Analysis
- max time kernel
76s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4.exe
- Size 115KB
- Sample240609-bx7pqsbf2x
- SHA256 6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4
- MD5 05a6cdeb31539dfba8eaf7c76f289781
- SHA1 525a0e5cd32100285e02d3ba4b049fd6099b435f
- SHA512 09df78d154543c2af4af98a1de2e96f511c8c32d8655283ebc6c11a9f649998054043a7d0b9eb54983167c0de0fee0433ea6f85fdaa6842a3dba63d52d2bfb16
- SSDEEP 3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFh:n3C9BRosxW8MFHLMWvlM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2620-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/900-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/2620-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2816-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/900-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/228-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2068-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1572-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1572-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1572-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1000-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1624-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4960-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/932-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4456-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3240-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3624-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4256-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4220-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/632-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1404-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3644-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2344-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4044-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2456-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1928-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1796-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4308-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/928-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3604 fxxlfrl.exe 2816 hbbhhh.exe 900 vjjjd.exe 228 fxlfrrf.exe 2068 bhhbnt.exe 1572 jddvp.exe 1000 lxxrllf.exe 1624 bbbbtt.exe 4960 ppddv.exe 932 frxxrrr.exe 4996 3flfxxr.exe 4456 tnnnhn.exe 3240 xrrxxrx.exe 3624 nnhbbb.exe 3000 hbnbtn.exe 4256 ddpjd.exe 4220 frfxllf.exe 632 hhtnnn.exe 1404 vvppj.exe 3644 9xrrlll.exe 404 tnnhbb.exe 2344 vjpjd.exe 4332 fxlfrrx.exe 4044 nnnnhh.exe 2456 jpvdv.exe 4224 lffxlll.exe 2308 3bhhnn.exe 1928 pjpjj.exe 1796 pjdvj.exe 4308 7llfxff.exe 928 nhnhbn.exe 1008 3htnbh.exe 3876 vvvpd.exe 1916 rrrrxfx.exe 672 bbnntt.exe 5100 nnhbth.exe 3432 dpvpj.exe 2840 1ffffll.exe 4940 hbhhhh.exe 3972 tnhbtt.exe 4352 ddppv.exe 4768 fxlllll.exe 2320 nnbbbb.exe 2612 nnhbnh.exe 2488 ddddd.exe 4780 lfffxxr.exe 1828 ffffxxx.exe 2140 nhbtnn.exe 1900 jdddv.exe 3852 jvjdd.exe 3772 fxfxlll.exe 4068 hbttnb.exe 3336 9thhtt.exe 4808 dpjdp.exe 3240 3ffxrrx.exe 460 fxfxrlf.exe 4392 htbbbb.exe 1376 ddjjv.exe 2172 7pvpj.exe 840 3lrllfl.exe 224 llrrrrr.exe 632 btnhbh.exe 4036 htbnbb.exe 4924 dvdvp.exe -
resource yara_rule behavioral2/memory/2620-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 3604 2620 6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4.exe 84 PID 2620 wrote to memory of 3604 2620 6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4.exe 84 PID 2620 wrote to memory of 3604 2620 6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4.exe 84 PID 3604 wrote to memory of 2816 3604 fxxlfrl.exe 85 PID 3604 wrote to memory of 2816 3604 fxxlfrl.exe 85 PID 3604 wrote to memory of 2816 3604 fxxlfrl.exe 85 PID 2816 wrote to memory of 900 2816 hbbhhh.exe 86 PID 2816 wrote to memory of 900 2816 hbbhhh.exe 86 PID 2816 wrote to memory of 900 2816 hbbhhh.exe 86 PID 900 wrote to memory of 228 900 vjjjd.exe 87 PID 900 wrote to memory of 228 900 vjjjd.exe 87 PID 900 wrote to memory of 228 900 vjjjd.exe 87 PID 228 wrote to memory of 2068 228 fxlfrrf.exe 88 PID 228 wrote to memory of 2068 228 fxlfrrf.exe 88 PID 228 wrote to memory of 2068 228 fxlfrrf.exe 88 PID 2068 wrote to memory of 1572 2068 bhhbnt.exe 89 PID 2068 wrote to memory of 1572 2068 bhhbnt.exe 89 PID 2068 wrote to memory of 1572 2068 bhhbnt.exe 89 PID 1572 wrote to memory of 1000 1572 jddvp.exe 90 PID 1572 wrote to memory of 1000 1572 jddvp.exe 90 PID 1572 wrote to memory of 1000 1572 jddvp.exe 90 PID 1000 wrote to memory of 1624 1000 lxxrllf.exe 91 PID 1000 wrote to memory of 1624 1000 lxxrllf.exe 91 PID 1000 wrote to memory of 1624 1000 lxxrllf.exe 91 PID 1624 wrote to memory of 4960 1624 bbbbtt.exe 92 PID 1624 wrote to memory of 4960 1624 bbbbtt.exe 92 PID 1624 wrote to memory of 4960 1624 bbbbtt.exe 92 PID 4960 wrote to memory of 932 4960 ppddv.exe 93 PID 4960 wrote to memory of 932 4960 ppddv.exe 93 PID 4960 wrote to memory of 932 4960 ppddv.exe 93 PID 932 wrote to memory of 4996 932 frxxrrr.exe 94 PID 932 wrote to memory of 4996 932 frxxrrr.exe 94 PID 932 wrote to memory of 4996 932 frxxrrr.exe 94 PID 4996 wrote to memory of 4456 4996 3flfxxr.exe 95 PID 4996 wrote to memory of 4456 4996 3flfxxr.exe 95 PID 4996 wrote to memory of 4456 4996 3flfxxr.exe 95 PID 4456 wrote to memory of 3240 4456 tnnnhn.exe 96 PID 4456 wrote to memory of 3240 4456 tnnnhn.exe 96 PID 4456 wrote to memory of 3240 4456 tnnnhn.exe 96 PID 3240 wrote to memory of 3624 3240 xrrxxrx.exe 97 PID 3240 wrote to memory of 3624 3240 xrrxxrx.exe 97 PID 3240 wrote to memory of 3624 3240 xrrxxrx.exe 97 PID 3624 wrote to memory of 3000 3624 nnhbbb.exe 98 PID 3624 wrote to memory of 3000 3624 nnhbbb.exe 98 PID 3624 wrote to memory of 3000 3624 nnhbbb.exe 98 PID 3000 wrote to memory of 4256 3000 hbnbtn.exe 99 PID 3000 wrote to memory of 4256 3000 hbnbtn.exe 99 PID 3000 wrote to memory of 4256 3000 hbnbtn.exe 99 PID 4256 wrote to memory of 4220 4256 ddpjd.exe 100 PID 4256 wrote to memory of 4220 4256 ddpjd.exe 100 PID 4256 wrote to memory of 4220 4256 ddpjd.exe 100 PID 4220 wrote to memory of 632 4220 frfxllf.exe 101 PID 4220 wrote to memory of 632 4220 frfxllf.exe 101 PID 4220 wrote to memory of 632 4220 frfxllf.exe 101 PID 632 wrote to memory of 1404 632 hhtnnn.exe 103 PID 632 wrote to memory of 1404 632 hhtnnn.exe 103 PID 632 wrote to memory of 1404 632 hhtnnn.exe 103 PID 1404 wrote to memory of 3644 1404 vvppj.exe 104 PID 1404 wrote to memory of 3644 1404 vvppj.exe 104 PID 1404 wrote to memory of 3644 1404 vvppj.exe 104 PID 3644 wrote to memory of 404 3644 9xrrlll.exe 105 PID 3644 wrote to memory of 404 3644 9xrrlll.exe 105 PID 3644 wrote to memory of 404 3644 9xrrlll.exe 105 PID 404 wrote to memory of 2344 404 tnnhbb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4.exe"C:\Users\Admin\AppData\Local\Temp\6a1a6b5ca726698b3b33fe2d33eb0266a607415e6dd799b49b9d7fa5bd57e9a4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fxxlfrl.exec:\fxxlfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\hbbhhh.exec:\hbbhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vjjjd.exec:\vjjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\bhhbnt.exec:\bhhbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jddvp.exec:\jddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\lxxrllf.exec:\lxxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\bbbbtt.exec:\bbbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ppddv.exec:\ppddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\frxxrrr.exec:\frxxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\3flfxxr.exec:\3flfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\tnnnhn.exec:\tnnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\xrrxxrx.exec:\xrrxxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\nnhbbb.exec:\nnhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\hbnbtn.exec:\hbnbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ddpjd.exec:\ddpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\frfxllf.exec:\frfxllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\hhtnnn.exec:\hhtnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\vvppj.exec:\vvppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\9xrrlll.exec:\9xrrlll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\tnnhbb.exec:\tnnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\vjpjd.exec:\vjpjd.exe23⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe24⤵
- Executes dropped EXE
PID:4332 -
\??\c:\nnnnhh.exec:\nnnnhh.exe25⤵
- Executes dropped EXE
PID:4044 -
\??\c:\jpvdv.exec:\jpvdv.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lffxlll.exec:\lffxlll.exe27⤵
- Executes dropped EXE
PID:4224 -
\??\c:\3bhhnn.exec:\3bhhnn.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pjpjj.exec:\pjpjj.exe29⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pjdvj.exec:\pjdvj.exe30⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7llfxff.exec:\7llfxff.exe31⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nhnhbn.exec:\nhnhbn.exe32⤵
- Executes dropped EXE
PID:928 -
\??\c:\3htnbh.exec:\3htnbh.exe33⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vvvpd.exec:\vvvpd.exe34⤵
- Executes dropped EXE
PID:3876 -
\??\c:\rrrrxfx.exec:\rrrrxfx.exe35⤵
- Executes dropped EXE
PID:1916 -
\??\c:\bbnntt.exec:\bbnntt.exe36⤵
- Executes dropped EXE
PID:672 -
\??\c:\nnhbth.exec:\nnhbth.exe37⤵
- Executes dropped EXE
PID:5100 -
\??\c:\djjdv.exec:\djjdv.exe38⤵PID:4316
-
\??\c:\dpvpj.exec:\dpvpj.exe39⤵
- Executes dropped EXE
PID:3432 -
\??\c:\1ffffll.exec:\1ffffll.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hbhhhh.exec:\hbhhhh.exe41⤵
- Executes dropped EXE
PID:4940 -
\??\c:\tnhbtt.exec:\tnhbtt.exe42⤵
- Executes dropped EXE
PID:3972 -
\??\c:\ddppv.exec:\ddppv.exe43⤵
- Executes dropped EXE
PID:4352 -
\??\c:\fxlllll.exec:\fxlllll.exe44⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nnbbbb.exec:\nnbbbb.exe45⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nnhbnh.exec:\nnhbnh.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ddddd.exec:\ddddd.exe47⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lfffxxr.exec:\lfffxxr.exe48⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ffffxxx.exec:\ffffxxx.exe49⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nhbtnn.exec:\nhbtnn.exe50⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jdddv.exec:\jdddv.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jvjdd.exec:\jvjdd.exe52⤵
- Executes dropped EXE
PID:3852 -
\??\c:\fxfxlll.exec:\fxfxlll.exe53⤵
- Executes dropped EXE
PID:3772 -
\??\c:\hbttnb.exec:\hbttnb.exe54⤵
- Executes dropped EXE
PID:4068 -
\??\c:\9thhtt.exec:\9thhtt.exe55⤵
- Executes dropped EXE
PID:3336 -
\??\c:\dpjdp.exec:\dpjdp.exe56⤵
- Executes dropped EXE
PID:4808 -
\??\c:\3ffxrrx.exec:\3ffxrrx.exe57⤵
- Executes dropped EXE
PID:3240 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe58⤵
- Executes dropped EXE
PID:460 -
\??\c:\htbbbb.exec:\htbbbb.exe59⤵
- Executes dropped EXE
PID:4392 -
\??\c:\ddjjv.exec:\ddjjv.exe60⤵
- Executes dropped EXE
PID:1376 -
\??\c:\7pvpj.exec:\7pvpj.exe61⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3lrllfl.exec:\3lrllfl.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\llrrrrr.exec:\llrrrrr.exe63⤵
- Executes dropped EXE
PID:224 -
\??\c:\btnhbh.exec:\btnhbh.exe64⤵
- Executes dropped EXE
PID:632 -
\??\c:\htbnbb.exec:\htbnbb.exe65⤵
- Executes dropped EXE
PID:4036 -
\??\c:\dvdvp.exec:\dvdvp.exe66⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe67⤵PID:464
-
\??\c:\llrlrrx.exec:\llrlrrx.exe68⤵PID:5092
-
\??\c:\bhtnnt.exec:\bhtnnt.exe69⤵PID:4040
-
\??\c:\tnbttn.exec:\tnbttn.exe70⤵PID:2052
-
\??\c:\dpppj.exec:\dpppj.exe71⤵PID:2016
-
\??\c:\xrrlllr.exec:\xrrlllr.exe72⤵PID:4560
-
\??\c:\tnbtnn.exec:\tnbtnn.exe73⤵PID:32
-
\??\c:\5nhbnn.exec:\5nhbnn.exe74⤵PID:1940
-
\??\c:\jppjj.exec:\jppjj.exe75⤵PID:4980
-
\??\c:\ppjdp.exec:\ppjdp.exe76⤵PID:3328
-
\??\c:\5rrlxxr.exec:\5rrlxxr.exe77⤵PID:1928
-
\??\c:\3nnhbb.exec:\3nnhbb.exe78⤵PID:4324
-
\??\c:\hthbnn.exec:\hthbnn.exe79⤵PID:4876
-
\??\c:\pjdvp.exec:\pjdvp.exe80⤵PID:4264
-
\??\c:\lffxrrl.exec:\lffxrrl.exe81⤵PID:4860
-
\??\c:\lrrfxlf.exec:\lrrfxlf.exe82⤵PID:3264
-
\??\c:\nbttnh.exec:\nbttnh.exe83⤵PID:4864
-
\??\c:\nntnnn.exec:\nntnnn.exe84⤵PID:4984
-
\??\c:\pdddp.exec:\pdddp.exe85⤵PID:1148
-
\??\c:\xflfffl.exec:\xflfffl.exe86⤵PID:2388
-
\??\c:\hthtnn.exec:\hthtnn.exe87⤵PID:4188
-
\??\c:\vjvvd.exec:\vjvvd.exe88⤵PID:3604
-
\??\c:\jdjvv.exec:\jdjvv.exe89⤵PID:1288
-
\??\c:\xxrrfff.exec:\xxrrfff.exe90⤵PID:4200
-
\??\c:\3bbbnt.exec:\3bbbnt.exe91⤵PID:1284
-
\??\c:\vjdvj.exec:\vjdvj.exe92⤵PID:2284
-
\??\c:\fxllfff.exec:\fxllfff.exe93⤵PID:4208
-
\??\c:\rrlfllr.exec:\rrlfllr.exe94⤵PID:704
-
\??\c:\thtttt.exec:\thtttt.exe95⤵PID:1056
-
\??\c:\tnhbtt.exec:\tnhbtt.exe96⤵PID:1184
-
\??\c:\pjdpv.exec:\pjdpv.exe97⤵PID:3096
-
\??\c:\vvjdv.exec:\vvjdv.exe98⤵PID:1624
-
\??\c:\llxrrrr.exec:\llxrrrr.exe99⤵PID:8
-
\??\c:\nhbbnn.exec:\nhbbnn.exe100⤵PID:4960
-
\??\c:\bnbbnb.exec:\bnbbnb.exe101⤵PID:4592
-
\??\c:\vjjdp.exec:\vjjdp.exe102⤵PID:872
-
\??\c:\pdjdv.exec:\pdjdv.exe103⤵PID:3444
-
\??\c:\lrxrlll.exec:\lrxrlll.exe104⤵PID:3968
-
\??\c:\hhnnnn.exec:\hhnnnn.exe105⤵PID:2468
-
\??\c:\hbtnnh.exec:\hbtnnh.exe106⤵PID:1468
-
\??\c:\jjdpp.exec:\jjdpp.exe107⤵PID:2264
-
\??\c:\pjjdv.exec:\pjjdv.exe108⤵PID:1564
-
\??\c:\xrxrfff.exec:\xrxrfff.exe109⤵PID:1036
-
\??\c:\thtnnn.exec:\thtnnn.exe110⤵PID:1800
-
\??\c:\xrllfff.exec:\xrllfff.exe111⤵PID:1208
-
\??\c:\rllxrrr.exec:\rllxrrr.exe112⤵PID:4604
-
\??\c:\ppvpj.exec:\ppvpj.exe113⤵PID:1832
-
\??\c:\hthbtt.exec:\hthbtt.exe114⤵PID:3212
-
\??\c:\dppvp.exec:\dppvp.exe115⤵PID:4856
-
\??\c:\lllfxrf.exec:\lllfxrf.exe116⤵PID:2512
-
\??\c:\ntbbtt.exec:\ntbbtt.exe117⤵PID:4044
-
\??\c:\tnnhtt.exec:\tnnhtt.exe118⤵PID:2900
-
\??\c:\jpvvv.exec:\jpvvv.exe119⤵PID:4908
-
\??\c:\rlrxlll.exec:\rlrxlll.exe120⤵PID:2948
-
\??\c:\lxffxxx.exec:\lxffxxx.exe121⤵PID:3368
-
\??\c:\1bbttt.exec:\1bbttt.exe122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-