Analysis
-
max time kernel
120s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 03:39
Behavioral task
behavioral1
Sample
74844d94aa0f8fc8941ebed5f4fcc5e0N.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
120 seconds
General
-
Target
74844d94aa0f8fc8941ebed5f4fcc5e0N.exe
-
Size
404KB
-
MD5
74844d94aa0f8fc8941ebed5f4fcc5e0
-
SHA1
5ae6013bf6ccbd15a0043c81fd1a564a72b7d5b1
-
SHA256
6e427cbbeffd5c03c51b00d19c53cd23604edaeaeb384a2db33b56b495835fa0
-
SHA512
2df58a9a1edb8cb2cbbb469d178d230bf844e915402f267e9f407941d19efd7260d4b22247e369b39d837471cfcdc1ee5000722dd7b724250c7dca0ff7b3f29d
-
SSDEEP
6144:kcm4FmowdHoSph3Ymu8wdHoSM05d34iWRbzami3x:y4wFHoS3zuxHoSTd34iWRhiB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/980-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-959-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-1192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-1211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-1215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-1291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3228 vjjdp.exe 2912 dvjjj.exe 668 frrfxfr.exe 2272 llfxllx.exe 4792 9tnhbb.exe 1980 9lfxlrr.exe 220 bbnhbt.exe 5016 1djvv.exe 3720 rxrlffx.exe 2504 xllffff.exe 3056 frlffxl.exe 5084 vjdvj.exe 2748 bhtttb.exe 3048 fffxrlf.exe 2692 nthtnn.exe 1868 vvjdv.exe 5096 rflfrlx.exe 4312 nhbnhn.exe 4504 fflfxrr.exe 3004 bnhbtn.exe 1664 xrrrrrr.exe 3428 xflxrlf.exe 4920 djppj.exe 2704 rffxrlf.exe 2200 bhbtbt.exe 3220 lflrxrx.exe 1848 tttnhh.exe 4488 lxxrfff.exe 820 nhthhh.exe 4516 pjpjd.exe 1944 ntnhbb.exe 2220 lrfxxxx.exe 1956 fxrrlfx.exe 3704 bntnhb.exe 4380 tntnbb.exe 772 dvpjd.exe 4944 frrlxrl.exe 4420 tbhbhb.exe 1524 3ddvv.exe 4604 frrlffx.exe 4372 3jdpd.exe 4568 vjjvj.exe 1488 5llfrxr.exe 2272 vvjjj.exe 1908 rrxxlfx.exe 4044 htthbb.exe 4240 vvpjv.exe 5020 rxfrfxr.exe 4988 rfllfxr.exe 3208 nnhbnh.exe 3976 3dvpd.exe 3644 lfffffx.exe 1800 5llfxrl.exe 3308 btnnhn.exe 2308 1ppdd.exe 4940 ddjvd.exe 2336 xrxrlff.exe 840 1tbtth.exe 3448 5tnhtt.exe 4992 jjdvp.exe 3584 llfxrrr.exe 4880 lrxfxfx.exe 2348 ntbtht.exe 1804 vpjjv.exe -
resource yara_rule behavioral2/memory/980-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023476-3.dat upx behavioral2/memory/980-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3228-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234ca-10.dat upx behavioral2/memory/2912-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cb-13.dat upx behavioral2/files/0x00070000000234cc-22.dat upx behavioral2/memory/668-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2272-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cd-28.dat upx behavioral2/files/0x00070000000234ce-35.dat upx behavioral2/memory/4792-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cf-39.dat upx behavioral2/memory/1980-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/220-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d0-46.dat upx behavioral2/memory/5016-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d1-53.dat upx behavioral2/memory/3720-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d2-59.dat upx behavioral2/memory/2504-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d3-64.dat upx behavioral2/memory/3056-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234d4-71.dat upx behavioral2/memory/3056-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023427-76.dat upx behavioral2/memory/2748-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234c8-83.dat upx behavioral2/files/0x00080000000234d6-87.dat upx behavioral2/files/0x00070000000234d7-93.dat upx behavioral2/memory/1868-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3048-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d8-100.dat upx behavioral2/memory/5096-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d9-105.dat upx behavioral2/files/0x00070000000234da-110.dat upx behavioral2/memory/4312-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234db-117.dat upx behavioral2/memory/3004-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1664-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234dc-124.dat upx behavioral2/files/0x00070000000234dd-131.dat upx behavioral2/memory/1664-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234de-135.dat upx behavioral2/memory/4920-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234df-141.dat upx behavioral2/files/0x00070000000234e0-146.dat upx behavioral2/memory/2704-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2200-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e1-153.dat upx behavioral2/files/0x00070000000234e2-158.dat upx behavioral2/memory/3220-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e3-165.dat upx behavioral2/files/0x00070000000234e4-170.dat upx behavioral2/files/0x00070000000234e5-175.dat upx behavioral2/files/0x00070000000234e6-181.dat upx behavioral2/memory/4516-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e7-185.dat upx behavioral2/memory/1944-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1956-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4944-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4420-210-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 980 wrote to memory of 3228 980 74844d94aa0f8fc8941ebed5f4fcc5e0N.exe 84 PID 980 wrote to memory of 3228 980 74844d94aa0f8fc8941ebed5f4fcc5e0N.exe 84 PID 980 wrote to memory of 3228 980 74844d94aa0f8fc8941ebed5f4fcc5e0N.exe 84 PID 3228 wrote to memory of 2912 3228 vjjdp.exe 85 PID 3228 wrote to memory of 2912 3228 vjjdp.exe 85 PID 3228 wrote to memory of 2912 3228 vjjdp.exe 85 PID 2912 wrote to memory of 668 2912 dvjjj.exe 86 PID 2912 wrote to memory of 668 2912 dvjjj.exe 86 PID 2912 wrote to memory of 668 2912 dvjjj.exe 86 PID 668 wrote to memory of 2272 668 frrfxfr.exe 87 PID 668 wrote to memory of 2272 668 frrfxfr.exe 87 PID 668 wrote to memory of 2272 668 frrfxfr.exe 87 PID 2272 wrote to memory of 4792 2272 llfxllx.exe 89 PID 2272 wrote to memory of 4792 2272 llfxllx.exe 89 PID 2272 wrote to memory of 4792 2272 llfxllx.exe 89 PID 4792 wrote to memory of 1980 4792 9tnhbb.exe 90 PID 4792 wrote to memory of 1980 4792 9tnhbb.exe 90 PID 4792 wrote to memory of 1980 4792 9tnhbb.exe 90 PID 1980 wrote to memory of 220 1980 9lfxlrr.exe 92 PID 1980 wrote to memory of 220 1980 9lfxlrr.exe 92 PID 1980 wrote to memory of 220 1980 9lfxlrr.exe 92 PID 220 wrote to memory of 5016 220 bbnhbt.exe 93 PID 220 wrote to memory of 5016 220 bbnhbt.exe 93 PID 220 wrote to memory of 5016 220 bbnhbt.exe 93 PID 5016 wrote to memory of 3720 5016 1djvv.exe 94 PID 5016 wrote to memory of 3720 5016 1djvv.exe 94 PID 5016 wrote to memory of 3720 5016 1djvv.exe 94 PID 3720 wrote to memory of 2504 3720 rxrlffx.exe 95 PID 3720 wrote to memory of 2504 3720 rxrlffx.exe 95 PID 3720 wrote to memory of 2504 3720 rxrlffx.exe 95 PID 2504 wrote to memory of 3056 2504 xllffff.exe 96 PID 2504 wrote to memory of 3056 2504 xllffff.exe 96 PID 2504 wrote to memory of 3056 2504 xllffff.exe 96 PID 3056 wrote to memory of 5084 3056 frlffxl.exe 97 PID 3056 wrote to memory of 5084 3056 frlffxl.exe 97 PID 3056 wrote to memory of 5084 3056 frlffxl.exe 97 PID 5084 wrote to memory of 2748 5084 vjdvj.exe 98 PID 5084 wrote to memory of 2748 5084 vjdvj.exe 98 PID 5084 wrote to memory of 2748 5084 vjdvj.exe 98 PID 2748 wrote to memory of 3048 2748 bhtttb.exe 99 PID 2748 wrote to memory of 3048 2748 bhtttb.exe 99 PID 2748 wrote to memory of 3048 2748 bhtttb.exe 99 PID 3048 wrote to memory of 2692 3048 fffxrlf.exe 100 PID 3048 wrote to memory of 2692 3048 fffxrlf.exe 100 PID 3048 wrote to memory of 2692 3048 fffxrlf.exe 100 PID 2692 wrote to memory of 1868 2692 nthtnn.exe 101 PID 2692 wrote to memory of 1868 2692 nthtnn.exe 101 PID 2692 wrote to memory of 1868 2692 nthtnn.exe 101 PID 1868 wrote to memory of 5096 1868 vvjdv.exe 102 PID 1868 wrote to memory of 5096 1868 vvjdv.exe 102 PID 1868 wrote to memory of 5096 1868 vvjdv.exe 102 PID 5096 wrote to memory of 4312 5096 rflfrlx.exe 103 PID 5096 wrote to memory of 4312 5096 rflfrlx.exe 103 PID 5096 wrote to memory of 4312 5096 rflfrlx.exe 103 PID 4312 wrote to memory of 4504 4312 nhbnhn.exe 104 PID 4312 wrote to memory of 4504 4312 nhbnhn.exe 104 PID 4312 wrote to memory of 4504 4312 nhbnhn.exe 104 PID 4504 wrote to memory of 3004 4504 fflfxrr.exe 105 PID 4504 wrote to memory of 3004 4504 fflfxrr.exe 105 PID 4504 wrote to memory of 3004 4504 fflfxrr.exe 105 PID 3004 wrote to memory of 1664 3004 bnhbtn.exe 106 PID 3004 wrote to memory of 1664 3004 bnhbtn.exe 106 PID 3004 wrote to memory of 1664 3004 bnhbtn.exe 106 PID 1664 wrote to memory of 3428 1664 xrrrrrr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\74844d94aa0f8fc8941ebed5f4fcc5e0N.exe"C:\Users\Admin\AppData\Local\Temp\74844d94aa0f8fc8941ebed5f4fcc5e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\vjjdp.exec:\vjjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\dvjjj.exec:\dvjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\frrfxfr.exec:\frrfxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\llfxllx.exec:\llfxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\9tnhbb.exec:\9tnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\9lfxlrr.exec:\9lfxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\bbnhbt.exec:\bbnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\1djvv.exec:\1djvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\rxrlffx.exec:\rxrlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\xllffff.exec:\xllffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\frlffxl.exec:\frlffxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vjdvj.exec:\vjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\bhtttb.exec:\bhtttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fffxrlf.exec:\fffxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nthtnn.exec:\nthtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vvjdv.exec:\vvjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\rflfrlx.exec:\rflfrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\nhbnhn.exec:\nhbnhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\fflfxrr.exec:\fflfxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\bnhbtn.exec:\bnhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\xflxrlf.exec:\xflxrlf.exe23⤵
- Executes dropped EXE
PID:3428 -
\??\c:\djppj.exec:\djppj.exe24⤵
- Executes dropped EXE
PID:4920 -
\??\c:\rffxrlf.exec:\rffxrlf.exe25⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bhbtbt.exec:\bhbtbt.exe26⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lflrxrx.exec:\lflrxrx.exe27⤵
- Executes dropped EXE
PID:3220 -
\??\c:\tttnhh.exec:\tttnhh.exe28⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lxxrfff.exec:\lxxrfff.exe29⤵
- Executes dropped EXE
PID:4488 -
\??\c:\nhthhh.exec:\nhthhh.exe30⤵
- Executes dropped EXE
PID:820 -
\??\c:\pjpjd.exec:\pjpjd.exe31⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ntnhbb.exec:\ntnhbb.exe32⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe33⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fxrrlfx.exec:\fxrrlfx.exe34⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bntnhb.exec:\bntnhb.exe35⤵
- Executes dropped EXE
PID:3704 -
\??\c:\tntnbb.exec:\tntnbb.exe36⤵
- Executes dropped EXE
PID:4380 -
\??\c:\dvpjd.exec:\dvpjd.exe37⤵
- Executes dropped EXE
PID:772 -
\??\c:\frrlxrl.exec:\frrlxrl.exe38⤵
- Executes dropped EXE
PID:4944 -
\??\c:\tbhbhb.exec:\tbhbhb.exe39⤵
- Executes dropped EXE
PID:4420 -
\??\c:\3ddvv.exec:\3ddvv.exe40⤵
- Executes dropped EXE
PID:1524 -
\??\c:\frrlffx.exec:\frrlffx.exe41⤵
- Executes dropped EXE
PID:4604 -
\??\c:\3jdpd.exec:\3jdpd.exe42⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vjjvj.exec:\vjjvj.exe43⤵
- Executes dropped EXE
PID:4568 -
\??\c:\5llfrxr.exec:\5llfrxr.exe44⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vvjjj.exec:\vvjjj.exe45⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rrxxlfx.exec:\rrxxlfx.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\htthbb.exec:\htthbb.exe47⤵
- Executes dropped EXE
PID:4044 -
\??\c:\vvpjv.exec:\vvpjv.exe48⤵
- Executes dropped EXE
PID:4240 -
\??\c:\rxfrfxr.exec:\rxfrfxr.exe49⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rfllfxr.exec:\rfllfxr.exe50⤵
- Executes dropped EXE
PID:4988 -
\??\c:\nnhbnh.exec:\nnhbnh.exe51⤵
- Executes dropped EXE
PID:3208 -
\??\c:\3dvpd.exec:\3dvpd.exe52⤵
- Executes dropped EXE
PID:3976 -
\??\c:\lfffffx.exec:\lfffffx.exe53⤵
- Executes dropped EXE
PID:3644 -
\??\c:\5llfxrl.exec:\5llfxrl.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\btnnhn.exec:\btnnhn.exe55⤵
- Executes dropped EXE
PID:3308 -
\??\c:\1ppdd.exec:\1ppdd.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ddjvd.exec:\ddjvd.exe57⤵
- Executes dropped EXE
PID:4940 -
\??\c:\xrxrlff.exec:\xrxrlff.exe58⤵
- Executes dropped EXE
PID:2336 -
\??\c:\1tbtth.exec:\1tbtth.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\5tnhtt.exec:\5tnhtt.exe60⤵
- Executes dropped EXE
PID:3448 -
\??\c:\jjdvp.exec:\jjdvp.exe61⤵
- Executes dropped EXE
PID:4992 -
\??\c:\llfxrrr.exec:\llfxrrr.exe62⤵
- Executes dropped EXE
PID:3584 -
\??\c:\lrxfxfx.exec:\lrxfxfx.exe63⤵
- Executes dropped EXE
PID:4880 -
\??\c:\ntbtht.exec:\ntbtht.exe64⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vpjjv.exec:\vpjjv.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\pvvvj.exec:\pvvvj.exe66⤵PID:2820
-
\??\c:\7rrfxrl.exec:\7rrfxrl.exe67⤵PID:1880
-
\??\c:\7tbhbt.exec:\7tbhbt.exe68⤵PID:1584
-
\??\c:\ddjdp.exec:\ddjdp.exe69⤵PID:5040
-
\??\c:\ppjdj.exec:\ppjdj.exe70⤵PID:3156
-
\??\c:\rrrllfx.exec:\rrrllfx.exe71⤵PID:2680
-
\??\c:\bnhbtt.exec:\bnhbtt.exe72⤵PID:3432
-
\??\c:\hbtnhh.exec:\hbtnhh.exe73⤵PID:4040
-
\??\c:\1pdjd.exec:\1pdjd.exe74⤵PID:4864
-
\??\c:\5xxrllf.exec:\5xxrllf.exe75⤵PID:5068
-
\??\c:\flrrrxr.exec:\flrrrxr.exe76⤵PID:1500
-
\??\c:\5hhbtt.exec:\5hhbtt.exe77⤵PID:3636
-
\??\c:\5vpjd.exec:\5vpjd.exe78⤵PID:4784
-
\??\c:\pjpjd.exec:\pjpjd.exe79⤵PID:1848
-
\??\c:\lffxxxr.exec:\lffxxxr.exe80⤵PID:3508
-
\??\c:\5vppj.exec:\5vppj.exe81⤵PID:1000
-
\??\c:\lxlxllx.exec:\lxlxllx.exe82⤵PID:2044
-
\??\c:\rlrrlfl.exec:\rlrrlfl.exe83⤵PID:5056
-
\??\c:\9hbbtt.exec:\9hbbtt.exe84⤵PID:1916
-
\??\c:\jjpjv.exec:\jjpjv.exe85⤵PID:1976
-
\??\c:\rlllffx.exec:\rlllffx.exe86⤵PID:4600
-
\??\c:\lxfffxx.exec:\lxfffxx.exe87⤵PID:4140
-
\??\c:\nnbtnn.exec:\nnbtnn.exe88⤵PID:4584
-
\??\c:\pdvvd.exec:\pdvvd.exe89⤵PID:772
-
\??\c:\xxxrlfr.exec:\xxxrlfr.exe90⤵PID:4844
-
\??\c:\rlrrfff.exec:\rlrrfff.exe91⤵PID:5088
-
\??\c:\ntbbtn.exec:\ntbbtn.exe92⤵PID:1184
-
\??\c:\pjdpj.exec:\pjdpj.exe93⤵PID:2876
-
\??\c:\jdvpv.exec:\jdvpv.exe94⤵PID:668
-
\??\c:\9fxlxfr.exec:\9fxlxfr.exe95⤵PID:2700
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe96⤵PID:1784
-
\??\c:\nbbhbh.exec:\nbbhbh.exe97⤵PID:4468
-
\??\c:\5jvpj.exec:\5jvpj.exe98⤵PID:5060
-
\??\c:\llrfrlf.exec:\llrfrlf.exe99⤵PID:4396
-
\??\c:\5lrfxfr.exec:\5lrfxfr.exe100⤵PID:4204
-
\??\c:\bhbthh.exec:\bhbthh.exe101⤵PID:212
-
\??\c:\3jjjd.exec:\3jjjd.exe102⤵PID:4764
-
\??\c:\xllxxrr.exec:\xllxxrr.exe103⤵PID:1884
-
\??\c:\xrxrrll.exec:\xrxrrll.exe104⤵PID:3620
-
\??\c:\bnhthb.exec:\bnhthb.exe105⤵PID:2504
-
\??\c:\jppjv.exec:\jppjv.exe106⤵PID:3524
-
\??\c:\jjdpd.exec:\jjdpd.exe107⤵PID:1800
-
\??\c:\rxfrllf.exec:\rxfrllf.exe108⤵PID:3056
-
\??\c:\hbbtnt.exec:\hbbtnt.exe109⤵PID:2888
-
\??\c:\dvpdv.exec:\dvpdv.exe110⤵PID:1536
-
\??\c:\3jppd.exec:\3jppd.exe111⤵PID:2864
-
\??\c:\xlrrffx.exec:\xlrrffx.exe112⤵PID:4352
-
\??\c:\1bhhbb.exec:\1bhhbb.exe113⤵PID:3048
-
\??\c:\pddvp.exec:\pddvp.exe114⤵PID:2052
-
\??\c:\djpjv.exec:\djpjv.exe115⤵PID:1508
-
\??\c:\xrfrllf.exec:\xrfrllf.exe116⤵PID:1740
-
\??\c:\thhbnh.exec:\thhbnh.exe117⤵PID:3336
-
\??\c:\pddvj.exec:\pddvj.exe118⤵PID:1888
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe119⤵PID:636
-
\??\c:\flrfxrf.exec:\flrfxrf.exe120⤵PID:4824
-
\??\c:\3nhhbb.exec:\3nhhbb.exe121⤵PID:1584
-
\??\c:\5dvjd.exec:\5dvjd.exe122⤵PID:5040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-