Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 03:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606.exe
- Size 97KB
- Sample240615-dr99sa1dpq
- SHA256 e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606
- MD5 d4a18e35ab49c00d22fd77444fc3b6d5
- SHA1 4c542decaa315612cfa8ec16002a83c4f57b191d
- SHA512 422564da3eebdcb50c309c40abab05543c1bde4fddab4bd0efff10c9b0186e535da77620e14f55bc93cb1aa5fe5b3495625ec43b555ae4fe5f249a2dd05afb5b
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLnnK:ymb3NkkiQ3mdBjFIi/REUZnKlbnvQ/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3808-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/3192-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3808-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3852-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3396-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1492-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3324-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1832-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1832-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1832-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1832-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2292-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1456-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2584-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/972-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3920-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/844-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2160-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4456-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3732-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5084-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4440-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1916-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2144-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3192 thnnhb.exe 720 jddvv.exe 3852 5nhnbt.exe 3396 jdjdv.exe 1492 flrlffx.exe 3324 btttnn.exe 1004 nbhbbb.exe 1832 lxrfrrl.exe 2696 vpvpd.exe 2880 jddvj.exe 2292 rxrlxxl.exe 1456 xrxlllr.exe 1204 ntbtnn.exe 3520 jdpdd.exe 2584 fxxrxrl.exe 972 thbtht.exe 3920 9tbnbb.exe 844 vvvjj.exe 2160 lffxxrx.exe 4456 httnhh.exe 3732 btnhtt.exe 3784 1ppjv.exe 5084 pdvvp.exe 3268 frxlfxx.exe 4440 xlrrrlf.exe 660 nhbnnn.exe 1916 hbtnnh.exe 2144 7jjdp.exe 5092 jvvpv.exe 1900 rlrrlrr.exe 388 httnhh.exe 2380 7hnhbb.exe 4024 vppjv.exe 4564 3pvpp.exe 412 rlfrlfx.exe 1120 lrrlffx.exe 3764 hbbbtn.exe 2792 nnnnbn.exe 3792 ttnhth.exe 4884 dddpj.exe 4384 pdpjd.exe 2140 frrxrrl.exe 1052 3llxrlf.exe 2920 5nnhtn.exe 2788 bnhbtt.exe 764 vpjdv.exe 2736 rflxxrl.exe 1092 lrxrrrx.exe 1896 1bhbtn.exe 1364 3nhhbt.exe 3264 tttnhb.exe 2376 9ddvj.exe 2608 jpvjd.exe 516 lxxrffr.exe 712 lrrrllf.exe 5024 ntbbtt.exe 1748 hhnhtt.exe 3060 9vdvp.exe 1656 5vjdj.exe 5080 rllxllf.exe 3340 xffrllf.exe 2748 rflrrll.exe 1032 hntnbb.exe 5040 hbbbbh.exe -
resource yara_rule behavioral2/memory/3192-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-190-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3808 wrote to memory of 3192 3808 e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606.exe 82 PID 3808 wrote to memory of 3192 3808 e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606.exe 82 PID 3808 wrote to memory of 3192 3808 e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606.exe 82 PID 3192 wrote to memory of 720 3192 thnnhb.exe 83 PID 3192 wrote to memory of 720 3192 thnnhb.exe 83 PID 3192 wrote to memory of 720 3192 thnnhb.exe 83 PID 720 wrote to memory of 3852 720 jddvv.exe 84 PID 720 wrote to memory of 3852 720 jddvv.exe 84 PID 720 wrote to memory of 3852 720 jddvv.exe 84 PID 3852 wrote to memory of 3396 3852 5nhnbt.exe 85 PID 3852 wrote to memory of 3396 3852 5nhnbt.exe 85 PID 3852 wrote to memory of 3396 3852 5nhnbt.exe 85 PID 3396 wrote to memory of 1492 3396 jdjdv.exe 86 PID 3396 wrote to memory of 1492 3396 jdjdv.exe 86 PID 3396 wrote to memory of 1492 3396 jdjdv.exe 86 PID 1492 wrote to memory of 3324 1492 flrlffx.exe 87 PID 1492 wrote to memory of 3324 1492 flrlffx.exe 87 PID 1492 wrote to memory of 3324 1492 flrlffx.exe 87 PID 3324 wrote to memory of 1004 3324 btttnn.exe 89 PID 3324 wrote to memory of 1004 3324 btttnn.exe 89 PID 3324 wrote to memory of 1004 3324 btttnn.exe 89 PID 1004 wrote to memory of 1832 1004 nbhbbb.exe 90 PID 1004 wrote to memory of 1832 1004 nbhbbb.exe 90 PID 1004 wrote to memory of 1832 1004 nbhbbb.exe 90 PID 1832 wrote to memory of 2696 1832 lxrfrrl.exe 92 PID 1832 wrote to memory of 2696 1832 lxrfrrl.exe 92 PID 1832 wrote to memory of 2696 1832 lxrfrrl.exe 92 PID 2696 wrote to memory of 2880 2696 vpvpd.exe 93 PID 2696 wrote to memory of 2880 2696 vpvpd.exe 93 PID 2696 wrote to memory of 2880 2696 vpvpd.exe 93 PID 2880 wrote to memory of 2292 2880 jddvj.exe 94 PID 2880 wrote to memory of 2292 2880 jddvj.exe 94 PID 2880 wrote to memory of 2292 2880 jddvj.exe 94 PID 2292 wrote to memory of 1456 2292 rxrlxxl.exe 95 PID 2292 wrote to memory of 1456 2292 rxrlxxl.exe 95 PID 2292 wrote to memory of 1456 2292 rxrlxxl.exe 95 PID 1456 wrote to memory of 1204 1456 xrxlllr.exe 96 PID 1456 wrote to memory of 1204 1456 xrxlllr.exe 96 PID 1456 wrote to memory of 1204 1456 xrxlllr.exe 96 PID 1204 wrote to memory of 3520 1204 ntbtnn.exe 97 PID 1204 wrote to memory of 3520 1204 ntbtnn.exe 97 PID 1204 wrote to memory of 3520 1204 ntbtnn.exe 97 PID 3520 wrote to memory of 2584 3520 jdpdd.exe 98 PID 3520 wrote to memory of 2584 3520 jdpdd.exe 98 PID 3520 wrote to memory of 2584 3520 jdpdd.exe 98 PID 2584 wrote to memory of 972 2584 fxxrxrl.exe 99 PID 2584 wrote to memory of 972 2584 fxxrxrl.exe 99 PID 2584 wrote to memory of 972 2584 fxxrxrl.exe 99 PID 972 wrote to memory of 3920 972 thbtht.exe 101 PID 972 wrote to memory of 3920 972 thbtht.exe 101 PID 972 wrote to memory of 3920 972 thbtht.exe 101 PID 3920 wrote to memory of 844 3920 9tbnbb.exe 102 PID 3920 wrote to memory of 844 3920 9tbnbb.exe 102 PID 3920 wrote to memory of 844 3920 9tbnbb.exe 102 PID 844 wrote to memory of 2160 844 vvvjj.exe 103 PID 844 wrote to memory of 2160 844 vvvjj.exe 103 PID 844 wrote to memory of 2160 844 vvvjj.exe 103 PID 2160 wrote to memory of 4456 2160 lffxxrx.exe 104 PID 2160 wrote to memory of 4456 2160 lffxxrx.exe 104 PID 2160 wrote to memory of 4456 2160 lffxxrx.exe 104 PID 4456 wrote to memory of 3732 4456 httnhh.exe 105 PID 4456 wrote to memory of 3732 4456 httnhh.exe 105 PID 4456 wrote to memory of 3732 4456 httnhh.exe 105 PID 3732 wrote to memory of 3784 3732 btnhtt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606.exe"C:\Users\Admin\AppData\Local\Temp\e57609a4b411d3ed3c2da6f3d4e40c9aca19f4d8d7ec98548718a11d55a07606.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\thnnhb.exec:\thnnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\jddvv.exec:\jddvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\5nhnbt.exec:\5nhnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\jdjdv.exec:\jdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\flrlffx.exec:\flrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\btttnn.exec:\btttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\nbhbbb.exec:\nbhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\lxrfrrl.exec:\lxrfrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\vpvpd.exec:\vpvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jddvj.exec:\jddvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rxrlxxl.exec:\rxrlxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\xrxlllr.exec:\xrxlllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\ntbtnn.exec:\ntbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\jdpdd.exec:\jdpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\fxxrxrl.exec:\fxxrxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\thbtht.exec:\thbtht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\9tbnbb.exec:\9tbnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\vvvjj.exec:\vvvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\lffxxrx.exec:\lffxxrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\httnhh.exec:\httnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\btnhtt.exec:\btnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\1ppjv.exec:\1ppjv.exe23⤵
- Executes dropped EXE
PID:3784 -
\??\c:\pdvvp.exec:\pdvvp.exe24⤵
- Executes dropped EXE
PID:5084 -
\??\c:\frxlfxx.exec:\frxlfxx.exe25⤵
- Executes dropped EXE
PID:3268 -
\??\c:\xlrrrlf.exec:\xlrrrlf.exe26⤵
- Executes dropped EXE
PID:4440 -
\??\c:\nhbnnn.exec:\nhbnnn.exe27⤵
- Executes dropped EXE
PID:660 -
\??\c:\hbtnnh.exec:\hbtnnh.exe28⤵
- Executes dropped EXE
PID:1916 -
\??\c:\7jjdp.exec:\7jjdp.exe29⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jvvpv.exec:\jvvpv.exe30⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\httnhh.exec:\httnhh.exe32⤵
- Executes dropped EXE
PID:388 -
\??\c:\7hnhbb.exec:\7hnhbb.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vppjv.exec:\vppjv.exe34⤵
- Executes dropped EXE
PID:4024 -
\??\c:\3pvpp.exec:\3pvpp.exe35⤵
- Executes dropped EXE
PID:4564 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe36⤵
- Executes dropped EXE
PID:412 -
\??\c:\lrrlffx.exec:\lrrlffx.exe37⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hbbbtn.exec:\hbbbtn.exe38⤵
- Executes dropped EXE
PID:3764 -
\??\c:\nnnnbn.exec:\nnnnbn.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ttnhth.exec:\ttnhth.exe40⤵
- Executes dropped EXE
PID:3792 -
\??\c:\dddpj.exec:\dddpj.exe41⤵
- Executes dropped EXE
PID:4884 -
\??\c:\pdpjd.exec:\pdpjd.exe42⤵
- Executes dropped EXE
PID:4384 -
\??\c:\frrxrrl.exec:\frrxrrl.exe43⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3llxrlf.exec:\3llxrlf.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\5nnhtn.exec:\5nnhtn.exe45⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bnhbtt.exec:\bnhbtt.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vpjdv.exec:\vpjdv.exe47⤵
- Executes dropped EXE
PID:764 -
\??\c:\rflxxrl.exec:\rflxxrl.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe49⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1bhbtn.exec:\1bhbtn.exe50⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3nhhbt.exec:\3nhhbt.exe51⤵
- Executes dropped EXE
PID:1364 -
\??\c:\tttnhb.exec:\tttnhb.exe52⤵
- Executes dropped EXE
PID:3264 -
\??\c:\9ddvj.exec:\9ddvj.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jpvjd.exec:\jpvjd.exe54⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lxxrffr.exec:\lxxrffr.exe55⤵
- Executes dropped EXE
PID:516 -
\??\c:\lrrrllf.exec:\lrrrllf.exe56⤵
- Executes dropped EXE
PID:712 -
\??\c:\ntbbtt.exec:\ntbbtt.exe57⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hhnhtt.exec:\hhnhtt.exe58⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9vdvp.exec:\9vdvp.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5vjdj.exec:\5vjdj.exe60⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rllxllf.exec:\rllxllf.exe61⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xffrllf.exec:\xffrllf.exe62⤵
- Executes dropped EXE
PID:3340 -
\??\c:\rflrrll.exec:\rflrrll.exe63⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hntnbb.exec:\hntnbb.exe64⤵
- Executes dropped EXE
PID:1032 -
\??\c:\hbbbbh.exec:\hbbbbh.exe65⤵
- Executes dropped EXE
PID:5040 -
\??\c:\vjjdv.exec:\vjjdv.exe66⤵PID:5020
-
\??\c:\pddvj.exec:\pddvj.exe67⤵PID:4080
-
\??\c:\lxxxfxr.exec:\lxxxfxr.exe68⤵PID:1556
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe69⤵PID:1844
-
\??\c:\nbbtnh.exec:\nbbtnh.exe70⤵PID:1632
-
\??\c:\tthbnn.exec:\tthbnn.exe71⤵PID:4592
-
\??\c:\pvddj.exec:\pvddj.exe72⤵PID:700
-
\??\c:\jppjv.exec:\jppjv.exe73⤵PID:1184
-
\??\c:\vjjvp.exec:\vjjvp.exe74⤵PID:2464
-
\??\c:\lrxrxxr.exec:\lrxrxxr.exe75⤵PID:1156
-
\??\c:\xxxlflx.exec:\xxxlflx.exe76⤵PID:2348
-
\??\c:\nhhbtt.exec:\nhhbtt.exe77⤵PID:1256
-
\??\c:\nhbnhb.exec:\nhbnhb.exe78⤵PID:4968
-
\??\c:\vvvpp.exec:\vvvpp.exe79⤵PID:2000
-
\??\c:\jjjdj.exec:\jjjdj.exe80⤵PID:2244
-
\??\c:\1lrrxxx.exec:\1lrrxxx.exe81⤵PID:3104
-
\??\c:\xxrrllf.exec:\xxrrllf.exe82⤵PID:1228
-
\??\c:\5nnhtt.exec:\5nnhtt.exe83⤵PID:1552
-
\??\c:\bttnnn.exec:\bttnnn.exe84⤵PID:2388
-
\??\c:\jdvpd.exec:\jdvpd.exe85⤵PID:944
-
\??\c:\vjvpv.exec:\vjvpv.exe86⤵PID:2568
-
\??\c:\xllxrxl.exec:\xllxrxl.exe87⤵PID:1924
-
\??\c:\5frllll.exec:\5frllll.exe88⤵PID:2380
-
\??\c:\7bhbtt.exec:\7bhbtt.exe89⤵PID:1908
-
\??\c:\htbhtt.exec:\htbhtt.exe90⤵PID:4444
-
\??\c:\vdjdp.exec:\vdjdp.exe91⤵PID:1172
-
\??\c:\vpjdv.exec:\vpjdv.exe92⤵PID:3116
-
\??\c:\jdddv.exec:\jdddv.exe93⤵PID:244
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe94⤵PID:116
-
\??\c:\3flfxxr.exec:\3flfxxr.exe95⤵PID:2404
-
\??\c:\bhhnnh.exec:\bhhnnh.exe96⤵PID:1376
-
\??\c:\hbhhbh.exec:\hbhhbh.exe97⤵PID:2276
-
\??\c:\1ddvv.exec:\1ddvv.exe98⤵PID:4812
-
\??\c:\frlfxrl.exec:\frlfxrl.exe99⤵PID:5052
-
\??\c:\tnnhhb.exec:\tnnhhb.exe100⤵PID:2124
-
\??\c:\9nbttn.exec:\9nbttn.exe101⤵PID:720
-
\??\c:\vpvpj.exec:\vpvpj.exe102⤵PID:3852
-
\??\c:\dpjjd.exec:\dpjjd.exe103⤵PID:3504
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe104⤵PID:3396
-
\??\c:\rlfllrl.exec:\rlfllrl.exe105⤵PID:1492
-
\??\c:\tbntnn.exec:\tbntnn.exe106⤵PID:1828
-
\??\c:\tntttn.exec:\tntttn.exe107⤵PID:4356
-
\??\c:\pjjdv.exec:\pjjdv.exe108⤵PID:1200
-
\??\c:\pjjdj.exec:\pjjdj.exe109⤵PID:3640
-
\??\c:\frrlxxx.exec:\frrlxxx.exe110⤵PID:2440
-
\??\c:\5fxfxxr.exec:\5fxfxxr.exe111⤵PID:3720
-
\??\c:\7ttnbb.exec:\7ttnbb.exe112⤵PID:3700
-
\??\c:\hhtbbh.exec:\hhtbbh.exe113⤵PID:4596
-
\??\c:\5hhhht.exec:\5hhhht.exe114⤵PID:1396
-
\??\c:\vvpjd.exec:\vvpjd.exe115⤵PID:756
-
\??\c:\dpdvj.exec:\dpdvj.exe116⤵PID:2644
-
\??\c:\xlrfrrr.exec:\xlrfrrr.exe117⤵PID:452
-
\??\c:\lfllffr.exec:\lfllffr.exe118⤵PID:2816
-
\??\c:\btbnhn.exec:\btbnhn.exe119⤵PID:3236
-
\??\c:\nntnhh.exec:\nntnhh.exe120⤵PID:1604
-
\??\c:\pjpjv.exec:\pjpjv.exe121⤵PID:2044
-
\??\c:\jpdpj.exec:\jpdpj.exe122⤵PID:544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-