Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16.exe
- Size 61KB
- Sample240608-wras2aeb6v
- SHA256 0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16
- MD5 3fecbf381f2f453c93521a5a4a3e2972
- SHA1 75862fe7eaa5e2e67b1715e9c8486c1630080435
- SHA512 0c54619e5d3e6ae2e7ce9950e632c1192c0c048f77b55a30832be2b8f0492272ce4c3cc47bfb4238032b5582f6180c7c681eee1fbb7b8a6ada90da03315c6111
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJLi:ymb3NkkiQ3mdBjFIvAvi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4084-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/4084-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/632-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3616-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3616-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3616-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3616-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1908-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1908-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1908-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1120-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1188-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1188-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1188-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2780-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5048-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3384-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1444-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/528-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/708-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1272-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/548-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/396-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2208-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3988-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3236-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 632 3hhbtt.exe 4196 jdddp.exe 3616 dddvj.exe 1908 bnbhtt.exe 1120 pjjjd.exe 4572 5flflrx.exe 3068 rxlfxrr.exe 1188 7httnn.exe 2780 dpvpj.exe 5108 lxxrrrl.exe 1588 nhbbtb.exe 5048 thtbnn.exe 3384 djjjd.exe 2380 xlfrflf.exe 1444 fxxrllf.exe 3836 httnnn.exe 1056 pvjvd.exe 4576 lfffxxr.exe 528 tttnhh.exe 708 thbnth.exe 1272 dvddp.exe 4880 rflfxxr.exe 548 rfxxrrr.exe 396 bntnbt.exe 3084 jdjdd.exe 2208 rxrlfxr.exe 3204 xrxxllf.exe 2304 ppppp.exe 3988 ppjjd.exe 3236 frrrllf.exe 4752 xlxrxxr.exe 3764 tnnhbb.exe 4840 3tnhtb.exe 3788 dddjj.exe 3880 pddvp.exe 4136 xlrrrxr.exe 1308 rlllxff.exe 5092 hnhbtt.exe 4376 dppjv.exe 1724 jdvvv.exe 632 ddvpj.exe 2228 bbbtbb.exe 2748 nbbhbh.exe 4796 vpjdv.exe 4444 1jjdp.exe 2200 3xflxxx.exe 1744 rlffrfl.exe 1236 hhbbhh.exe 2140 tbbbtt.exe 4240 vvppj.exe 3708 vpjdv.exe 4592 dvvvv.exe 1184 xrxrrrx.exe 3680 lrxffff.exe 3532 nnnbth.exe 3916 hnnnbb.exe 1504 1djpd.exe 3384 jdjpj.exe 4960 fxrlxxx.exe 1444 fflrxrf.exe 2500 tnhbbt.exe 1056 djdpp.exe 4872 7vvvp.exe 1820 rfffrlf.exe -
resource yara_rule behavioral2/memory/4084-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-203-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4084 wrote to memory of 632 4084 0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16.exe 81 PID 4084 wrote to memory of 632 4084 0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16.exe 81 PID 4084 wrote to memory of 632 4084 0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16.exe 81 PID 632 wrote to memory of 4196 632 3hhbtt.exe 82 PID 632 wrote to memory of 4196 632 3hhbtt.exe 82 PID 632 wrote to memory of 4196 632 3hhbtt.exe 82 PID 4196 wrote to memory of 3616 4196 jdddp.exe 83 PID 4196 wrote to memory of 3616 4196 jdddp.exe 83 PID 4196 wrote to memory of 3616 4196 jdddp.exe 83 PID 3616 wrote to memory of 1908 3616 dddvj.exe 84 PID 3616 wrote to memory of 1908 3616 dddvj.exe 84 PID 3616 wrote to memory of 1908 3616 dddvj.exe 84 PID 1908 wrote to memory of 1120 1908 bnbhtt.exe 85 PID 1908 wrote to memory of 1120 1908 bnbhtt.exe 85 PID 1908 wrote to memory of 1120 1908 bnbhtt.exe 85 PID 1120 wrote to memory of 4572 1120 pjjjd.exe 86 PID 1120 wrote to memory of 4572 1120 pjjjd.exe 86 PID 1120 wrote to memory of 4572 1120 pjjjd.exe 86 PID 4572 wrote to memory of 3068 4572 5flflrx.exe 87 PID 4572 wrote to memory of 3068 4572 5flflrx.exe 87 PID 4572 wrote to memory of 3068 4572 5flflrx.exe 87 PID 3068 wrote to memory of 1188 3068 rxlfxrr.exe 88 PID 3068 wrote to memory of 1188 3068 rxlfxrr.exe 88 PID 3068 wrote to memory of 1188 3068 rxlfxrr.exe 88 PID 1188 wrote to memory of 2780 1188 7httnn.exe 89 PID 1188 wrote to memory of 2780 1188 7httnn.exe 89 PID 1188 wrote to memory of 2780 1188 7httnn.exe 89 PID 2780 wrote to memory of 5108 2780 dpvpj.exe 90 PID 2780 wrote to memory of 5108 2780 dpvpj.exe 90 PID 2780 wrote to memory of 5108 2780 dpvpj.exe 90 PID 5108 wrote to memory of 1588 5108 lxxrrrl.exe 91 PID 5108 wrote to memory of 1588 5108 lxxrrrl.exe 91 PID 5108 wrote to memory of 1588 5108 lxxrrrl.exe 91 PID 1588 wrote to memory of 5048 1588 nhbbtb.exe 92 PID 1588 wrote to memory of 5048 1588 nhbbtb.exe 92 PID 1588 wrote to memory of 5048 1588 nhbbtb.exe 92 PID 5048 wrote to memory of 3384 5048 thtbnn.exe 93 PID 5048 wrote to memory of 3384 5048 thtbnn.exe 93 PID 5048 wrote to memory of 3384 5048 thtbnn.exe 93 PID 3384 wrote to memory of 2380 3384 djjjd.exe 94 PID 3384 wrote to memory of 2380 3384 djjjd.exe 94 PID 3384 wrote to memory of 2380 3384 djjjd.exe 94 PID 2380 wrote to memory of 1444 2380 xlfrflf.exe 95 PID 2380 wrote to memory of 1444 2380 xlfrflf.exe 95 PID 2380 wrote to memory of 1444 2380 xlfrflf.exe 95 PID 1444 wrote to memory of 3836 1444 fxxrllf.exe 97 PID 1444 wrote to memory of 3836 1444 fxxrllf.exe 97 PID 1444 wrote to memory of 3836 1444 fxxrllf.exe 97 PID 3836 wrote to memory of 1056 3836 httnnn.exe 98 PID 3836 wrote to memory of 1056 3836 httnnn.exe 98 PID 3836 wrote to memory of 1056 3836 httnnn.exe 98 PID 1056 wrote to memory of 4576 1056 pvjvd.exe 99 PID 1056 wrote to memory of 4576 1056 pvjvd.exe 99 PID 1056 wrote to memory of 4576 1056 pvjvd.exe 99 PID 4576 wrote to memory of 528 4576 lfffxxr.exe 100 PID 4576 wrote to memory of 528 4576 lfffxxr.exe 100 PID 4576 wrote to memory of 528 4576 lfffxxr.exe 100 PID 528 wrote to memory of 708 528 tttnhh.exe 102 PID 528 wrote to memory of 708 528 tttnhh.exe 102 PID 528 wrote to memory of 708 528 tttnhh.exe 102 PID 708 wrote to memory of 1272 708 thbnth.exe 103 PID 708 wrote to memory of 1272 708 thbnth.exe 103 PID 708 wrote to memory of 1272 708 thbnth.exe 103 PID 1272 wrote to memory of 4880 1272 dvddp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16.exe"C:\Users\Admin\AppData\Local\Temp\0091d20d3e96d6f76e38ca8672054fb8e7cb5635a599d7fae49750cb07263e16.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\3hhbtt.exec:\3hhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\jdddp.exec:\jdddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\dddvj.exec:\dddvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\bnbhtt.exec:\bnbhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\pjjjd.exec:\pjjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\5flflrx.exec:\5flflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\rxlfxrr.exec:\rxlfxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7httnn.exec:\7httnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\dpvpj.exec:\dpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\nhbbtb.exec:\nhbbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\thtbnn.exec:\thtbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\djjjd.exec:\djjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\xlfrflf.exec:\xlfrflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\fxxrllf.exec:\fxxrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\httnnn.exec:\httnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\pvjvd.exec:\pvjvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\lfffxxr.exec:\lfffxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\tttnhh.exec:\tttnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\thbnth.exec:\thbnth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\dvddp.exec:\dvddp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\rflfxxr.exec:\rflfxxr.exe23⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe24⤵
- Executes dropped EXE
PID:548 -
\??\c:\bntnbt.exec:\bntnbt.exe25⤵
- Executes dropped EXE
PID:396 -
\??\c:\jdjdd.exec:\jdjdd.exe26⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe27⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrxxllf.exec:\xrxxllf.exe28⤵
- Executes dropped EXE
PID:3204 -
\??\c:\ppppp.exec:\ppppp.exe29⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ppjjd.exec:\ppjjd.exe30⤵
- Executes dropped EXE
PID:3988 -
\??\c:\frrrllf.exec:\frrrllf.exe31⤵
- Executes dropped EXE
PID:3236 -
\??\c:\xlxrxxr.exec:\xlxrxxr.exe32⤵
- Executes dropped EXE
PID:4752 -
\??\c:\tnnhbb.exec:\tnnhbb.exe33⤵
- Executes dropped EXE
PID:3764 -
\??\c:\3tnhtb.exec:\3tnhtb.exe34⤵
- Executes dropped EXE
PID:4840 -
\??\c:\dddjj.exec:\dddjj.exe35⤵
- Executes dropped EXE
PID:3788 -
\??\c:\pddvp.exec:\pddvp.exe36⤵
- Executes dropped EXE
PID:3880 -
\??\c:\xlrrrxr.exec:\xlrrrxr.exe37⤵
- Executes dropped EXE
PID:4136 -
\??\c:\rlllxff.exec:\rlllxff.exe38⤵
- Executes dropped EXE
PID:1308 -
\??\c:\hnhbtt.exec:\hnhbtt.exe39⤵
- Executes dropped EXE
PID:5092 -
\??\c:\dppjv.exec:\dppjv.exe40⤵
- Executes dropped EXE
PID:4376 -
\??\c:\jdvvv.exec:\jdvvv.exe41⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ddvpj.exec:\ddvpj.exe42⤵
- Executes dropped EXE
PID:632 -
\??\c:\bbbtbb.exec:\bbbtbb.exe43⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nbbhbh.exec:\nbbhbh.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vpjdv.exec:\vpjdv.exe45⤵
- Executes dropped EXE
PID:4796 -
\??\c:\1jjdp.exec:\1jjdp.exe46⤵
- Executes dropped EXE
PID:4444 -
\??\c:\3xflxxx.exec:\3xflxxx.exe47⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlffrfl.exec:\rlffrfl.exe48⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hhbbhh.exec:\hhbbhh.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tbbbtt.exec:\tbbbtt.exe50⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vvppj.exec:\vvppj.exe51⤵
- Executes dropped EXE
PID:4240 -
\??\c:\vpjdv.exec:\vpjdv.exe52⤵
- Executes dropped EXE
PID:3708 -
\??\c:\dvvvv.exec:\dvvvv.exe53⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe54⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lrxffff.exec:\lrxffff.exe55⤵
- Executes dropped EXE
PID:3680 -
\??\c:\nnnbth.exec:\nnnbth.exe56⤵
- Executes dropped EXE
PID:3532 -
\??\c:\hnnnbb.exec:\hnnnbb.exe57⤵
- Executes dropped EXE
PID:3916 -
\??\c:\1djpd.exec:\1djpd.exe58⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jdjpj.exec:\jdjpj.exe59⤵
- Executes dropped EXE
PID:3384 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe60⤵
- Executes dropped EXE
PID:4960 -
\??\c:\fflrxrf.exec:\fflrxrf.exe61⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tnhbbt.exec:\tnhbbt.exe62⤵
- Executes dropped EXE
PID:2500 -
\??\c:\djdpp.exec:\djdpp.exe63⤵
- Executes dropped EXE
PID:1056 -
\??\c:\7vvvp.exec:\7vvvp.exe64⤵
- Executes dropped EXE
PID:4872 -
\??\c:\rfffrlf.exec:\rfffrlf.exe65⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rxfrflx.exec:\rxfrflx.exe66⤵PID:3640
-
\??\c:\tnttnn.exec:\tnttnn.exe67⤵PID:1980
-
\??\c:\htbtth.exec:\htbtth.exe68⤵PID:2024
-
\??\c:\vvjvv.exec:\vvjvv.exe69⤵PID:1204
-
\??\c:\xxlrfxr.exec:\xxlrfxr.exe70⤵PID:2188
-
\??\c:\lflffff.exec:\lflffff.exe71⤵PID:4880
-
\??\c:\htbbbt.exec:\htbbbt.exe72⤵PID:5056
-
\??\c:\jdpvd.exec:\jdpvd.exe73⤵PID:1796
-
\??\c:\jdpjd.exec:\jdpjd.exe74⤵PID:1496
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe75⤵PID:4124
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe76⤵PID:5008
-
\??\c:\1tttnn.exec:\1tttnn.exe77⤵PID:4924
-
\??\c:\tbhtnn.exec:\tbhtnn.exe78⤵PID:2940
-
\??\c:\vpjjv.exec:\vpjjv.exe79⤵PID:432
-
\??\c:\vdjjd.exec:\vdjjd.exe80⤵PID:3488
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe81⤵PID:2104
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe82⤵PID:116
-
\??\c:\hthhbt.exec:\hthhbt.exe83⤵PID:4072
-
\??\c:\dvpjv.exec:\dvpjv.exe84⤵PID:4004
-
\??\c:\pdpvv.exec:\pdpvv.exe85⤵PID:1416
-
\??\c:\xrxlrrr.exec:\xrxlrrr.exe86⤵PID:2864
-
\??\c:\tbbbtn.exec:\tbbbtn.exe87⤵PID:1200
-
\??\c:\pjvpv.exec:\pjvpv.exe88⤵PID:1964
-
\??\c:\lffxrrl.exec:\lffxrrl.exe89⤵PID:3884
-
\??\c:\9fffxxx.exec:\9fffxxx.exe90⤵PID:4388
-
\??\c:\bhttnn.exec:\bhttnn.exe91⤵PID:3320
-
\??\c:\ddjvd.exec:\ddjvd.exe92⤵PID:4624
-
\??\c:\dvvpd.exec:\dvvpd.exe93⤵PID:2408
-
\??\c:\fllrlxx.exec:\fllrlxx.exe94⤵PID:3720
-
\??\c:\rxfllfl.exec:\rxfllfl.exe95⤵PID:3616
-
\??\c:\bhtnnb.exec:\bhtnnb.exe96⤵PID:1576
-
\??\c:\vpjpj.exec:\vpjpj.exe97⤵PID:3976
-
\??\c:\ppvjp.exec:\ppvjp.exe98⤵PID:2516
-
\??\c:\frfxrlx.exec:\frfxrlx.exe99⤵PID:1108
-
\??\c:\xffffxf.exec:\xffffxf.exe100⤵PID:4348
-
\??\c:\tttbbt.exec:\tttbbt.exe101⤵PID:1040
-
\??\c:\vpdpd.exec:\vpdpd.exe102⤵PID:4980
-
\??\c:\jpddd.exec:\jpddd.exe103⤵PID:4512
-
\??\c:\xllrffr.exec:\xllrffr.exe104⤵PID:2984
-
\??\c:\rxxlxxl.exec:\rxxlxxl.exe105⤵PID:5108
-
\??\c:\hbhnbt.exec:\hbhnbt.exe106⤵PID:3980
-
\??\c:\3dddj.exec:\3dddj.exe107⤵PID:4276
-
\??\c:\vvdvv.exec:\vvdvv.exe108⤵PID:3680
-
\??\c:\lffllll.exec:\lffllll.exe109⤵PID:3532
-
\??\c:\rrrxxll.exec:\rrrxxll.exe110⤵PID:1220
-
\??\c:\bnbttn.exec:\bnbttn.exe111⤵PID:4116
-
\??\c:\tnnhnn.exec:\tnnhnn.exe112⤵PID:452
-
\??\c:\dvddp.exec:\dvddp.exe113⤵PID:4176
-
\??\c:\ffrxffx.exec:\ffrxffx.exe114⤵PID:1396
-
\??\c:\xrllfff.exec:\xrllfff.exe115⤵PID:4660
-
\??\c:\5ntnhh.exec:\5ntnhh.exe116⤵PID:2652
-
\??\c:\pvvvp.exec:\pvvvp.exe117⤵PID:1828
-
\??\c:\rlffxxr.exec:\rlffxxr.exe118⤵PID:892
-
\??\c:\lffxrrf.exec:\lffxrrf.exe119⤵PID:2588
-
\??\c:\tbbhbb.exec:\tbbhbb.exe120⤵PID:2024
-
\??\c:\hbhhhb.exec:\hbhhhb.exe121⤵PID:4284
-
\??\c:\dvvpv.exec:\dvvpv.exe122⤵PID:936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-