Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 01:00
Behavioral task
behavioral1
Sample
1a13eff55ff072fac7e30eda9d12fa20N.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
1a13eff55ff072fac7e30eda9d12fa20N.exe
-
Size
86KB
-
MD5
1a13eff55ff072fac7e30eda9d12fa20
-
SHA1
f520cc8173dafb435fceaf30692d30161e6ce754
-
SHA256
2d6fe53267fffdeb9bb60fcf95a1c08b1f2e9fba2553a6228c38135b2c6433fe
-
SHA512
21c3bda3fac955d8d6f1b8271dd47ac20a5252d414d6d39349c99d4a64fb84b509e02a11d705a2ef1f2ac63c132a750a80afd21037c73d2e4d6b151757291d57
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCih2QVe:zhOmTsF93UYfwC6GIoutiTU2HVS64h8
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/368-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1796-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 nhnbth.exe 1104 vpvdd.exe 3688 bbhbht.exe 2824 frxlffx.exe 872 thbnnn.exe 1796 vvddd.exe 2568 lrflfrx.exe 3336 htttnn.exe 2524 vvvpd.exe 3260 xflfxrl.exe 1908 5nhnhh.exe 4612 pvvpj.exe 4168 ffrlffx.exe 2872 9bnnbh.exe 2600 vpddp.exe 4060 9xffrff.exe 3236 ddjjj.exe 4112 3bbtnt.exe 2104 jjjvp.exe 1928 rrxxxxf.exe 2252 llxxffr.exe 1760 hhnhbb.exe 1140 vvvvp.exe 4972 rrfxlrx.exe 4360 nbnhbb.exe 968 pvdvd.exe 3692 xfrrrrr.exe 2152 nnthht.exe 4688 ppjvj.exe 4348 rlrfrlx.exe 3736 lxrflxf.exe 764 tnhbtt.exe 4376 vjvjd.exe 4020 jvpjv.exe 4736 fflllll.exe 4492 bhhnnt.exe 4212 pjvvv.exe 3176 nhnhhh.exe 2120 vpvpd.exe 2768 fxfxrxr.exe 1720 bhhhth.exe 872 bhbtbb.exe 2860 pvpjp.exe 2828 fxxrllf.exe 3464 thbtbb.exe 3336 jppdj.exe 1208 djppd.exe 5040 nhnnbh.exe 4232 jjdpj.exe 4552 rrlxfrx.exe 2736 thbtnn.exe 5052 vppjj.exe 1888 vdjjj.exe 884 xrfxfff.exe 3364 nbtnhb.exe 2600 dpjvp.exe 1628 rlxxrrx.exe 4060 tthhtn.exe 3600 bbbtnh.exe 3868 fflxxfr.exe 1488 llffllr.exe 1816 bbhtbb.exe 396 jdvdd.exe 2696 djjvp.exe -
resource yara_rule behavioral2/memory/368-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002364f-4.dat upx behavioral2/memory/368-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2664-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023652-9.dat upx behavioral2/files/0x0007000000023656-11.dat upx behavioral2/memory/1104-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3688-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023657-20.dat upx behavioral2/files/0x0007000000023658-23.dat upx behavioral2/files/0x0007000000023659-27.dat upx behavioral2/memory/872-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365a-32.dat upx behavioral2/memory/2568-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365b-37.dat upx behavioral2/memory/2568-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365c-42.dat upx behavioral2/memory/3336-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365d-47.dat upx behavioral2/memory/2524-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365e-52.dat upx behavioral2/files/0x000700000002365f-56.dat upx behavioral2/memory/1908-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4612-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023660-62.dat upx behavioral2/memory/4168-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023661-67.dat upx behavioral2/memory/2872-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023662-72.dat upx behavioral2/memory/1796-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2600-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023663-76.dat upx behavioral2/files/0x0007000000023664-82.dat upx behavioral2/memory/4060-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023653-87.dat upx behavioral2/memory/3236-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023665-92.dat upx behavioral2/files/0x0007000000023666-96.dat upx behavioral2/files/0x0007000000023667-100.dat upx behavioral2/memory/2252-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023668-105.dat upx behavioral2/files/0x0007000000023669-109.dat upx behavioral2/files/0x000700000002366a-113.dat upx behavioral2/memory/1140-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002366b-118.dat upx behavioral2/memory/4360-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002366c-122.dat upx behavioral2/files/0x000700000002366d-127.dat upx behavioral2/files/0x000700000002366e-131.dat upx behavioral2/files/0x000700000002366f-135.dat upx behavioral2/files/0x0007000000023670-139.dat upx behavioral2/memory/4688-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4348-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023671-146.dat upx behavioral2/files/0x0007000000023672-149.dat upx behavioral2/memory/3736-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4376-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4020-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4212-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3176-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1720-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2860-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3336-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4232-195-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 368 wrote to memory of 2664 368 1a13eff55ff072fac7e30eda9d12fa20N.exe 89 PID 368 wrote to memory of 2664 368 1a13eff55ff072fac7e30eda9d12fa20N.exe 89 PID 368 wrote to memory of 2664 368 1a13eff55ff072fac7e30eda9d12fa20N.exe 89 PID 2664 wrote to memory of 1104 2664 nhnbth.exe 90 PID 2664 wrote to memory of 1104 2664 nhnbth.exe 90 PID 2664 wrote to memory of 1104 2664 nhnbth.exe 90 PID 1104 wrote to memory of 3688 1104 vpvdd.exe 92 PID 1104 wrote to memory of 3688 1104 vpvdd.exe 92 PID 1104 wrote to memory of 3688 1104 vpvdd.exe 92 PID 3688 wrote to memory of 2824 3688 bbhbht.exe 93 PID 3688 wrote to memory of 2824 3688 bbhbht.exe 93 PID 3688 wrote to memory of 2824 3688 bbhbht.exe 93 PID 2824 wrote to memory of 872 2824 frxlffx.exe 95 PID 2824 wrote to memory of 872 2824 frxlffx.exe 95 PID 2824 wrote to memory of 872 2824 frxlffx.exe 95 PID 872 wrote to memory of 1796 872 thbnnn.exe 96 PID 872 wrote to memory of 1796 872 thbnnn.exe 96 PID 872 wrote to memory of 1796 872 thbnnn.exe 96 PID 1796 wrote to memory of 2568 1796 vvddd.exe 97 PID 1796 wrote to memory of 2568 1796 vvddd.exe 97 PID 1796 wrote to memory of 2568 1796 vvddd.exe 97 PID 2568 wrote to memory of 3336 2568 lrflfrx.exe 98 PID 2568 wrote to memory of 3336 2568 lrflfrx.exe 98 PID 2568 wrote to memory of 3336 2568 lrflfrx.exe 98 PID 3336 wrote to memory of 2524 3336 htttnn.exe 99 PID 3336 wrote to memory of 2524 3336 htttnn.exe 99 PID 3336 wrote to memory of 2524 3336 htttnn.exe 99 PID 2524 wrote to memory of 3260 2524 vvvpd.exe 100 PID 2524 wrote to memory of 3260 2524 vvvpd.exe 100 PID 2524 wrote to memory of 3260 2524 vvvpd.exe 100 PID 3260 wrote to memory of 1908 3260 xflfxrl.exe 101 PID 3260 wrote to memory of 1908 3260 xflfxrl.exe 101 PID 3260 wrote to memory of 1908 3260 xflfxrl.exe 101 PID 1908 wrote to memory of 4612 1908 5nhnhh.exe 102 PID 1908 wrote to memory of 4612 1908 5nhnhh.exe 102 PID 1908 wrote to memory of 4612 1908 5nhnhh.exe 102 PID 4612 wrote to memory of 4168 4612 pvvpj.exe 103 PID 4612 wrote to memory of 4168 4612 pvvpj.exe 103 PID 4612 wrote to memory of 4168 4612 pvvpj.exe 103 PID 4168 wrote to memory of 2872 4168 ffrlffx.exe 105 PID 4168 wrote to memory of 2872 4168 ffrlffx.exe 105 PID 4168 wrote to memory of 2872 4168 ffrlffx.exe 105 PID 2872 wrote to memory of 2600 2872 9bnnbh.exe 106 PID 2872 wrote to memory of 2600 2872 9bnnbh.exe 106 PID 2872 wrote to memory of 2600 2872 9bnnbh.exe 106 PID 2600 wrote to memory of 4060 2600 vpddp.exe 107 PID 2600 wrote to memory of 4060 2600 vpddp.exe 107 PID 2600 wrote to memory of 4060 2600 vpddp.exe 107 PID 4060 wrote to memory of 3236 4060 9xffrff.exe 108 PID 4060 wrote to memory of 3236 4060 9xffrff.exe 108 PID 4060 wrote to memory of 3236 4060 9xffrff.exe 108 PID 3236 wrote to memory of 4112 3236 ddjjj.exe 109 PID 3236 wrote to memory of 4112 3236 ddjjj.exe 109 PID 3236 wrote to memory of 4112 3236 ddjjj.exe 109 PID 4112 wrote to memory of 2104 4112 3bbtnt.exe 110 PID 4112 wrote to memory of 2104 4112 3bbtnt.exe 110 PID 4112 wrote to memory of 2104 4112 3bbtnt.exe 110 PID 2104 wrote to memory of 1928 2104 jjjvp.exe 111 PID 2104 wrote to memory of 1928 2104 jjjvp.exe 111 PID 2104 wrote to memory of 1928 2104 jjjvp.exe 111 PID 1928 wrote to memory of 2252 1928 rrxxxxf.exe 112 PID 1928 wrote to memory of 2252 1928 rrxxxxf.exe 112 PID 1928 wrote to memory of 2252 1928 rrxxxxf.exe 112 PID 2252 wrote to memory of 1760 2252 llxxffr.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a13eff55ff072fac7e30eda9d12fa20N.exe"C:\Users\Admin\AppData\Local\Temp\1a13eff55ff072fac7e30eda9d12fa20N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\nhnbth.exec:\nhnbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpvdd.exec:\vpvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\bbhbht.exec:\bbhbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\frxlffx.exec:\frxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\thbnnn.exec:\thbnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\vvddd.exec:\vvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\lrflfrx.exec:\lrflfrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\htttnn.exec:\htttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\vvvpd.exec:\vvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xflfxrl.exec:\xflfxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\5nhnhh.exec:\5nhnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\pvvpj.exec:\pvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\ffrlffx.exec:\ffrlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\9bnnbh.exec:\9bnnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vpddp.exec:\vpddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\9xffrff.exec:\9xffrff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\ddjjj.exec:\ddjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\3bbtnt.exec:\3bbtnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\jjjvp.exec:\jjjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\llxxffr.exec:\llxxffr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hhnhbb.exec:\hhnhbb.exe23⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vvvvp.exec:\vvvvp.exe24⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rrfxlrx.exec:\rrfxlrx.exe25⤵
- Executes dropped EXE
PID:4972 -
\??\c:\nbnhbb.exec:\nbnhbb.exe26⤵
- Executes dropped EXE
PID:4360 -
\??\c:\pvdvd.exec:\pvdvd.exe27⤵
- Executes dropped EXE
PID:968 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe28⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nnthht.exec:\nnthht.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ppjvj.exec:\ppjvj.exe30⤵
- Executes dropped EXE
PID:4688 -
\??\c:\rlrfrlx.exec:\rlrfrlx.exe31⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lxrflxf.exec:\lxrflxf.exe32⤵
- Executes dropped EXE
PID:3736 -
\??\c:\tnhbtt.exec:\tnhbtt.exe33⤵
- Executes dropped EXE
PID:764 -
\??\c:\vjvjd.exec:\vjvjd.exe34⤵
- Executes dropped EXE
PID:4376 -
\??\c:\jvpjv.exec:\jvpjv.exe35⤵
- Executes dropped EXE
PID:4020 -
\??\c:\fflllll.exec:\fflllll.exe36⤵
- Executes dropped EXE
PID:4736 -
\??\c:\bhhnnt.exec:\bhhnnt.exe37⤵
- Executes dropped EXE
PID:4492 -
\??\c:\pjvvv.exec:\pjvvv.exe38⤵
- Executes dropped EXE
PID:4212 -
\??\c:\nhnhhh.exec:\nhnhhh.exe39⤵
- Executes dropped EXE
PID:3176 -
\??\c:\vpvpd.exec:\vpvpd.exe40⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bhhhth.exec:\bhhhth.exe42⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bhbtbb.exec:\bhbtbb.exe43⤵
- Executes dropped EXE
PID:872 -
\??\c:\pvpjp.exec:\pvpjp.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fxxrllf.exec:\fxxrllf.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\thbtbb.exec:\thbtbb.exe46⤵
- Executes dropped EXE
PID:3464 -
\??\c:\jppdj.exec:\jppdj.exe47⤵
- Executes dropped EXE
PID:3336 -
\??\c:\djppd.exec:\djppd.exe48⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nhnnbh.exec:\nhnnbh.exe49⤵
- Executes dropped EXE
PID:5040 -
\??\c:\jjdpj.exec:\jjdpj.exe50⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rrlxfrx.exec:\rrlxfrx.exe51⤵
- Executes dropped EXE
PID:4552 -
\??\c:\thbtnn.exec:\thbtnn.exe52⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vppjj.exec:\vppjj.exe53⤵
- Executes dropped EXE
PID:5052 -
\??\c:\vdjjj.exec:\vdjjj.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xrfxfff.exec:\xrfxfff.exe55⤵
- Executes dropped EXE
PID:884 -
\??\c:\nbtnhb.exec:\nbtnhb.exe56⤵
- Executes dropped EXE
PID:3364 -
\??\c:\dpjvp.exec:\dpjvp.exe57⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe58⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tthhtn.exec:\tthhtn.exe59⤵
- Executes dropped EXE
PID:4060 -
\??\c:\bbbtnh.exec:\bbbtnh.exe60⤵
- Executes dropped EXE
PID:3600 -
\??\c:\fflxxfr.exec:\fflxxfr.exe61⤵
- Executes dropped EXE
PID:3868 -
\??\c:\llffllr.exec:\llffllr.exe62⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bbhtbb.exec:\bbhtbb.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdvdd.exec:\jdvdd.exe64⤵
- Executes dropped EXE
PID:396 -
\??\c:\djjvp.exec:\djjvp.exe65⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tthhbb.exec:\tthhbb.exe66⤵PID:2252
-
\??\c:\vdvjv.exec:\vdvjv.exe67⤵PID:3556
-
\??\c:\fxlffff.exec:\fxlffff.exe68⤵PID:2400
-
\??\c:\bnhbhh.exec:\bnhbhh.exe69⤵PID:2580
-
\??\c:\ddddv.exec:\ddddv.exe70⤵PID:3892
-
\??\c:\llffffl.exec:\llffffl.exe71⤵PID:2200
-
\??\c:\btnnnt.exec:\btnnnt.exe72⤵PID:1108
-
\??\c:\vpvdv.exec:\vpvdv.exe73⤵PID:3436
-
\??\c:\7xrllxf.exec:\7xrllxf.exe74⤵PID:3432
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe75⤵PID:1744
-
\??\c:\bbhbhh.exec:\bbhbhh.exe76⤵PID:1732
-
\??\c:\pvjdj.exec:\pvjdj.exe77⤵PID:4348
-
\??\c:\hhthhb.exec:\hhthhb.exe78⤵PID:736
-
\??\c:\vjjvp.exec:\vjjvp.exe79⤵PID:3736
-
\??\c:\thtbhh.exec:\thtbhh.exe80⤵PID:4468
-
\??\c:\xflrrrl.exec:\xflrrrl.exe81⤵PID:3380
-
\??\c:\llrllll.exec:\llrllll.exe82⤵PID:952
-
\??\c:\dpddd.exec:\dpddd.exe83⤵PID:368
-
\??\c:\rrrxrrr.exec:\rrrxrrr.exe84⤵PID:4736
-
\??\c:\tbbnth.exec:\tbbnth.exe85⤵PID:2996
-
\??\c:\dvjdd.exec:\dvjdd.exe86⤵PID:3564
-
\??\c:\dpvpj.exec:\dpvpj.exe87⤵PID:2628
-
\??\c:\5lrfxrx.exec:\5lrfxrx.exe88⤵PID:2120
-
\??\c:\hbhthh.exec:\hbhthh.exe89⤵PID:2768
-
\??\c:\jjjpp.exec:\jjjpp.exe90⤵PID:1720
-
\??\c:\rflxrfx.exec:\rflxrfx.exe91⤵PID:3084
-
\??\c:\thbtbh.exec:\thbtbh.exe92⤵PID:336
-
\??\c:\ththth.exec:\ththth.exe93⤵PID:2500
-
\??\c:\vdpjp.exec:\vdpjp.exe94⤵PID:3464
-
\??\c:\rrlfxff.exec:\rrlfxff.exe95⤵PID:3336
-
\??\c:\nbhbnn.exec:\nbhbnn.exe96⤵PID:1208
-
\??\c:\djppp.exec:\djppp.exe97⤵PID:3368
-
\??\c:\rlflflx.exec:\rlflflx.exe98⤵PID:4232
-
\??\c:\nbnttb.exec:\nbnttb.exe99⤵PID:636
-
\??\c:\vppdj.exec:\vppdj.exe100⤵PID:3376
-
\??\c:\dddpd.exec:\dddpd.exe101⤵PID:4560
-
\??\c:\1rxfrfr.exec:\1rxfrfr.exe102⤵PID:1864
-
\??\c:\btbbnt.exec:\btbbnt.exe103⤵PID:2184
-
\??\c:\hbnhhh.exec:\hbnhhh.exe104⤵PID:1220
-
\??\c:\dvdjj.exec:\dvdjj.exe105⤵PID:1004
-
\??\c:\ffxfrlr.exec:\ffxfrlr.exe106⤵PID:748
-
\??\c:\ttnhhb.exec:\ttnhhb.exe107⤵PID:4820
-
\??\c:\tttnhb.exec:\tttnhb.exe108⤵PID:1612
-
\??\c:\pjjdj.exec:\pjjdj.exe109⤵PID:4700
-
\??\c:\fxfffff.exec:\fxfffff.exe110⤵PID:2548
-
\??\c:\hhbntb.exec:\hhbntb.exe111⤵PID:2888
-
\??\c:\ppdjv.exec:\ppdjv.exe112⤵PID:680
-
\??\c:\lxlrffx.exec:\lxlrffx.exe113⤵PID:3128
-
\??\c:\rrxrrfr.exec:\rrxrrfr.exe114⤵PID:4328
-
\??\c:\hbhbtt.exec:\hbhbtt.exe115⤵PID:264
-
\??\c:\3jppd.exec:\3jppd.exe116⤵PID:4884
-
\??\c:\fllffxr.exec:\fllffxr.exe117⤵PID:2920
-
\??\c:\3hhbbb.exec:\3hhbbb.exe118⤵PID:184
-
\??\c:\ppjdp.exec:\ppjdp.exe119⤵PID:712
-
\??\c:\hbthtn.exec:\hbthtn.exe120⤵PID:4508
-
\??\c:\ddddd.exec:\ddddd.exe121⤵PID:3604
-
\??\c:\htbhnn.exec:\htbhnn.exe122⤵PID:4224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-