Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a.exe
-
Size
229KB
-
MD5
3262ccdb247c8c37b27cd50c2635a9c7
-
SHA1
10be05e5090125771aeca98253a2a8069ca21742
-
SHA256
fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a
-
SHA512
10497b6f527fe5d40fe06c7fd03970eae2cef3ce79ad583372adf4c7d2f09f3fcc037ddf26bdcb519536cfd780383d4375242173e1c10cb90c8534df915ef001
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1N:n3C9BRo7MlrWKo+lxKk1N
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3272-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral2/memory/3272-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3148-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4812-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/220-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1328-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4620-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/748-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2876-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1744-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4692-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2892-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2304-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/872-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3604-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3044-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3904-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1968-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2928-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2576-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2216-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3184-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/208-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3148 btnhbb.exe 4812 5dvpj.exe 208 9fffrlf.exe 1732 lxfrfxr.exe 220 btbtbb.exe 3184 vjddp.exe 2216 vjjjj.exe 744 lffrxfl.exe 2576 fxlffxr.exe 2928 nnhtth.exe 1968 9ttnbt.exe 3904 jdjjj.exe 3044 jdvjd.exe 3604 ffllffx.exe 1328 ffflffr.exe 1964 nhhhnn.exe 1080 pjjdp.exe 872 ppvpd.exe 2304 xlrlxrl.exe 3544 frlxrrl.exe 2892 bnnhbb.exe 2344 nhbbbb.exe 5068 vvpjp.exe 4692 vddvj.exe 1744 llfxxrl.exe 2876 rrfrxxx.exe 748 bnhnht.exe 3120 hntnhh.exe 4548 7jjdv.exe 4620 pjppp.exe 3424 xrlfrrl.exe 4420 fxfxxxf.exe 4184 nbhhbb.exe 2488 vjjpd.exe 1420 djdpj.exe 2112 1lfxfxl.exe 4680 rffxrlf.exe 3064 thnbtt.exe 1036 7tnbnb.exe 1200 dpjvp.exe 2520 vvjdp.exe 4352 xffxfxr.exe 4972 hntnhh.exe 1944 ttbbtn.exe 1020 pjjdv.exe 2264 pjvpv.exe 1004 xflfxrr.exe 4008 lrrlffx.exe 2976 hbbbtt.exe 4724 jdjdv.exe 1236 vppdp.exe 4164 xrxlxxr.exe 4488 frrrrrl.exe 100 bththb.exe 1892 pjjdd.exe 1032 ffxxrxx.exe 1960 nhbtbb.exe 3160 djjjd.exe 2104 7lflxxf.exe 3244 ntttbh.exe 3604 9vjdv.exe 2528 5jdpd.exe 1964 xrrfxxx.exe 3716 7hhbbb.exe -
resource yara_rule behavioral2/memory/3272-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-25-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3272 wrote to memory of 3148 3272 fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a.exe 81 PID 3272 wrote to memory of 3148 3272 fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a.exe 81 PID 3272 wrote to memory of 3148 3272 fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a.exe 81 PID 3148 wrote to memory of 4812 3148 btnhbb.exe 82 PID 3148 wrote to memory of 4812 3148 btnhbb.exe 82 PID 3148 wrote to memory of 4812 3148 btnhbb.exe 82 PID 4812 wrote to memory of 208 4812 5dvpj.exe 83 PID 4812 wrote to memory of 208 4812 5dvpj.exe 83 PID 4812 wrote to memory of 208 4812 5dvpj.exe 83 PID 208 wrote to memory of 1732 208 9fffrlf.exe 84 PID 208 wrote to memory of 1732 208 9fffrlf.exe 84 PID 208 wrote to memory of 1732 208 9fffrlf.exe 84 PID 1732 wrote to memory of 220 1732 lxfrfxr.exe 85 PID 1732 wrote to memory of 220 1732 lxfrfxr.exe 85 PID 1732 wrote to memory of 220 1732 lxfrfxr.exe 85 PID 220 wrote to memory of 3184 220 btbtbb.exe 86 PID 220 wrote to memory of 3184 220 btbtbb.exe 86 PID 220 wrote to memory of 3184 220 btbtbb.exe 86 PID 3184 wrote to memory of 2216 3184 vjddp.exe 87 PID 3184 wrote to memory of 2216 3184 vjddp.exe 87 PID 3184 wrote to memory of 2216 3184 vjddp.exe 87 PID 2216 wrote to memory of 744 2216 vjjjj.exe 88 PID 2216 wrote to memory of 744 2216 vjjjj.exe 88 PID 2216 wrote to memory of 744 2216 vjjjj.exe 88 PID 744 wrote to memory of 2576 744 lffrxfl.exe 89 PID 744 wrote to memory of 2576 744 lffrxfl.exe 89 PID 744 wrote to memory of 2576 744 lffrxfl.exe 89 PID 2576 wrote to memory of 2928 2576 fxlffxr.exe 90 PID 2576 wrote to memory of 2928 2576 fxlffxr.exe 90 PID 2576 wrote to memory of 2928 2576 fxlffxr.exe 90 PID 2928 wrote to memory of 1968 2928 nnhtth.exe 91 PID 2928 wrote to memory of 1968 2928 nnhtth.exe 91 PID 2928 wrote to memory of 1968 2928 nnhtth.exe 91 PID 1968 wrote to memory of 3904 1968 9ttnbt.exe 92 PID 1968 wrote to memory of 3904 1968 9ttnbt.exe 92 PID 1968 wrote to memory of 3904 1968 9ttnbt.exe 92 PID 3904 wrote to memory of 3044 3904 jdjjj.exe 93 PID 3904 wrote to memory of 3044 3904 jdjjj.exe 93 PID 3904 wrote to memory of 3044 3904 jdjjj.exe 93 PID 3044 wrote to memory of 3604 3044 jdvjd.exe 141 PID 3044 wrote to memory of 3604 3044 jdvjd.exe 141 PID 3044 wrote to memory of 3604 3044 jdvjd.exe 141 PID 3604 wrote to memory of 1328 3604 ffllffx.exe 95 PID 3604 wrote to memory of 1328 3604 ffllffx.exe 95 PID 3604 wrote to memory of 1328 3604 ffllffx.exe 95 PID 1328 wrote to memory of 1964 1328 ffflffr.exe 143 PID 1328 wrote to memory of 1964 1328 ffflffr.exe 143 PID 1328 wrote to memory of 1964 1328 ffflffr.exe 143 PID 1964 wrote to memory of 1080 1964 nhhhnn.exe 97 PID 1964 wrote to memory of 1080 1964 nhhhnn.exe 97 PID 1964 wrote to memory of 1080 1964 nhhhnn.exe 97 PID 1080 wrote to memory of 872 1080 pjjdp.exe 98 PID 1080 wrote to memory of 872 1080 pjjdp.exe 98 PID 1080 wrote to memory of 872 1080 pjjdp.exe 98 PID 872 wrote to memory of 2304 872 ppvpd.exe 99 PID 872 wrote to memory of 2304 872 ppvpd.exe 99 PID 872 wrote to memory of 2304 872 ppvpd.exe 99 PID 2304 wrote to memory of 3544 2304 xlrlxrl.exe 100 PID 2304 wrote to memory of 3544 2304 xlrlxrl.exe 100 PID 2304 wrote to memory of 3544 2304 xlrlxrl.exe 100 PID 3544 wrote to memory of 2892 3544 frlxrrl.exe 148 PID 3544 wrote to memory of 2892 3544 frlxrrl.exe 148 PID 3544 wrote to memory of 2892 3544 frlxrrl.exe 148 PID 2892 wrote to memory of 2344 2892 bnnhbb.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a.exe"C:\Users\Admin\AppData\Local\Temp\fc24043979b90443f4707c6ab71b284fe7e563ac61ad3dc972b8a4b053522b8a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\btnhbb.exec:\btnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\5dvpj.exec:\5dvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\9fffrlf.exec:\9fffrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\lxfrfxr.exec:\lxfrfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\btbtbb.exec:\btbtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\vjddp.exec:\vjddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\vjjjj.exec:\vjjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\lffrxfl.exec:\lffrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\fxlffxr.exec:\fxlffxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nnhtth.exec:\nnhtth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\9ttnbt.exec:\9ttnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jdjjj.exec:\jdjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\jdvjd.exec:\jdvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ffllffx.exec:\ffllffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ffflffr.exec:\ffflffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\nhhhnn.exec:\nhhhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\pjjdp.exec:\pjjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\ppvpd.exec:\ppvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\xlrlxrl.exec:\xlrlxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\frlxrrl.exec:\frlxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\bnnhbb.exec:\bnnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nhbbbb.exec:\nhbbbb.exe23⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vvpjp.exec:\vvpjp.exe24⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vddvj.exec:\vddvj.exe25⤵
- Executes dropped EXE
PID:4692 -
\??\c:\llfxxrl.exec:\llfxxrl.exe26⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rrfrxxx.exec:\rrfrxxx.exe27⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bnhnht.exec:\bnhnht.exe28⤵
- Executes dropped EXE
PID:748 -
\??\c:\hntnhh.exec:\hntnhh.exe29⤵
- Executes dropped EXE
PID:3120 -
\??\c:\7jjdv.exec:\7jjdv.exe30⤵
- Executes dropped EXE
PID:4548 -
\??\c:\pjppp.exec:\pjppp.exe31⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe32⤵
- Executes dropped EXE
PID:3424 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe33⤵
- Executes dropped EXE
PID:4420 -
\??\c:\nbhhbb.exec:\nbhhbb.exe34⤵
- Executes dropped EXE
PID:4184 -
\??\c:\vjjpd.exec:\vjjpd.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\djdpj.exec:\djdpj.exe36⤵
- Executes dropped EXE
PID:1420 -
\??\c:\1lfxfxl.exec:\1lfxfxl.exe37⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rffxrlf.exec:\rffxrlf.exe38⤵
- Executes dropped EXE
PID:4680 -
\??\c:\thnbtt.exec:\thnbtt.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7tnbnb.exec:\7tnbnb.exe40⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dpjvp.exec:\dpjvp.exe41⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vvjdp.exec:\vvjdp.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xffxfxr.exec:\xffxfxr.exe43⤵
- Executes dropped EXE
PID:4352 -
\??\c:\hntnhh.exec:\hntnhh.exe44⤵
- Executes dropped EXE
PID:4972 -
\??\c:\ttbbtn.exec:\ttbbtn.exe45⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pjjdv.exec:\pjjdv.exe46⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pjvpv.exec:\pjvpv.exe47⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xflfxrr.exec:\xflfxrr.exe48⤵
- Executes dropped EXE
PID:1004 -
\??\c:\lrrlffx.exec:\lrrlffx.exe49⤵
- Executes dropped EXE
PID:4008 -
\??\c:\hbbbtt.exec:\hbbbtt.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jdjdv.exec:\jdjdv.exe51⤵
- Executes dropped EXE
PID:4724 -
\??\c:\vppdp.exec:\vppdp.exe52⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xrxlxxr.exec:\xrxlxxr.exe53⤵
- Executes dropped EXE
PID:4164 -
\??\c:\frrrrrl.exec:\frrrrrl.exe54⤵
- Executes dropped EXE
PID:4488 -
\??\c:\bththb.exec:\bththb.exe55⤵
- Executes dropped EXE
PID:100 -
\??\c:\pjjdd.exec:\pjjdd.exe56⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nhbtbb.exec:\nhbtbb.exe58⤵
- Executes dropped EXE
PID:1960 -
\??\c:\djjjd.exec:\djjjd.exe59⤵
- Executes dropped EXE
PID:3160 -
\??\c:\7lflxxf.exec:\7lflxxf.exe60⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ntttbh.exec:\ntttbh.exe61⤵
- Executes dropped EXE
PID:3244 -
\??\c:\9vjdv.exec:\9vjdv.exe62⤵
- Executes dropped EXE
PID:3604 -
\??\c:\5jdpd.exec:\5jdpd.exe63⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xrrfxxx.exec:\xrrfxxx.exe64⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7hhbbb.exec:\7hhbbb.exe65⤵
- Executes dropped EXE
PID:3716 -
\??\c:\dvpdv.exec:\dvpdv.exe66⤵PID:5004
-
\??\c:\lfrrfff.exec:\lfrrfff.exe67⤵PID:2692
-
\??\c:\tbhhbb.exec:\tbhhbb.exe68⤵PID:4940
-
\??\c:\vpvvd.exec:\vpvvd.exe69⤵PID:2892
-
\??\c:\llxxflf.exec:\llxxflf.exe70⤵PID:3548
-
\??\c:\7hhntt.exec:\7hhntt.exe71⤵PID:4156
-
\??\c:\djpjv.exec:\djpjv.exe72⤵PID:2348
-
\??\c:\rlfxrll.exec:\rlfxrll.exe73⤵PID:1744
-
\??\c:\btbbnn.exec:\btbbnn.exe74⤵PID:2420
-
\??\c:\dpvjd.exec:\dpvjd.exe75⤵PID:1868
-
\??\c:\lxffflr.exec:\lxffflr.exe76⤵PID:2196
-
\??\c:\vvpdp.exec:\vvpdp.exe77⤵PID:1460
-
\??\c:\rlxfxrx.exec:\rlxfxrx.exe78⤵PID:2456
-
\??\c:\tnbbhb.exec:\tnbbhb.exe79⤵PID:3760
-
\??\c:\xffxrll.exec:\xffxrll.exe80⤵PID:812
-
\??\c:\tnnttn.exec:\tnnttn.exe81⤵PID:2124
-
\??\c:\dvpjd.exec:\dvpjd.exe82⤵PID:1040
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe83⤵PID:3612
-
\??\c:\lrlfrll.exec:\lrlfrll.exe84⤵PID:2112
-
\??\c:\pjjdd.exec:\pjjdd.exe85⤵PID:2952
-
\??\c:\3flfrrr.exec:\3flfrrr.exe86⤵PID:1856
-
\??\c:\hhnhbb.exec:\hhnhbb.exe87⤵PID:3252
-
\??\c:\5vppd.exec:\5vppd.exe88⤵PID:1480
-
\??\c:\nhhbbt.exec:\nhhbbt.exe89⤵PID:3084
-
\??\c:\pjdvp.exec:\pjdvp.exe90⤵PID:4200
-
\??\c:\hnhnht.exec:\hnhnht.exe91⤵PID:2520
-
\??\c:\pjdjj.exec:\pjdjj.exe92⤵PID:1516
-
\??\c:\btbtnn.exec:\btbtnn.exe93⤵PID:4364
-
\??\c:\pjvvj.exec:\pjvvj.exe94⤵PID:5104
-
\??\c:\5llfxrl.exec:\5llfxrl.exe95⤵PID:2072
-
\??\c:\nthbtb.exec:\nthbtb.exe96⤵PID:2264
-
\??\c:\dvvpd.exec:\dvvpd.exe97⤵PID:5036
-
\??\c:\5vjjj.exec:\5vjjj.exe98⤵PID:1916
-
\??\c:\fxrffxl.exec:\fxrffxl.exe99⤵PID:2492
-
\??\c:\hnthtt.exec:\hnthtt.exe100⤵PID:2432
-
\??\c:\jvddd.exec:\jvddd.exe101⤵PID:2108
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe102⤵PID:2976
-
\??\c:\hbhhhb.exec:\hbhhhb.exe103⤵PID:4740
-
\??\c:\xlffxrx.exec:\xlffxrx.exe104⤵PID:3748
-
\??\c:\nbbtnh.exec:\nbbtnh.exe105⤵PID:2144
-
\??\c:\7vdvv.exec:\7vdvv.exe106⤵PID:2644
-
\??\c:\nnhhhh.exec:\nnhhhh.exe107⤵PID:4512
-
\??\c:\vdjjp.exec:\vdjjp.exe108⤵PID:4164
-
\??\c:\xfrlllr.exec:\xfrlllr.exe109⤵PID:1872
-
\??\c:\9rxrrfl.exec:\9rxrrfl.exe110⤵PID:4288
-
\??\c:\tnbbhh.exec:\tnbbhh.exe111⤵PID:836
-
\??\c:\vjvpj.exec:\vjvpj.exe112⤵PID:4432
-
\??\c:\vdjjd.exec:\vdjjd.exe113⤵PID:5064
-
\??\c:\5xxrffx.exec:\5xxrffx.exe114⤵PID:3248
-
\??\c:\ntnthh.exec:\ntnthh.exe115⤵PID:4028
-
\??\c:\ntbtnn.exec:\ntbtnn.exe116⤵PID:4768
-
\??\c:\ddvdp.exec:\ddvdp.exe117⤵PID:2256
-
\??\c:\xfrlllx.exec:\xfrlllx.exe118⤵PID:4820
-
\??\c:\nbhbbb.exec:\nbhbbb.exe119⤵PID:4020
-
\??\c:\jddvv.exec:\jddvv.exe120⤵PID:2496
-
\??\c:\pdddd.exec:\pdddd.exe121⤵PID:4772
-
\??\c:\9xfxxfr.exec:\9xfxxfr.exe122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-