Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 13:45
Behavioral task
behavioral1
Sample
cf892d3d868cfcefa3e63d5efb448130N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
cf892d3d868cfcefa3e63d5efb448130N.exe
-
Size
498KB
-
MD5
cf892d3d868cfcefa3e63d5efb448130
-
SHA1
3cb8c8a457e157fde645aed709d7997e6eb4eb03
-
SHA256
388748e21134ba18678b1adcc21744660d6363064cc5ddb9296f4e549a890697
-
SHA512
a16db4e16dd87ee5811794bd34e3c6d48e33bec60691e495f8f039d45d1d43922fa173900a9517d7524cb7fe955e89378b793e2d78c19da37d0b3fb08c3df892
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxw:0KFmFVtrRcFEFmFS
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2752-6-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1864-222-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3928-251-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/212-322-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/408-366-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4276-521-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4444-557-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3692-569-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4488-573-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4436-579-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4932-576-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1548-563-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/932-560-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3512-553-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2784-547-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2660-545-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1172-539-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3448-531-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2208-498-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2556-495-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4760-486-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2996-472-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1860-463-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4812-449-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2864-445-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5100-441-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5064-435-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2988-427-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4572-417-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4964-413-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1552-405-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1064-393-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4876-383-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4608-374-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1824-359-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3276-355-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3104-343-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3244-339-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/876-336-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3492-317-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/384-306-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3560-300-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3948-288-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2792-286-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3920-282-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4820-278-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5012-272-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3340-270-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4576-266-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4928-262-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2796-255-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2044-247-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4980-241-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2988-234-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3336-232-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4524-228-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1868-220-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3444-208-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2368-205-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3880-202-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4436-193-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4232-186-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4780-176-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1548-165-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4540 8268482.exe 2200 frrlffx.exe 3560 hntnbn.exe 1052 8466480.exe 4884 htbnhb.exe 384 rfrfxfx.exe 2496 btnhth.exe 4016 6404888.exe 3492 844860.exe 2984 884260.exe 2140 u060262.exe 1220 3nnhbt.exe 3632 thhnbb.exe 3280 1tnhbb.exe 3244 1tnbtn.exe 768 20664.exe 3956 w28208.exe 5068 28048.exe 1592 0622662.exe 1180 866264.exe 4136 4448260.exe 3904 nhhbtt.exe 2724 vjjvp.exe 5084 nhhttn.exe 2592 1ddvj.exe 1548 3bhbbn.exe 1240 ttbbtn.exe 4780 xffxllf.exe 4232 rlrrxrl.exe 60 jdjdp.exe 4436 ntthnb.exe 4364 42264.exe 3880 s0082.exe 2368 fxlxlff.exe 3444 4242806.exe 5092 g0868.exe 4948 8820400.exe 1868 48648.exe 1864 42264.exe 4524 22226.exe 3336 pddvj.exe 2988 fffxlfx.exe 2276 20200.exe 4980 jpjdp.exe 2044 000422.exe 3928 06286.exe 2796 024860.exe 976 8860882.exe 4928 288600.exe 4576 pdpjj.exe 3340 4226044.exe 5012 4024424.exe 4820 28820.exe 3920 884866.exe 2792 08084.exe 3948 66866.exe 3040 k46460.exe 2200 o862408.exe 3560 64226.exe 3136 o886082.exe 3660 g2826.exe 384 40204.exe 4128 7nnbnh.exe 3492 k02266.exe -
resource yara_rule behavioral2/memory/2752-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0009000000023453-3.dat upx behavioral2/memory/2752-6-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4540-8-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x00070000000234a8-14.dat upx behavioral2/files/0x00070000000234a9-25.dat upx behavioral2/files/0x00070000000234af-62.dat upx behavioral2/files/0x00070000000234b3-85.dat upx behavioral2/files/0x00070000000234ba-126.dat upx behavioral2/memory/1864-222-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3928-251-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/212-322-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/408-366-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4276-521-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4444-557-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3692-569-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4488-573-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4436-579-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3944-582-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4544-581-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4932-576-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1548-563-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/932-560-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3512-553-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2784-547-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2660-545-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1172-539-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3448-531-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2208-498-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2556-495-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4760-486-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2996-472-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1860-463-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4812-449-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2864-445-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5100-441-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5064-435-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2988-427-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4572-417-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4964-413-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1552-405-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1064-393-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4876-383-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4608-374-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1824-359-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3276-355-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3104-343-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3244-339-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/876-336-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3492-317-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/384-306-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3560-300-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3948-288-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2792-286-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3920-282-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4820-278-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5012-272-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3340-270-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4576-266-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4928-262-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2796-255-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2044-247-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4980-241-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2988-234-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2752 wrote to memory of 4540 2752 cf892d3d868cfcefa3e63d5efb448130N.exe 84 PID 2752 wrote to memory of 4540 2752 cf892d3d868cfcefa3e63d5efb448130N.exe 84 PID 2752 wrote to memory of 4540 2752 cf892d3d868cfcefa3e63d5efb448130N.exe 84 PID 4540 wrote to memory of 2200 4540 8268482.exe 141 PID 4540 wrote to memory of 2200 4540 8268482.exe 141 PID 4540 wrote to memory of 2200 4540 8268482.exe 141 PID 2200 wrote to memory of 3560 2200 frrlffx.exe 86 PID 2200 wrote to memory of 3560 2200 frrlffx.exe 86 PID 2200 wrote to memory of 3560 2200 frrlffx.exe 86 PID 3560 wrote to memory of 1052 3560 hntnbn.exe 87 PID 3560 wrote to memory of 1052 3560 hntnbn.exe 87 PID 3560 wrote to memory of 1052 3560 hntnbn.exe 87 PID 1052 wrote to memory of 4884 1052 8466480.exe 88 PID 1052 wrote to memory of 4884 1052 8466480.exe 88 PID 1052 wrote to memory of 4884 1052 8466480.exe 88 PID 4884 wrote to memory of 384 4884 htbnhb.exe 89 PID 4884 wrote to memory of 384 4884 htbnhb.exe 89 PID 4884 wrote to memory of 384 4884 htbnhb.exe 89 PID 384 wrote to memory of 2496 384 rfrfxfx.exe 90 PID 384 wrote to memory of 2496 384 rfrfxfx.exe 90 PID 384 wrote to memory of 2496 384 rfrfxfx.exe 90 PID 2496 wrote to memory of 4016 2496 btnhth.exe 91 PID 2496 wrote to memory of 4016 2496 btnhth.exe 91 PID 2496 wrote to memory of 4016 2496 btnhth.exe 91 PID 4016 wrote to memory of 3492 4016 6404888.exe 147 PID 4016 wrote to memory of 3492 4016 6404888.exe 147 PID 4016 wrote to memory of 3492 4016 6404888.exe 147 PID 3492 wrote to memory of 2984 3492 844860.exe 93 PID 3492 wrote to memory of 2984 3492 844860.exe 93 PID 3492 wrote to memory of 2984 3492 844860.exe 93 PID 2984 wrote to memory of 2140 2984 884260.exe 94 PID 2984 wrote to memory of 2140 2984 884260.exe 94 PID 2984 wrote to memory of 2140 2984 884260.exe 94 PID 2140 wrote to memory of 1220 2140 u060262.exe 95 PID 2140 wrote to memory of 1220 2140 u060262.exe 95 PID 2140 wrote to memory of 1220 2140 u060262.exe 95 PID 1220 wrote to memory of 3632 1220 3nnhbt.exe 96 PID 1220 wrote to memory of 3632 1220 3nnhbt.exe 96 PID 1220 wrote to memory of 3632 1220 3nnhbt.exe 96 PID 3632 wrote to memory of 3280 3632 thhnbb.exe 97 PID 3632 wrote to memory of 3280 3632 thhnbb.exe 97 PID 3632 wrote to memory of 3280 3632 thhnbb.exe 97 PID 3280 wrote to memory of 3244 3280 1tnhbb.exe 98 PID 3280 wrote to memory of 3244 3280 1tnhbb.exe 98 PID 3280 wrote to memory of 3244 3280 1tnhbb.exe 98 PID 3244 wrote to memory of 768 3244 1tnbtn.exe 99 PID 3244 wrote to memory of 768 3244 1tnbtn.exe 99 PID 3244 wrote to memory of 768 3244 1tnbtn.exe 99 PID 768 wrote to memory of 3956 768 20664.exe 100 PID 768 wrote to memory of 3956 768 20664.exe 100 PID 768 wrote to memory of 3956 768 20664.exe 100 PID 3956 wrote to memory of 5068 3956 w28208.exe 101 PID 3956 wrote to memory of 5068 3956 w28208.exe 101 PID 3956 wrote to memory of 5068 3956 w28208.exe 101 PID 5068 wrote to memory of 1592 5068 28048.exe 102 PID 5068 wrote to memory of 1592 5068 28048.exe 102 PID 5068 wrote to memory of 1592 5068 28048.exe 102 PID 1592 wrote to memory of 1180 1592 0622662.exe 103 PID 1592 wrote to memory of 1180 1592 0622662.exe 103 PID 1592 wrote to memory of 1180 1592 0622662.exe 103 PID 1180 wrote to memory of 4136 1180 866264.exe 104 PID 1180 wrote to memory of 4136 1180 866264.exe 104 PID 1180 wrote to memory of 4136 1180 866264.exe 104 PID 4136 wrote to memory of 3904 4136 4448260.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf892d3d868cfcefa3e63d5efb448130N.exe"C:\Users\Admin\AppData\Local\Temp\cf892d3d868cfcefa3e63d5efb448130N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\8268482.exec:\8268482.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\frrlffx.exec:\frrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\hntnbn.exec:\hntnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\8466480.exec:\8466480.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\htbnhb.exec:\htbnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\rfrfxfx.exec:\rfrfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\btnhth.exec:\btnhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\6404888.exec:\6404888.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\844860.exec:\844860.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\884260.exec:\884260.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\u060262.exec:\u060262.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\3nnhbt.exec:\3nnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\thhnbb.exec:\thhnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\1tnhbb.exec:\1tnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\1tnbtn.exec:\1tnbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\20664.exec:\20664.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\w28208.exec:\w28208.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\28048.exec:\28048.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\0622662.exec:\0622662.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\866264.exec:\866264.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\4448260.exec:\4448260.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\nhhbtt.exec:\nhhbtt.exe23⤵
- Executes dropped EXE
PID:3904 -
\??\c:\vjjvp.exec:\vjjvp.exe24⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nhhttn.exec:\nhhttn.exe25⤵
- Executes dropped EXE
PID:5084 -
\??\c:\1ddvj.exec:\1ddvj.exe26⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3bhbbn.exec:\3bhbbn.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\ttbbtn.exec:\ttbbtn.exe28⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xffxllf.exec:\xffxllf.exe29⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rlrrxrl.exec:\rlrrxrl.exe30⤵
- Executes dropped EXE
PID:4232 -
\??\c:\jdjdp.exec:\jdjdp.exe31⤵
- Executes dropped EXE
PID:60 -
\??\c:\ntthnb.exec:\ntthnb.exe32⤵
- Executes dropped EXE
PID:4436 -
\??\c:\42264.exec:\42264.exe33⤵
- Executes dropped EXE
PID:4364 -
\??\c:\s0082.exec:\s0082.exe34⤵
- Executes dropped EXE
PID:3880 -
\??\c:\fxlxlff.exec:\fxlxlff.exe35⤵
- Executes dropped EXE
PID:2368 -
\??\c:\4242806.exec:\4242806.exe36⤵
- Executes dropped EXE
PID:3444 -
\??\c:\g0868.exec:\g0868.exe37⤵
- Executes dropped EXE
PID:5092 -
\??\c:\8820400.exec:\8820400.exe38⤵
- Executes dropped EXE
PID:4948 -
\??\c:\48648.exec:\48648.exe39⤵
- Executes dropped EXE
PID:1868 -
\??\c:\42264.exec:\42264.exe40⤵
- Executes dropped EXE
PID:1864 -
\??\c:\22226.exec:\22226.exe41⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pddvj.exec:\pddvj.exe42⤵
- Executes dropped EXE
PID:3336 -
\??\c:\fffxlfx.exec:\fffxlfx.exe43⤵
- Executes dropped EXE
PID:2988 -
\??\c:\20200.exec:\20200.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jpjdp.exec:\jpjdp.exe45⤵
- Executes dropped EXE
PID:4980 -
\??\c:\000422.exec:\000422.exe46⤵
- Executes dropped EXE
PID:2044 -
\??\c:\06286.exec:\06286.exe47⤵
- Executes dropped EXE
PID:3928 -
\??\c:\024860.exec:\024860.exe48⤵
- Executes dropped EXE
PID:2796 -
\??\c:\8860882.exec:\8860882.exe49⤵
- Executes dropped EXE
PID:976 -
\??\c:\288600.exec:\288600.exe50⤵
- Executes dropped EXE
PID:4928 -
\??\c:\pdpjj.exec:\pdpjj.exe51⤵
- Executes dropped EXE
PID:4576 -
\??\c:\4226044.exec:\4226044.exe52⤵
- Executes dropped EXE
PID:3340 -
\??\c:\4024424.exec:\4024424.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\28820.exec:\28820.exe54⤵
- Executes dropped EXE
PID:4820 -
\??\c:\884866.exec:\884866.exe55⤵
- Executes dropped EXE
PID:3920 -
\??\c:\08084.exec:\08084.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\66866.exec:\66866.exe57⤵
- Executes dropped EXE
PID:3948 -
\??\c:\k46460.exec:\k46460.exe58⤵
- Executes dropped EXE
PID:3040 -
\??\c:\o862408.exec:\o862408.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\64226.exec:\64226.exe60⤵
- Executes dropped EXE
PID:3560 -
\??\c:\o886082.exec:\o886082.exe61⤵
- Executes dropped EXE
PID:3136 -
\??\c:\g2826.exec:\g2826.exe62⤵
- Executes dropped EXE
PID:3660 -
\??\c:\40204.exec:\40204.exe63⤵
- Executes dropped EXE
PID:384 -
\??\c:\7nnbnh.exec:\7nnbnh.exe64⤵
- Executes dropped EXE
PID:4128 -
\??\c:\k02266.exec:\k02266.exe65⤵
- Executes dropped EXE
PID:3492 -
\??\c:\248226.exec:\248226.exe66⤵PID:2172
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe67⤵PID:212
-
\??\c:\9jdvj.exec:\9jdvj.exe68⤵PID:3524
-
\??\c:\ntbttn.exec:\ntbttn.exe69⤵PID:744
-
\??\c:\vvdjd.exec:\vvdjd.exe70⤵PID:1032
-
\??\c:\428244.exec:\428244.exe71⤵PID:876
-
\??\c:\4260848.exec:\4260848.exe72⤵PID:3244
-
\??\c:\djpdp.exec:\djpdp.exe73⤵PID:3104
-
\??\c:\jdjdj.exec:\jdjdj.exe74⤵PID:1560
-
\??\c:\8460882.exec:\8460882.exe75⤵PID:3704
-
\??\c:\a6204.exec:\a6204.exe76⤵PID:3276
-
\??\c:\pvdvp.exec:\pvdvp.exe77⤵PID:1824
-
\??\c:\frxfffx.exec:\frxfffx.exe78⤵PID:1136
-
\??\c:\hbnhhh.exec:\hbnhhh.exe79⤵PID:408
-
\??\c:\82048.exec:\82048.exe80⤵PID:1456
-
\??\c:\jvppj.exec:\jvppj.exe81⤵PID:1488
-
\??\c:\w40480.exec:\w40480.exe82⤵PID:4608
-
\??\c:\5xrlxrf.exec:\5xrlxrf.exe83⤵PID:3692
-
\??\c:\vdjdv.exec:\vdjdv.exe84⤵PID:4876
-
\??\c:\84488.exec:\84488.exe85⤵PID:5112
-
\??\c:\8466044.exec:\8466044.exe86⤵PID:4232
-
\??\c:\lrlffxx.exec:\lrlffxx.exe87⤵PID:1064
-
\??\c:\3rrlxxf.exec:\3rrlxxf.exe88⤵PID:2780
-
\??\c:\08282.exec:\08282.exe89⤵PID:4260
-
\??\c:\bntthh.exec:\bntthh.exe90⤵PID:4528
-
\??\c:\djpdd.exec:\djpdd.exe91⤵PID:1552
-
\??\c:\2006464.exec:\2006464.exe92⤵PID:220
-
\??\c:\1flxxrr.exec:\1flxxrr.exe93⤵PID:4964
-
\??\c:\bhhhbb.exec:\bhhhbb.exe94⤵PID:4572
-
\??\c:\htttnh.exec:\htttnh.exe95⤵PID:4360
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe96⤵PID:4524
-
\??\c:\djppp.exec:\djppp.exe97⤵PID:2988
-
\??\c:\bnnnth.exec:\bnnnth.exe98⤵PID:4980
-
\??\c:\k88604.exec:\k88604.exe99⤵PID:2044
-
\??\c:\886460.exec:\886460.exe100⤵PID:5064
-
\??\c:\vjjdv.exec:\vjjdv.exe101⤵PID:5100
-
\??\c:\02620.exec:\02620.exe102⤵PID:2864
-
\??\c:\4282082.exec:\4282082.exe103⤵PID:4812
-
\??\c:\pjdvv.exec:\pjdvv.exe104⤵PID:1624
-
\??\c:\062482.exec:\062482.exe105⤵PID:3424
-
\??\c:\o408820.exec:\o408820.exe106⤵PID:5036
-
\??\c:\62860.exec:\62860.exe107⤵PID:2508
-
\??\c:\2666262.exec:\2666262.exe108⤵PID:1860
-
\??\c:\228264.exec:\228264.exe109⤵PID:2064
-
\??\c:\64486.exec:\64486.exe110⤵PID:2996
-
\??\c:\28448.exec:\28448.exe111⤵PID:2220
-
\??\c:\jdjvd.exec:\jdjvd.exe112⤵PID:2200
-
\??\c:\vdjdp.exec:\vdjdp.exe113⤵PID:3876
-
\??\c:\ttntnb.exec:\ttntnb.exe114⤵PID:2824
-
\??\c:\88682.exec:\88682.exe115⤵PID:4760
-
\??\c:\884260.exec:\884260.exe116⤵PID:384
-
\??\c:\7jdvj.exec:\7jdvj.exe117⤵PID:2556
-
\??\c:\a2820.exec:\a2820.exe118⤵PID:2208
-
\??\c:\u848608.exec:\u848608.exe119⤵PID:3492
-
\??\c:\k62044.exec:\k62044.exe120⤵PID:2172
-
\??\c:\3lxrllf.exec:\3lxrllf.exe121⤵PID:4880
-
\??\c:\tttnhb.exec:\tttnhb.exe122⤵PID:844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-