Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
- Target 38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec.exe
- Size 121KB
- Sample240614-zagf2aydlk
- SHA256 38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec
- MD5 d4a42eab82887b1a8e1d1bfb7fe85ec0
- SHA1 b7fdd663b27af066efc806beeb777e15ce0fff2f
- SHA512 e6943f6edc60830e75e51581839a4f681634d598f2d9a5f4c7d7f19ab9aad45b639766ef24e93c6fd1f01aa89ef7d9bef7d3b33e755a47359aeb91d01659b738
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8sh:ymb3NkkiQ3mdBjFomR7UsyJC+n0GsgcK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3540-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/3540-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4464-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2428-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2428-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4656-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3472-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1104-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1104-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4140-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4396-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4544-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/428-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4200-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/744-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2760-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5052-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2000-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2568-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3948-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4616-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/536-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4672-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4708 tntbbt.exe 4464 vjddv.exe 2428 lxlffrl.exe 1348 nnhhtb.exe 4656 5pjjd.exe 1112 lxfxxrl.exe 3472 hbbttt.exe 2668 tnhbtn.exe 1104 dddvp.exe 4140 hhhhbn.exe 4984 pjvpp.exe 4492 xrlffxr.exe 4396 ntttnn.exe 4544 jjjjd.exe 428 xfffffl.exe 4200 llrllfl.exe 744 vpdvp.exe 2760 9xrlfll.exe 4752 nhbnht.exe 3068 dvjdj.exe 5052 llxrfxl.exe 1928 hhtttb.exe 4628 dpvpj.exe 2000 frxrlfx.exe 4348 9rrrlfx.exe 2568 thnbtn.exe 4616 frxlffx.exe 536 nnbbnn.exe 4672 3vdjd.exe 3272 lfxxllx.exe 2876 1xfxrrl.exe 540 7ppjd.exe 1384 vvdvv.exe 1420 frxxxxx.exe 3092 lxfxllx.exe 876 bbnhbb.exe 4872 nttnnh.exe 4160 pjpjv.exe 2420 lflfxxf.exe 4140 7lfxrrl.exe 2240 hhbhht.exe 2160 bhhbtt.exe 2520 9ppjd.exe 2136 3vjjj.exe 2044 lffxxxr.exe 4316 lfffffl.exe 3564 hnhbhn.exe 2324 7jvpj.exe 4184 pjpvp.exe 3576 fxxxrrr.exe 4104 rlllfrr.exe 4692 9hthbb.exe 1412 jjvvv.exe 2292 vpddp.exe 2264 lflrrfl.exe 3456 1nbbhn.exe 2740 1nnhbb.exe 3012 vvvvp.exe 2744 1ffxrlf.exe 3720 rrflrxl.exe 2508 hhtntb.exe 1920 1pvjd.exe 3612 dvdvp.exe 2200 rxrlxxr.exe -
resource yara_rule behavioral2/memory/3540-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-201-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 4708 3540 38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec.exe 89 PID 3540 wrote to memory of 4708 3540 38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec.exe 89 PID 3540 wrote to memory of 4708 3540 38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec.exe 89 PID 4708 wrote to memory of 4464 4708 tntbbt.exe 90 PID 4708 wrote to memory of 4464 4708 tntbbt.exe 90 PID 4708 wrote to memory of 4464 4708 tntbbt.exe 90 PID 4464 wrote to memory of 2428 4464 vjddv.exe 91 PID 4464 wrote to memory of 2428 4464 vjddv.exe 91 PID 4464 wrote to memory of 2428 4464 vjddv.exe 91 PID 2428 wrote to memory of 1348 2428 lxlffrl.exe 92 PID 2428 wrote to memory of 1348 2428 lxlffrl.exe 92 PID 2428 wrote to memory of 1348 2428 lxlffrl.exe 92 PID 1348 wrote to memory of 4656 1348 nnhhtb.exe 93 PID 1348 wrote to memory of 4656 1348 nnhhtb.exe 93 PID 1348 wrote to memory of 4656 1348 nnhhtb.exe 93 PID 4656 wrote to memory of 1112 4656 5pjjd.exe 94 PID 4656 wrote to memory of 1112 4656 5pjjd.exe 94 PID 4656 wrote to memory of 1112 4656 5pjjd.exe 94 PID 1112 wrote to memory of 3472 1112 lxfxxrl.exe 95 PID 1112 wrote to memory of 3472 1112 lxfxxrl.exe 95 PID 1112 wrote to memory of 3472 1112 lxfxxrl.exe 95 PID 3472 wrote to memory of 2668 3472 hbbttt.exe 96 PID 3472 wrote to memory of 2668 3472 hbbttt.exe 96 PID 3472 wrote to memory of 2668 3472 hbbttt.exe 96 PID 2668 wrote to memory of 1104 2668 tnhbtn.exe 98 PID 2668 wrote to memory of 1104 2668 tnhbtn.exe 98 PID 2668 wrote to memory of 1104 2668 tnhbtn.exe 98 PID 1104 wrote to memory of 4140 1104 dddvp.exe 99 PID 1104 wrote to memory of 4140 1104 dddvp.exe 99 PID 1104 wrote to memory of 4140 1104 dddvp.exe 99 PID 4140 wrote to memory of 4984 4140 hhhhbn.exe 100 PID 4140 wrote to memory of 4984 4140 hhhhbn.exe 100 PID 4140 wrote to memory of 4984 4140 hhhhbn.exe 100 PID 4984 wrote to memory of 4492 4984 pjvpp.exe 102 PID 4984 wrote to memory of 4492 4984 pjvpp.exe 102 PID 4984 wrote to memory of 4492 4984 pjvpp.exe 102 PID 4492 wrote to memory of 4396 4492 xrlffxr.exe 103 PID 4492 wrote to memory of 4396 4492 xrlffxr.exe 103 PID 4492 wrote to memory of 4396 4492 xrlffxr.exe 103 PID 4396 wrote to memory of 4544 4396 ntttnn.exe 104 PID 4396 wrote to memory of 4544 4396 ntttnn.exe 104 PID 4396 wrote to memory of 4544 4396 ntttnn.exe 104 PID 4544 wrote to memory of 428 4544 jjjjd.exe 105 PID 4544 wrote to memory of 428 4544 jjjjd.exe 105 PID 4544 wrote to memory of 428 4544 jjjjd.exe 105 PID 428 wrote to memory of 4200 428 xfffffl.exe 106 PID 428 wrote to memory of 4200 428 xfffffl.exe 106 PID 428 wrote to memory of 4200 428 xfffffl.exe 106 PID 4200 wrote to memory of 744 4200 llrllfl.exe 107 PID 4200 wrote to memory of 744 4200 llrllfl.exe 107 PID 4200 wrote to memory of 744 4200 llrllfl.exe 107 PID 744 wrote to memory of 2760 744 vpdvp.exe 109 PID 744 wrote to memory of 2760 744 vpdvp.exe 109 PID 744 wrote to memory of 2760 744 vpdvp.exe 109 PID 2760 wrote to memory of 4752 2760 9xrlfll.exe 110 PID 2760 wrote to memory of 4752 2760 9xrlfll.exe 110 PID 2760 wrote to memory of 4752 2760 9xrlfll.exe 110 PID 4752 wrote to memory of 3068 4752 nhbnht.exe 111 PID 4752 wrote to memory of 3068 4752 nhbnht.exe 111 PID 4752 wrote to memory of 3068 4752 nhbnht.exe 111 PID 3068 wrote to memory of 5052 3068 dvjdj.exe 112 PID 3068 wrote to memory of 5052 3068 dvjdj.exe 112 PID 3068 wrote to memory of 5052 3068 dvjdj.exe 112 PID 5052 wrote to memory of 1928 5052 llxrfxl.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec.exe"C:\Users\Admin\AppData\Local\Temp\38b072d312bbe9ebe8dbf621a05b3be2b0fbab3cff8d562b081769e3886491ec.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\tntbbt.exec:\tntbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\vjddv.exec:\vjddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\lxlffrl.exec:\lxlffrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\nnhhtb.exec:\nnhhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\5pjjd.exec:\5pjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\hbbttt.exec:\hbbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\tnhbtn.exec:\tnhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\dddvp.exec:\dddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\hhhhbn.exec:\hhhhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\pjvpp.exec:\pjvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\xrlffxr.exec:\xrlffxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\ntttnn.exec:\ntttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\jjjjd.exec:\jjjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\xfffffl.exec:\xfffffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\llrllfl.exec:\llrllfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\vpdvp.exec:\vpdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\9xrlfll.exec:\9xrlfll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nhbnht.exec:\nhbnht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\dvjdj.exec:\dvjdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\llxrfxl.exec:\llxrfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\hhtttb.exec:\hhtttb.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dpvpj.exec:\dpvpj.exe24⤵
- Executes dropped EXE
PID:4628 -
\??\c:\frxrlfx.exec:\frxrlfx.exe25⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9rrrlfx.exec:\9rrrlfx.exe26⤵
- Executes dropped EXE
PID:4348 -
\??\c:\thnbtn.exec:\thnbtn.exe27⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5vdpj.exec:\5vdpj.exe28⤵PID:3948
-
\??\c:\frxlffx.exec:\frxlffx.exe29⤵
- Executes dropped EXE
PID:4616 -
\??\c:\nnbbnn.exec:\nnbbnn.exe30⤵
- Executes dropped EXE
PID:536 -
\??\c:\3vdjd.exec:\3vdjd.exe31⤵
- Executes dropped EXE
PID:4672 -
\??\c:\lfxxllx.exec:\lfxxllx.exe32⤵
- Executes dropped EXE
PID:3272 -
\??\c:\1xfxrrl.exec:\1xfxrrl.exe33⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7ppjd.exec:\7ppjd.exe34⤵
- Executes dropped EXE
PID:540 -
\??\c:\vvdvv.exec:\vvdvv.exe35⤵
- Executes dropped EXE
PID:1384 -
\??\c:\frxxxxx.exec:\frxxxxx.exe36⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lxfxllx.exec:\lxfxllx.exe37⤵
- Executes dropped EXE
PID:3092 -
\??\c:\bbnhbb.exec:\bbnhbb.exe38⤵
- Executes dropped EXE
PID:876 -
\??\c:\nttnnh.exec:\nttnnh.exe39⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pjpjv.exec:\pjpjv.exe40⤵
- Executes dropped EXE
PID:4160 -
\??\c:\lflfxxf.exec:\lflfxxf.exe41⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe42⤵
- Executes dropped EXE
PID:4140 -
\??\c:\hhbhht.exec:\hhbhht.exe43⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bhhbtt.exec:\bhhbtt.exe44⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9ppjd.exec:\9ppjd.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3vjjj.exec:\3vjjj.exe46⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lffxxxr.exec:\lffxxxr.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lfffffl.exec:\lfffffl.exe48⤵
- Executes dropped EXE
PID:4316 -
\??\c:\hnhbhn.exec:\hnhbhn.exe49⤵
- Executes dropped EXE
PID:3564 -
\??\c:\7jvpj.exec:\7jvpj.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjpvp.exec:\pjpvp.exe51⤵
- Executes dropped EXE
PID:4184 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe52⤵
- Executes dropped EXE
PID:3576 -
\??\c:\rlllfrr.exec:\rlllfrr.exe53⤵
- Executes dropped EXE
PID:4104 -
\??\c:\9hthbb.exec:\9hthbb.exe54⤵
- Executes dropped EXE
PID:4692 -
\??\c:\jjvvv.exec:\jjvvv.exe55⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vpddp.exec:\vpddp.exe56⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lflrrfl.exec:\lflrrfl.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1nbbhn.exec:\1nbbhn.exe58⤵
- Executes dropped EXE
PID:3456 -
\??\c:\1nnhbb.exec:\1nnhbb.exe59⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vvvvp.exec:\vvvvp.exe60⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1ffxrlf.exec:\1ffxrlf.exe61⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rrflrxl.exec:\rrflrxl.exe62⤵
- Executes dropped EXE
PID:3720 -
\??\c:\hhtntb.exec:\hhtntb.exe63⤵
- Executes dropped EXE
PID:2508 -
\??\c:\1pvjd.exec:\1pvjd.exe64⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dvdvp.exec:\dvdvp.exe65⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rxrlxxr.exec:\rxrlxxr.exe66⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3lllffr.exec:\3lllffr.exe67⤵PID:536
-
\??\c:\nbbtnt.exec:\nbbtnt.exe68⤵PID:4464
-
\??\c:\1bbthb.exec:\1bbthb.exe69⤵PID:3100
-
\??\c:\jjdpj.exec:\jjdpj.exe70⤵PID:212
-
\??\c:\flllffx.exec:\flllffx.exe71⤵PID:4924
-
\??\c:\7bbnhh.exec:\7bbnhh.exe72⤵PID:2164
-
\??\c:\hbhhnh.exec:\hbhhnh.exe73⤵PID:804
-
\??\c:\jjjjd.exec:\jjjjd.exe74⤵PID:2152
-
\??\c:\pjjjd.exec:\pjjjd.exe75⤵PID:4580
-
\??\c:\xlllfrl.exec:\xlllfrl.exe76⤵PID:2828
-
\??\c:\nbnbnh.exec:\nbnbnh.exe77⤵PID:3864
-
\??\c:\bhhhbb.exec:\bhhhbb.exe78⤵PID:4836
-
\??\c:\ddppp.exec:\ddppp.exe79⤵PID:2844
-
\??\c:\dvvpd.exec:\dvvpd.exe80⤵PID:3812
-
\??\c:\xxxffff.exec:\xxxffff.exe81⤵PID:4960
-
\??\c:\ffflflx.exec:\ffflflx.exe82⤵PID:3876
-
\??\c:\btnhtt.exec:\btnhtt.exe83⤵PID:3708
-
\??\c:\hbhhhn.exec:\hbhhhn.exe84⤵PID:3632
-
\??\c:\pppjv.exec:\pppjv.exe85⤵PID:2244
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe86⤵PID:3304
-
\??\c:\xlllllf.exec:\xlllllf.exe87⤵PID:4044
-
\??\c:\bbbhbb.exec:\bbbhbb.exe88⤵PID:1100
-
\??\c:\bnttnn.exec:\bnttnn.exe89⤵PID:512
-
\??\c:\vjjjd.exec:\vjjjd.exe90⤵PID:2080
-
\??\c:\rlrlfff.exec:\rlrlfff.exe91⤵PID:3000
-
\??\c:\xxffllf.exec:\xxffllf.exe92⤵PID:4236
-
\??\c:\tnttnn.exec:\tnttnn.exe93⤵PID:4756
-
\??\c:\nnhhtb.exec:\nnhhtb.exe94⤵PID:1820
-
\??\c:\jpddp.exec:\jpddp.exe95⤵PID:5052
-
\??\c:\jvppp.exec:\jvppp.exe96⤵PID:2684
-
\??\c:\lflfxfx.exec:\lflfxfx.exe97⤵PID:2908
-
\??\c:\9fllfff.exec:\9fllfff.exe98⤵PID:2000
-
\??\c:\ttbbtt.exec:\ttbbtt.exe99⤵PID:4404
-
\??\c:\nhhhnn.exec:\nhhhnn.exe100⤵PID:4988
-
\??\c:\pjddp.exec:\pjddp.exe101⤵PID:4444
-
\??\c:\vpjjj.exec:\vpjjj.exe102⤵PID:1716
-
\??\c:\9rxrrxf.exec:\9rxrrxf.exe103⤵PID:4004
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe104⤵PID:4340
-
\??\c:\nhhhhh.exec:\nhhhhh.exe105⤵PID:536
-
\??\c:\3ntnbb.exec:\3ntnbb.exe106⤵PID:4028
-
\??\c:\dpvjd.exec:\dpvjd.exe107⤵PID:5060
-
\??\c:\jdjdp.exec:\jdjdp.exe108⤵PID:1360
-
\??\c:\fxffrff.exec:\fxffrff.exe109⤵PID:4676
-
\??\c:\1lfxxxx.exec:\1lfxxxx.exe110⤵PID:2164
-
\??\c:\nhtttt.exec:\nhtttt.exe111⤵PID:804
-
\??\c:\nbhhbb.exec:\nbhhbb.exe112⤵PID:2152
-
\??\c:\dpvvp.exec:\dpvvp.exe113⤵PID:4580
-
\??\c:\pjjdv.exec:\pjjdv.exe114⤵PID:2828
-
\??\c:\llffffr.exec:\llffffr.exe115⤵PID:3864
-
\??\c:\lxxrlrl.exec:\lxxrlrl.exe116⤵PID:3284
-
\??\c:\tbttnt.exec:\tbttnt.exe117⤵PID:3040
-
\??\c:\nhnhbb.exec:\nhnhbb.exe118⤵PID:1220
-
\??\c:\jdddv.exec:\jdddv.exe119⤵PID:4960
-
\??\c:\jjjdv.exec:\jjjdv.exe120⤵PID:3876
-
\??\c:\3xffxfx.exec:\3xffxfx.exe121⤵PID:3708
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe122⤵PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-