1988
-
\??\c:\pdjjj.exec:\pdjjj.exe94⤵PID:1828
-
\??\c:\5jjdv.exec:\5jjdv.exe95⤵PID:5048
-
\??\c:\rrxxlll.exec:\rrxxlll.exe96⤵PID:4428
-
\??\c:\tntnnn.exec:\tntnnn.exe97⤵PID:856
-
\??\c:\btbttt.exec:\btbttt.exe98⤵PID:3920
-
\??\c:\ddvpp.exec:\ddvpp.exe99⤵PID:4544
-
\??\c:\lfxrlll.exec:\lfxrlll.exe100⤵PID:1984
-
\??\c:\tnttnn.exec:\tnttnn.exe101⤵PID:4916
-
\??\c:\hbbhhn.exec:\hbbhhn.exe102⤵PID:2852
-
\??\c:\jpvvv.exec:\jpvvv.exe103⤵PID:3736
-
\??\c:\jpvpp.exec:\jpvpp.exe104⤵PID:4016
-
\??\c:\flrxlll.exec:\flrxlll.exe105⤵PID:4704
-
\??\c:\hbtnbb.exec:\hbtnbb.exe106⤵PID:2028
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe107⤵PID:1280
-
\??\c:\htnbth.exec:\htnbth.exe108⤵PID:2816
-
\??\c:\hhbnhb.exec:\hhbnhb.exe109⤵PID:4772
-
\??\c:\pvddd.exec:\pvddd.exe110⤵PID:1008
-
\??\c:\rffxxxr.exec:\rffxxxr.exe111⤵PID:4768
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe112⤵PID:4080
-
\??\c:\btnhhb.exec:\btnhhb.exe113⤵PID:4564
-
\??\c:\3vvpd.exec:\3vvpd.exe114⤵PID:2360
-
\??\c:\vppjp.exec:\vppjp.exe115⤵PID:1052
-
\??\c:\3fxrffx.exec:\3fxrffx.exe116⤵PID:4088
-
\??\c:\btthbt.exec:\btthbt.exe117⤵PID:1712
-
\??\c:\tbhbbt.exec:\tbhbbt.exe118⤵PID:3252
-
\??\c:\7jdpd.exec:\7jdpd.exe119⤵PID:5044
-
\??\c:\rxllxxr.exec:\rxllxxr.exe120⤵PID:3828
-
\??\c:\xxxrffx.exec:\xxxrffx.exe121⤵PID:1108
-
\??\c:\bttnhh.exec:\bttnhh.exe122⤵PID:432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-