Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 02:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f.exe
-
Size
72KB
-
MD5
d0cd7c87aa7f20693d2c73dcea19c322
-
SHA1
752c665900a2c832e942d572305eeec174722c7c
-
SHA256
c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f
-
SHA512
b7d2653d0b1cd61833b758cffb0afe5ac9fecc997880eb65048ac05890b4eb13762c40af8d8991b180356158fdb1a7c5883824d2d02250c648cc17cb7fb35550
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgyYrasMa:ymb3NkkiQ3mdBjFo73thYus7
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2656-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-38-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-832-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 33 IoCs
resource yara_rule behavioral2/memory/2656-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1788-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2452-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2976-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1972-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/804-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4588-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4460-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4460-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4460-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2852-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3064-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2412-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4812-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1264-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1840-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3852-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1272-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1600-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1900-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3880-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1060-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3292-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1788 vdjvd.exe 2452 5rrfxrl.exe 2976 ttthtn.exe 5056 vpjvd.exe 1972 lrfrfxr.exe 404 xlfrfxl.exe 804 9ppdv.exe 4588 5xlxrfr.exe 4540 bhbhbh.exe 4460 dppjp.exe 2852 fxxllfx.exe 3632 rffxlxl.exe 5028 bhhtnn.exe 5036 dppdv.exe 3064 vjvjv.exe 2412 flfrlxr.exe 4812 nhhbbb.exe 1264 jpjdj.exe 1840 jdpdj.exe 3852 lxrfrlx.exe 2320 hnnbtn.exe 1272 pddpd.exe 1600 flfrfxl.exe 2720 lffxfff.exe 1792 bbhtbh.exe 1900 pdvpd.exe 4056 vjjjp.exe 3880 frfrfxl.exe 3924 tnbthb.exe 1060 ttnhth.exe 3292 pvvjp.exe 4560 vvvvj.exe 4940 1lfxrrr.exe 4872 nnttbb.exe 1776 nnnbtt.exe 2188 5vpjp.exe 4928 vppjv.exe 4336 1rlfrlf.exe 2656 frlxrfr.exe 2688 3tnhnh.exe 3040 vjpjd.exe 2452 7pdpv.exe 3264 xlrxlxr.exe 5056 rfxrfrr.exe 4792 bnbttn.exe 3464 5nnbbb.exe 5104 vpvvd.exe 4612 3dvjp.exe 4588 frrxfxl.exe 4492 ffflffl.exe 4376 hthhbt.exe 5072 thbthb.exe 1916 ththtt.exe 4284 vjpdj.exe 4156 flrxlxl.exe 3664 3rrfrrl.exe 3028 nhbhtb.exe 5036 nbttht.exe 1440 jvvvp.exe 4092 jdppv.exe 2572 fxxxxxf.exe 5024 nhnhhb.exe 2712 nbbhhh.exe 744 3ddvv.exe -
resource yara_rule behavioral2/memory/2656-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 1788 2656 c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f.exe 82 PID 2656 wrote to memory of 1788 2656 c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f.exe 82 PID 2656 wrote to memory of 1788 2656 c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f.exe 82 PID 1788 wrote to memory of 2452 1788 vdjvd.exe 83 PID 1788 wrote to memory of 2452 1788 vdjvd.exe 83 PID 1788 wrote to memory of 2452 1788 vdjvd.exe 83 PID 2452 wrote to memory of 2976 2452 5rrfxrl.exe 84 PID 2452 wrote to memory of 2976 2452 5rrfxrl.exe 84 PID 2452 wrote to memory of 2976 2452 5rrfxrl.exe 84 PID 2976 wrote to memory of 5056 2976 ttthtn.exe 85 PID 2976 wrote to memory of 5056 2976 ttthtn.exe 85 PID 2976 wrote to memory of 5056 2976 ttthtn.exe 85 PID 5056 wrote to memory of 1972 5056 vpjvd.exe 86 PID 5056 wrote to memory of 1972 5056 vpjvd.exe 86 PID 5056 wrote to memory of 1972 5056 vpjvd.exe 86 PID 1972 wrote to memory of 404 1972 lrfrfxr.exe 87 PID 1972 wrote to memory of 404 1972 lrfrfxr.exe 87 PID 1972 wrote to memory of 404 1972 lrfrfxr.exe 87 PID 404 wrote to memory of 804 404 xlfrfxl.exe 88 PID 404 wrote to memory of 804 404 xlfrfxl.exe 88 PID 404 wrote to memory of 804 404 xlfrfxl.exe 88 PID 804 wrote to memory of 4588 804 9ppdv.exe 89 PID 804 wrote to memory of 4588 804 9ppdv.exe 89 PID 804 wrote to memory of 4588 804 9ppdv.exe 89 PID 4588 wrote to memory of 4540 4588 5xlxrfr.exe 90 PID 4588 wrote to memory of 4540 4588 5xlxrfr.exe 90 PID 4588 wrote to memory of 4540 4588 5xlxrfr.exe 90 PID 4540 wrote to memory of 4460 4540 bhbhbh.exe 91 PID 4540 wrote to memory of 4460 4540 bhbhbh.exe 91 PID 4540 wrote to memory of 4460 4540 bhbhbh.exe 91 PID 4460 wrote to memory of 2852 4460 dppjp.exe 92 PID 4460 wrote to memory of 2852 4460 dppjp.exe 92 PID 4460 wrote to memory of 2852 4460 dppjp.exe 92 PID 2852 wrote to memory of 3632 2852 fxxllfx.exe 94 PID 2852 wrote to memory of 3632 2852 fxxllfx.exe 94 PID 2852 wrote to memory of 3632 2852 fxxllfx.exe 94 PID 3632 wrote to memory of 5028 3632 rffxlxl.exe 95 PID 3632 wrote to memory of 5028 3632 rffxlxl.exe 95 PID 3632 wrote to memory of 5028 3632 rffxlxl.exe 95 PID 5028 wrote to memory of 5036 5028 bhhtnn.exe 96 PID 5028 wrote to memory of 5036 5028 bhhtnn.exe 96 PID 5028 wrote to memory of 5036 5028 bhhtnn.exe 96 PID 5036 wrote to memory of 3064 5036 dppdv.exe 97 PID 5036 wrote to memory of 3064 5036 dppdv.exe 97 PID 5036 wrote to memory of 3064 5036 dppdv.exe 97 PID 3064 wrote to memory of 2412 3064 vjvjv.exe 98 PID 3064 wrote to memory of 2412 3064 vjvjv.exe 98 PID 3064 wrote to memory of 2412 3064 vjvjv.exe 98 PID 2412 wrote to memory of 4812 2412 flfrlxr.exe 99 PID 2412 wrote to memory of 4812 2412 flfrlxr.exe 99 PID 2412 wrote to memory of 4812 2412 flfrlxr.exe 99 PID 4812 wrote to memory of 1264 4812 nhhbbb.exe 100 PID 4812 wrote to memory of 1264 4812 nhhbbb.exe 100 PID 4812 wrote to memory of 1264 4812 nhhbbb.exe 100 PID 1264 wrote to memory of 1840 1264 jpjdj.exe 101 PID 1264 wrote to memory of 1840 1264 jpjdj.exe 101 PID 1264 wrote to memory of 1840 1264 jpjdj.exe 101 PID 1840 wrote to memory of 3852 1840 jdpdj.exe 103 PID 1840 wrote to memory of 3852 1840 jdpdj.exe 103 PID 1840 wrote to memory of 3852 1840 jdpdj.exe 103 PID 3852 wrote to memory of 2320 3852 lxrfrlx.exe 104 PID 3852 wrote to memory of 2320 3852 lxrfrlx.exe 104 PID 3852 wrote to memory of 2320 3852 lxrfrlx.exe 104 PID 2320 wrote to memory of 1272 2320 hnnbtn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f.exe"C:\Users\Admin\AppData\Local\Temp\c97bcf040146b11be8fa10433e94db473024d9104581512f0f99753e8a13b11f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vdjvd.exec:\vdjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\5rrfxrl.exec:\5rrfxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ttthtn.exec:\ttthtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vpjvd.exec:\vpjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\lrfrfxr.exec:\lrfrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\9ppdv.exec:\9ppdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\5xlxrfr.exec:\5xlxrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\bhbhbh.exec:\bhbhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\dppjp.exec:\dppjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\fxxllfx.exec:\fxxllfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rffxlxl.exec:\rffxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\bhhtnn.exec:\bhhtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\dppdv.exec:\dppdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\vjvjv.exec:\vjvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\flfrlxr.exec:\flfrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\nhhbbb.exec:\nhhbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\jpjdj.exec:\jpjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\jdpdj.exec:\jdpdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\hnnbtn.exec:\hnnbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\pddpd.exec:\pddpd.exe23⤵
- Executes dropped EXE
PID:1272 -
\??\c:\flfrfxl.exec:\flfrfxl.exe24⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lffxfff.exec:\lffxfff.exe25⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bbhtbh.exec:\bbhtbh.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pdvpd.exec:\pdvpd.exe27⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vjjjp.exec:\vjjjp.exe28⤵
- Executes dropped EXE
PID:4056 -
\??\c:\frfrfxl.exec:\frfrfxl.exe29⤵
- Executes dropped EXE
PID:3880 -
\??\c:\tnbthb.exec:\tnbthb.exe30⤵
- Executes dropped EXE
PID:3924 -
\??\c:\ttnhth.exec:\ttnhth.exe31⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pvvjp.exec:\pvvjp.exe32⤵
- Executes dropped EXE
PID:3292 -
\??\c:\vvvvj.exec:\vvvvj.exe33⤵
- Executes dropped EXE
PID:4560 -
\??\c:\1lfxrrr.exec:\1lfxrrr.exe34⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nnttbb.exec:\nnttbb.exe35⤵
- Executes dropped EXE
PID:4872 -
\??\c:\nnnbtt.exec:\nnnbtt.exe36⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5vpjp.exec:\5vpjp.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vppjv.exec:\vppjv.exe38⤵
- Executes dropped EXE
PID:4928 -
\??\c:\1rlfrlf.exec:\1rlfrlf.exe39⤵
- Executes dropped EXE
PID:4336 -
\??\c:\frlxrfr.exec:\frlxrfr.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3tnhnh.exec:\3tnhnh.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vjpjd.exec:\vjpjd.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7pdpv.exec:\7pdpv.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xlrxlxr.exec:\xlrxlxr.exe44⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rfxrfrr.exec:\rfxrfrr.exe45⤵
- Executes dropped EXE
PID:5056 -
\??\c:\bnbttn.exec:\bnbttn.exe46⤵
- Executes dropped EXE
PID:4792 -
\??\c:\5nnbbb.exec:\5nnbbb.exe47⤵
- Executes dropped EXE
PID:3464 -
\??\c:\vpvvd.exec:\vpvvd.exe48⤵
- Executes dropped EXE
PID:5104 -
\??\c:\3dvjp.exec:\3dvjp.exe49⤵
- Executes dropped EXE
PID:4612 -
\??\c:\frrxfxl.exec:\frrxfxl.exe50⤵
- Executes dropped EXE
PID:4588 -
\??\c:\ffflffl.exec:\ffflffl.exe51⤵
- Executes dropped EXE
PID:4492 -
\??\c:\hthhbt.exec:\hthhbt.exe52⤵
- Executes dropped EXE
PID:4376 -
\??\c:\thbthb.exec:\thbthb.exe53⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ththtt.exec:\ththtt.exe54⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vjpdj.exec:\vjpdj.exe55⤵
- Executes dropped EXE
PID:4284 -
\??\c:\flrxlxl.exec:\flrxlxl.exe56⤵
- Executes dropped EXE
PID:4156 -
\??\c:\3rrfrrl.exec:\3rrfrrl.exe57⤵
- Executes dropped EXE
PID:3664 -
\??\c:\nhbhtb.exec:\nhbhtb.exe58⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nbttht.exec:\nbttht.exe59⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jvvvp.exec:\jvvvp.exe60⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jdppv.exec:\jdppv.exe61⤵
- Executes dropped EXE
PID:4092 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe62⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhnhhb.exec:\nhnhhb.exe63⤵
- Executes dropped EXE
PID:5024 -
\??\c:\nbbhhh.exec:\nbbhhh.exe64⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3ddvv.exec:\3ddvv.exe65⤵
- Executes dropped EXE
PID:744 -
\??\c:\jvvpd.exec:\jvvpd.exe66⤵PID:2948
-
\??\c:\jvdpv.exec:\jvdpv.exe67⤵PID:2328
-
\??\c:\rrllfxf.exec:\rrllfxf.exe68⤵PID:676
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe69⤵PID:2212
-
\??\c:\htttnn.exec:\htttnn.exe70⤵PID:1092
-
\??\c:\nhbtnt.exec:\nhbtnt.exe71⤵PID:2720
-
\??\c:\jddpv.exec:\jddpv.exe72⤵PID:1792
-
\??\c:\ddjjv.exec:\ddjjv.exe73⤵PID:2936
-
\??\c:\lxxrllf.exec:\lxxrllf.exe74⤵PID:2288
-
\??\c:\btttbb.exec:\btttbb.exe75⤵PID:432
-
\??\c:\bbbthh.exec:\bbbthh.exe76⤵PID:4168
-
\??\c:\dvddd.exec:\dvddd.exe77⤵PID:2216
-
\??\c:\jppjd.exec:\jppjd.exe78⤵PID:4352
-
\??\c:\ttnhnn.exec:\ttnhnn.exe79⤵PID:2668
-
\??\c:\nnnhbb.exec:\nnnhbb.exe80⤵PID:4560
-
\??\c:\pjpjd.exec:\pjpjd.exe81⤵PID:4940
-
\??\c:\lffxlrl.exec:\lffxlrl.exe82⤵PID:3740
-
\??\c:\jvddp.exec:\jvddp.exe83⤵PID:3336
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe84⤵PID:968
-
\??\c:\lfxxxff.exec:\lfxxxff.exe85⤵PID:3712
-
\??\c:\djjvj.exec:\djjvj.exe86⤵PID:5116
-
\??\c:\3lfrfxl.exec:\3lfrfxl.exe87⤵PID:4000
-
\??\c:\lxrlfff.exec:\lxrlfff.exe88⤵PID:672
-
\??\c:\nnhbnh.exec:\nnhbnh.exe89⤵PID:1588
-
\??\c:\vddpv.exec:\vddpv.exe90⤵PID:2880
-
\??\c:\9rlxlxr.exec:\9rlxlxr.exe91⤵PID:3312
-
\??\c:\rlfxlrl.exec:\rlfxlrl.exe92⤵PID:2556
-
\??\c:\hnbthb.exec:\hnbthb.exe93⤵PID:3004
-
\??\c:\thbntn.exec:\thbntn.exe94⤵PID:4944
-
\??\c:\jdvjv.exec:\jdvjv.exe95⤵PID:3120
-
\??\c:\3ffrlxl.exec:\3ffrlxl.exe96⤵PID:4444
-
\??\c:\tnnnbt.exec:\tnnnbt.exe97⤵PID:4256
-
\??\c:\vvdvd.exec:\vvdvd.exe98⤵PID:2764
-
\??\c:\dvvjv.exec:\dvvjv.exe99⤵PID:2856
-
\??\c:\lrrxlxf.exec:\lrrxlxf.exe100⤵PID:2852
-
\??\c:\xrrffrr.exec:\xrrffrr.exe101⤵PID:1664
-
\??\c:\9bttnh.exec:\9bttnh.exe102⤵PID:3204
-
\??\c:\thbthh.exec:\thbthh.exe103⤵PID:2316
-
\??\c:\pppdp.exec:\pppdp.exe104⤵PID:2092
-
\??\c:\vddpd.exec:\vddpd.exe105⤵PID:4340
-
\??\c:\flrlfxx.exec:\flrlfxx.exe106⤵PID:4772
-
\??\c:\nbhthb.exec:\nbhthb.exe107⤵PID:4344
-
\??\c:\9thttn.exec:\9thttn.exe108⤵PID:2644
-
\??\c:\pjpjj.exec:\pjpjj.exe109⤵PID:3796
-
\??\c:\jpddv.exec:\jpddv.exe110⤵PID:2140
-
\??\c:\lrxlffx.exec:\lrxlffx.exe111⤵PID:992
-
\??\c:\lxlxlfr.exec:\lxlxlfr.exe112⤵PID:2536
-
\??\c:\tntnnh.exec:\tntnnh.exe113⤵PID:1552
-
\??\c:\5vdpd.exec:\5vdpd.exe114⤵PID:4864
-
\??\c:\pdddp.exec:\pdddp.exe115⤵PID:624
-
\??\c:\fllfrff.exec:\fllfrff.exe116⤵PID:1896
-
\??\c:\nttnbn.exec:\nttnbn.exe117⤵PID:3940
-
\??\c:\jpjdp.exec:\jpjdp.exe118⤵PID:4196
-
\??\c:\jpjvj.exec:\jpjvj.exe119⤵PID:1020
-
\??\c:\9xrfrrl.exec:\9xrfrrl.exe120⤵PID:3268
-
\??\c:\llxrlfl.exec:\llxrlfl.exe121⤵PID:3260
-
\??\c:\9nhbnh.exec:\9nhbnh.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-