Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 21:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
- Target 344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6.exe
- Size 971KB
- Sample240613-1dg3eavbql
- SHA256 344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6
- MD5 edcbf74d7ca2d1ea132def895d49e12d
- SHA1 4d68ff731d05ef7f87cad6e43a9bc14377ac700b
- SHA512 cf5256c5f3dd66aa1b43f187a2ed69bf27166dd9182a703fe578542438f370af49815ec4976327ca43cfc47db0a0360a7e57741f678a232c5cfae7a3e624845a
- SSDEEP 12288:n3C9yMo+S0L9xRnoq7H9xqYL04iVypNKvzcMwdBS3b3aoqYveXVadBlHD+CURPOo:SgD4bhoqLDqYLagB6Wj1+CyC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2064-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4384-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4632-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2428-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4232-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3452-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2552-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4336-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3156-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3208-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4604-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4552-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5092-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2272-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3228-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2392-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/512-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2620-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2308-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3416-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4896 1jjvj.exe 3452 hbnbhn.exe 4232 dvpvp.exe 2064 xrrlrfx.exe 2428 bbbtnn.exe 4632 vpjvp.exe 4384 lllxrlf.exe 2552 jpdvp.exe 2120 7lxfrlx.exe 4336 xlxflrf.exe 3156 ttnbnh.exe 3208 tbbtnh.exe 2076 bnbtnh.exe 4604 5hthhb.exe 4552 djpvj.exe 5092 5rxfxff.exe 3740 rrxxrrr.exe 1764 rxlfxrx.exe 2476 nnnhhb.exe 2272 vvjpj.exe 2968 lxxxxff.exe 3228 vjppp.exe 2392 llxffff.exe 512 fxxxxff.exe 4952 tththh.exe 2984 5xxrlrl.exe 2620 bbbbtb.exe 2308 rlrllfx.exe 2092 3bthhn.exe 3416 vvppp.exe 4876 tnhhbb.exe 3984 dvdvv.exe 3592 jvvpj.exe 1204 ttthhb.exe 4824 jjppj.exe 4544 rlrlflf.exe 3532 bbbbbb.exe 3600 5llfrxl.exe 3476 htbbtt.exe 624 ffrflxf.exe 400 hhnbbt.exe 3988 dpvpj.exe 4368 rrrrfxr.exe 1924 tbbtbt.exe 1636 5jvvj.exe 408 dvjdd.exe 212 1hhtnn.exe 3552 tttttt.exe 1240 vpvvp.exe 3520 bhnbtn.exe 3116 jjvjd.exe 1888 llrrlrl.exe 820 5nbbtt.exe 464 vvpdp.exe 2488 9rxrxxx.exe 8 nbthbn.exe 4220 7vppp.exe 3652 xrxllfx.exe 4616 htbhnt.exe 5068 dpvjj.exe 1812 lrxxxff.exe 1376 3pvjd.exe 1880 xrlffxx.exe 3200 nnhbtt.exe -
resource yara_rule behavioral2/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-199-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 4896 1924 344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6.exe 81 PID 1924 wrote to memory of 4896 1924 344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6.exe 81 PID 1924 wrote to memory of 4896 1924 344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6.exe 81 PID 4896 wrote to memory of 3452 4896 1jjvj.exe 82 PID 4896 wrote to memory of 3452 4896 1jjvj.exe 82 PID 4896 wrote to memory of 3452 4896 1jjvj.exe 82 PID 3452 wrote to memory of 4232 3452 hbnbhn.exe 83 PID 3452 wrote to memory of 4232 3452 hbnbhn.exe 83 PID 3452 wrote to memory of 4232 3452 hbnbhn.exe 83 PID 4232 wrote to memory of 2064 4232 dvpvp.exe 84 PID 4232 wrote to memory of 2064 4232 dvpvp.exe 84 PID 4232 wrote to memory of 2064 4232 dvpvp.exe 84 PID 2064 wrote to memory of 2428 2064 xrrlrfx.exe 85 PID 2064 wrote to memory of 2428 2064 xrrlrfx.exe 85 PID 2064 wrote to memory of 2428 2064 xrrlrfx.exe 85 PID 2428 wrote to memory of 4632 2428 bbbtnn.exe 86 PID 2428 wrote to memory of 4632 2428 bbbtnn.exe 86 PID 2428 wrote to memory of 4632 2428 bbbtnn.exe 86 PID 4632 wrote to memory of 4384 4632 vpjvp.exe 87 PID 4632 wrote to memory of 4384 4632 vpjvp.exe 87 PID 4632 wrote to memory of 4384 4632 vpjvp.exe 87 PID 4384 wrote to memory of 2552 4384 lllxrlf.exe 88 PID 4384 wrote to memory of 2552 4384 lllxrlf.exe 88 PID 4384 wrote to memory of 2552 4384 lllxrlf.exe 88 PID 2552 wrote to memory of 2120 2552 jpdvp.exe 90 PID 2552 wrote to memory of 2120 2552 jpdvp.exe 90 PID 2552 wrote to memory of 2120 2552 jpdvp.exe 90 PID 2120 wrote to memory of 4336 2120 7lxfrlx.exe 92 PID 2120 wrote to memory of 4336 2120 7lxfrlx.exe 92 PID 2120 wrote to memory of 4336 2120 7lxfrlx.exe 92 PID 4336 wrote to memory of 3156 4336 xlxflrf.exe 93 PID 4336 wrote to memory of 3156 4336 xlxflrf.exe 93 PID 4336 wrote to memory of 3156 4336 xlxflrf.exe 93 PID 3156 wrote to memory of 3208 3156 ttnbnh.exe 95 PID 3156 wrote to memory of 3208 3156 ttnbnh.exe 95 PID 3156 wrote to memory of 3208 3156 ttnbnh.exe 95 PID 3208 wrote to memory of 2076 3208 tbbtnh.exe 96 PID 3208 wrote to memory of 2076 3208 tbbtnh.exe 96 PID 3208 wrote to memory of 2076 3208 tbbtnh.exe 96 PID 2076 wrote to memory of 4604 2076 bnbtnh.exe 97 PID 2076 wrote to memory of 4604 2076 bnbtnh.exe 97 PID 2076 wrote to memory of 4604 2076 bnbtnh.exe 97 PID 4604 wrote to memory of 4552 4604 5hthhb.exe 98 PID 4604 wrote to memory of 4552 4604 5hthhb.exe 98 PID 4604 wrote to memory of 4552 4604 5hthhb.exe 98 PID 4552 wrote to memory of 5092 4552 djpvj.exe 99 PID 4552 wrote to memory of 5092 4552 djpvj.exe 99 PID 4552 wrote to memory of 5092 4552 djpvj.exe 99 PID 5092 wrote to memory of 3740 5092 5rxfxff.exe 100 PID 5092 wrote to memory of 3740 5092 5rxfxff.exe 100 PID 5092 wrote to memory of 3740 5092 5rxfxff.exe 100 PID 3740 wrote to memory of 1764 3740 rrxxrrr.exe 101 PID 3740 wrote to memory of 1764 3740 rrxxrrr.exe 101 PID 3740 wrote to memory of 1764 3740 rrxxrrr.exe 101 PID 1764 wrote to memory of 2476 1764 rxlfxrx.exe 102 PID 1764 wrote to memory of 2476 1764 rxlfxrx.exe 102 PID 1764 wrote to memory of 2476 1764 rxlfxrx.exe 102 PID 2476 wrote to memory of 2272 2476 nnnhhb.exe 103 PID 2476 wrote to memory of 2272 2476 nnnhhb.exe 103 PID 2476 wrote to memory of 2272 2476 nnnhhb.exe 103 PID 2272 wrote to memory of 2968 2272 vvjpj.exe 104 PID 2272 wrote to memory of 2968 2272 vvjpj.exe 104 PID 2272 wrote to memory of 2968 2272 vvjpj.exe 104 PID 2968 wrote to memory of 3228 2968 lxxxxff.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6.exe"C:\Users\Admin\AppData\Local\Temp\344dc21d3ca5902f9506d4ffeb97b526864e8083b794c1e588e14e924b4798d6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\1jjvj.exec:\1jjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\hbnbhn.exec:\hbnbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\dvpvp.exec:\dvpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\xrrlrfx.exec:\xrrlrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\bbbtnn.exec:\bbbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\vpjvp.exec:\vpjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\lllxrlf.exec:\lllxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\jpdvp.exec:\jpdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7lxfrlx.exec:\7lxfrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xlxflrf.exec:\xlxflrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\ttnbnh.exec:\ttnbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\tbbtnh.exec:\tbbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\bnbtnh.exec:\bnbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\5hthhb.exec:\5hthhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\djpvj.exec:\djpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\5rxfxff.exec:\5rxfxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\rxlfxrx.exec:\rxlfxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\nnnhhb.exec:\nnnhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\vvjpj.exec:\vvjpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\lxxxxff.exec:\lxxxxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\vjppp.exec:\vjppp.exe23⤵
- Executes dropped EXE
PID:3228 -
\??\c:\llxffff.exec:\llxffff.exe24⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fxxxxff.exec:\fxxxxff.exe25⤵
- Executes dropped EXE
PID:512 -
\??\c:\tththh.exec:\tththh.exe26⤵
- Executes dropped EXE
PID:4952 -
\??\c:\5xxrlrl.exec:\5xxrlrl.exe27⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bbbbtb.exec:\bbbbtb.exe28⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rlrllfx.exec:\rlrllfx.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3bthhn.exec:\3bthhn.exe30⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vvppp.exec:\vvppp.exe31⤵
- Executes dropped EXE
PID:3416 -
\??\c:\tnhhbb.exec:\tnhhbb.exe32⤵
- Executes dropped EXE
PID:4876 -
\??\c:\dvdvv.exec:\dvdvv.exe33⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jvvpj.exec:\jvvpj.exe34⤵
- Executes dropped EXE
PID:3592 -
\??\c:\ttthhb.exec:\ttthhb.exe35⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jjppj.exec:\jjppj.exe36⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rlrlflf.exec:\rlrlflf.exe37⤵
- Executes dropped EXE
PID:4544 -
\??\c:\bbbbbb.exec:\bbbbbb.exe38⤵
- Executes dropped EXE
PID:3532 -
\??\c:\5llfrxl.exec:\5llfrxl.exe39⤵
- Executes dropped EXE
PID:3600 -
\??\c:\htbbtt.exec:\htbbtt.exe40⤵
- Executes dropped EXE
PID:3476 -
\??\c:\ffrflxf.exec:\ffrflxf.exe41⤵
- Executes dropped EXE
PID:624 -
\??\c:\hhnbbt.exec:\hhnbbt.exe42⤵
- Executes dropped EXE
PID:400 -
\??\c:\dpvpj.exec:\dpvpj.exe43⤵
- Executes dropped EXE
PID:3988 -
\??\c:\rrrrfxr.exec:\rrrrfxr.exe44⤵
- Executes dropped EXE
PID:4368 -
\??\c:\tbbtbt.exec:\tbbtbt.exe45⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5jvvj.exec:\5jvvj.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dvjdd.exec:\dvjdd.exe47⤵
- Executes dropped EXE
PID:408 -
\??\c:\1hhtnn.exec:\1hhtnn.exe48⤵
- Executes dropped EXE
PID:212 -
\??\c:\tttttt.exec:\tttttt.exe49⤵
- Executes dropped EXE
PID:3552 -
\??\c:\vpvvp.exec:\vpvvp.exe50⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bhnbtn.exec:\bhnbtn.exe51⤵
- Executes dropped EXE
PID:3520 -
\??\c:\jjvjd.exec:\jjvjd.exe52⤵
- Executes dropped EXE
PID:3116 -
\??\c:\llrrlrl.exec:\llrrlrl.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\5nbbtt.exec:\5nbbtt.exe54⤵
- Executes dropped EXE
PID:820 -
\??\c:\vvpdp.exec:\vvpdp.exe55⤵
- Executes dropped EXE
PID:464 -
\??\c:\9rxrxxx.exec:\9rxrxxx.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nbthbn.exec:\nbthbn.exe57⤵
- Executes dropped EXE
PID:8 -
\??\c:\7vppp.exec:\7vppp.exe58⤵
- Executes dropped EXE
PID:4220 -
\??\c:\xrxllfx.exec:\xrxllfx.exe59⤵
- Executes dropped EXE
PID:3652 -
\??\c:\htbhnt.exec:\htbhnt.exe60⤵
- Executes dropped EXE
PID:4616 -
\??\c:\dpvjj.exec:\dpvjj.exe61⤵
- Executes dropped EXE
PID:5068 -
\??\c:\lrxxxff.exec:\lrxxxff.exe62⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3pvjd.exec:\3pvjd.exe63⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xrlffxx.exec:\xrlffxx.exe64⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nnhbtt.exec:\nnhbtt.exe65⤵
- Executes dropped EXE
PID:3200 -
\??\c:\pjvpp.exec:\pjvpp.exe66⤵PID:1020
-
\??\c:\flrlffr.exec:\flrlffr.exe67⤵PID:4860
-
\??\c:\bnhbtn.exec:\bnhbtn.exe68⤵PID:1112
-
\??\c:\vpdvd.exec:\vpdvd.exe69⤵PID:4552
-
\??\c:\5fxxrrx.exec:\5fxxrrx.exe70⤵PID:1668
-
\??\c:\5bhhbb.exec:\5bhhbb.exe71⤵PID:1584
-
\??\c:\xffrlfr.exec:\xffrlfr.exe72⤵PID:4104
-
\??\c:\5bnnhn.exec:\5bnnhn.exe73⤵PID:1520
-
\??\c:\1djdd.exec:\1djdd.exe74⤵PID:2476
-
\??\c:\frfxxxr.exec:\frfxxxr.exe75⤵PID:860
-
\??\c:\bhbbbb.exec:\bhbbbb.exe76⤵PID:2968
-
\??\c:\jvjjj.exec:\jvjjj.exe77⤵PID:4180
-
\??\c:\xxrrlfr.exec:\xxrrlfr.exe78⤵PID:5000
-
\??\c:\9nnnhb.exec:\9nnnhb.exe79⤵PID:2292
-
\??\c:\jjvpj.exec:\jjvpj.exe80⤵PID:1964
-
\??\c:\flxxxlr.exec:\flxxxlr.exe81⤵PID:2600
-
\??\c:\hbbbtt.exec:\hbbbtt.exe82⤵PID:2920
-
\??\c:\1frllll.exec:\1frllll.exe83⤵PID:1360
-
\??\c:\tntbtb.exec:\tntbtb.exe84⤵PID:4496
-
\??\c:\9vdvd.exec:\9vdvd.exe85⤵PID:4488
-
\??\c:\lflllrx.exec:\lflllrx.exe86⤵PID:3576
-
\??\c:\bhnbnh.exec:\bhnbnh.exe87⤵PID:2764
-
\??\c:\9jvdj.exec:\9jvdj.exe88⤵PID:3284
-
\??\c:\7xrrrrr.exec:\7xrrrrr.exe89⤵PID:4876
-
\??\c:\jpvvd.exec:\jpvvd.exe90⤵PID:1252
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe91⤵PID:4064
-
\??\c:\xlxrllf.exec:\xlxrllf.exe92⤵PID:436
-
\??\c:\tnbhnn.exec:\tnbhnn.exe93⤵PID:4960
-
\??\c:\9pvjv.exec:\9pvjv.exe94⤵PID:1596
-
\??\c:\rlrlffx.exec:\rlrlffx.exe95⤵PID:1544
-
\??\c:\thnnnt.exec:\thnnnt.exe96⤵PID:4964
-
\??\c:\xxlllrl.exec:\xxlllrl.exe97⤵PID:1552
-
\??\c:\bnnhbb.exec:\bnnhbb.exe98⤵PID:1260
-
\??\c:\5pvvv.exec:\5pvvv.exe99⤵PID:4800
-
\??\c:\xxxxrll.exec:\xxxxrll.exe100⤵PID:812
-
\??\c:\1hbtnh.exec:\1hbtnh.exe101⤵PID:2660
-
\??\c:\7lfrfxr.exec:\7lfrfxr.exe102⤵PID:1924
-
\??\c:\hnttnt.exec:\hnttnt.exe103⤵PID:4272
-
\??\c:\dvpjv.exec:\dvpjv.exe104⤵PID:1340
-
\??\c:\frrllfx.exec:\frrllfx.exe105⤵PID:212
-
\??\c:\thhhhh.exec:\thhhhh.exe106⤵PID:4696
-
\??\c:\vvvjd.exec:\vvvjd.exe107⤵PID:2944
-
\??\c:\3fllfll.exec:\3fllfll.exe108⤵PID:1680
-
\??\c:\btbttt.exec:\btbttt.exe109⤵PID:376
-
\??\c:\jvpjd.exec:\jvpjd.exe110⤵PID:1888
-
\??\c:\lxffxxx.exec:\lxffxxx.exe111⤵PID:3712
-
\??\c:\jvpjp.exec:\jvpjp.exe112⤵PID:556
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe113⤵PID:1720
-
\??\c:\1hnhhh.exec:\1hnhhh.exe114⤵PID:8
-
\??\c:\7jdvv.exec:\7jdvv.exe115⤵PID:1404
-
\??\c:\frxrfxx.exec:\frxrfxx.exe116⤵PID:4336
-
\??\c:\7bhhhn.exec:\7bhhhn.exe117⤵PID:3012
-
\??\c:\7vdpj.exec:\7vdpj.exe118⤵PID:5068
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe119⤵PID:3368
-
\??\c:\nbbbtt.exec:\nbbbtt.exe120⤵PID:3208
-
\??\c:\vvdjd.exec:\vvdjd.exe121⤵PID:3880
-
\??\c:\7rrxrrr.exec:\7rrxrrr.exe122⤵PID:3200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-