Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 00:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4.exe
-
Size
388KB
-
MD5
2dfc6ef866db9ea7735c18042a27a4b8
-
SHA1
bf147188a25dcc668e28cee06792bc248a20eb6b
-
SHA256
865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4
-
SHA512
dbfe0d298b68c790477a9520bd2e51f0fc1079d48bc9782f7cdaa3020ad9159b298c75052a0fad63f83ce76f4aa80d5b683507d94b4c4a26260be3191a9c0309
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfI:SgdnJVU4TlnwJ6Gof
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2964-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral2/memory/2964-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4780-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2560-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2332-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1832-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2996-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/652-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/548-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3308-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2284-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5072-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/536-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1192-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4132-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2320-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/688-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/952-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1312-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1352-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4008-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1372-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1144-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4924-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4780 lllrrrf.exe 2332 lxxxxxx.exe 2560 7htnhh.exe 1832 btbnhb.exe 2996 jjdpj.exe 652 lrxlfxf.exe 5080 lffrrlr.exe 548 fffffll.exe 3308 dvppj.exe 2284 nhbbtb.exe 5072 pjjjp.exe 536 rxffxrl.exe 1192 jdjjv.exe 3836 7rrrrrr.exe 1312 nbhnnb.exe 4132 9jdvp.exe 2320 rlxrxxx.exe 688 tbhbbt.exe 952 btnhhb.exe 2688 9pjdv.exe 1352 frxrrll.exe 4092 pvppv.exe 2260 xlfxrll.exe 3368 btnbht.exe 4008 dvvjj.exe 1372 thhbnh.exe 5036 9ffxllf.exe 4016 nhnhnh.exe 1144 jdppv.exe 4580 bbbnhb.exe 4924 vvpjj.exe 996 nbhbhb.exe 2748 9xxlxrl.exe 3440 vjjdv.exe 2848 rlfxlll.exe 4372 thnbhb.exe 2660 hntttn.exe 1988 1vpvv.exe 376 xxxxxfx.exe 4988 1thbtt.exe 1520 ddpdd.exe 3080 rrrrrfl.exe 1792 xxrxxxr.exe 4024 hbnnhb.exe 3832 ppvpp.exe 2984 1fffxfr.exe 448 llxrfxf.exe 1820 ttnhhb.exe 3884 pdjdd.exe 1076 1xxlfff.exe 2264 tbnnhh.exe 4624 djpjd.exe 4312 5xxfxxf.exe 2544 lllfffl.exe 3188 htbbbn.exe 1764 jvjvp.exe 4416 ffrrlll.exe 1716 lflffxx.exe 5108 ttbbbt.exe 2400 1vpjv.exe 2320 rlxxxxr.exe 1836 1tnhbb.exe 2136 jjpjd.exe 2424 pjdpj.exe -
resource yara_rule behavioral2/memory/2964-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 4780 2964 865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4.exe 85 PID 2964 wrote to memory of 4780 2964 865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4.exe 85 PID 2964 wrote to memory of 4780 2964 865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4.exe 85 PID 4780 wrote to memory of 2332 4780 lllrrrf.exe 86 PID 4780 wrote to memory of 2332 4780 lllrrrf.exe 86 PID 4780 wrote to memory of 2332 4780 lllrrrf.exe 86 PID 2332 wrote to memory of 2560 2332 lxxxxxx.exe 87 PID 2332 wrote to memory of 2560 2332 lxxxxxx.exe 87 PID 2332 wrote to memory of 2560 2332 lxxxxxx.exe 87 PID 2560 wrote to memory of 1832 2560 7htnhh.exe 88 PID 2560 wrote to memory of 1832 2560 7htnhh.exe 88 PID 2560 wrote to memory of 1832 2560 7htnhh.exe 88 PID 1832 wrote to memory of 2996 1832 btbnhb.exe 89 PID 1832 wrote to memory of 2996 1832 btbnhb.exe 89 PID 1832 wrote to memory of 2996 1832 btbnhb.exe 89 PID 2996 wrote to memory of 652 2996 jjdpj.exe 90 PID 2996 wrote to memory of 652 2996 jjdpj.exe 90 PID 2996 wrote to memory of 652 2996 jjdpj.exe 90 PID 652 wrote to memory of 5080 652 lrxlfxf.exe 91 PID 652 wrote to memory of 5080 652 lrxlfxf.exe 91 PID 652 wrote to memory of 5080 652 lrxlfxf.exe 91 PID 5080 wrote to memory of 548 5080 lffrrlr.exe 92 PID 5080 wrote to memory of 548 5080 lffrrlr.exe 92 PID 5080 wrote to memory of 548 5080 lffrrlr.exe 92 PID 548 wrote to memory of 3308 548 fffffll.exe 94 PID 548 wrote to memory of 3308 548 fffffll.exe 94 PID 548 wrote to memory of 3308 548 fffffll.exe 94 PID 3308 wrote to memory of 2284 3308 dvppj.exe 95 PID 3308 wrote to memory of 2284 3308 dvppj.exe 95 PID 3308 wrote to memory of 2284 3308 dvppj.exe 95 PID 2284 wrote to memory of 5072 2284 nhbbtb.exe 96 PID 2284 wrote to memory of 5072 2284 nhbbtb.exe 96 PID 2284 wrote to memory of 5072 2284 nhbbtb.exe 96 PID 5072 wrote to memory of 536 5072 pjjjp.exe 97 PID 5072 wrote to memory of 536 5072 pjjjp.exe 97 PID 5072 wrote to memory of 536 5072 pjjjp.exe 97 PID 536 wrote to memory of 1192 536 rxffxrl.exe 98 PID 536 wrote to memory of 1192 536 rxffxrl.exe 98 PID 536 wrote to memory of 1192 536 rxffxrl.exe 98 PID 1192 wrote to memory of 3836 1192 jdjjv.exe 99 PID 1192 wrote to memory of 3836 1192 jdjjv.exe 99 PID 1192 wrote to memory of 3836 1192 jdjjv.exe 99 PID 3836 wrote to memory of 1312 3836 7rrrrrr.exe 100 PID 3836 wrote to memory of 1312 3836 7rrrrrr.exe 100 PID 3836 wrote to memory of 1312 3836 7rrrrrr.exe 100 PID 1312 wrote to memory of 4132 1312 nbhnnb.exe 101 PID 1312 wrote to memory of 4132 1312 nbhnnb.exe 101 PID 1312 wrote to memory of 4132 1312 nbhnnb.exe 101 PID 4132 wrote to memory of 2320 4132 9jdvp.exe 102 PID 4132 wrote to memory of 2320 4132 9jdvp.exe 102 PID 4132 wrote to memory of 2320 4132 9jdvp.exe 102 PID 2320 wrote to memory of 688 2320 rlxrxxx.exe 103 PID 2320 wrote to memory of 688 2320 rlxrxxx.exe 103 PID 2320 wrote to memory of 688 2320 rlxrxxx.exe 103 PID 688 wrote to memory of 952 688 tbhbbt.exe 104 PID 688 wrote to memory of 952 688 tbhbbt.exe 104 PID 688 wrote to memory of 952 688 tbhbbt.exe 104 PID 952 wrote to memory of 2688 952 btnhhb.exe 105 PID 952 wrote to memory of 2688 952 btnhhb.exe 105 PID 952 wrote to memory of 2688 952 btnhhb.exe 105 PID 2688 wrote to memory of 1352 2688 9pjdv.exe 106 PID 2688 wrote to memory of 1352 2688 9pjdv.exe 106 PID 2688 wrote to memory of 1352 2688 9pjdv.exe 106 PID 1352 wrote to memory of 4092 1352 frxrrll.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4.exe"C:\Users\Admin\AppData\Local\Temp\865467ee3318bc9f8cb2364bc4b645d994db0a486c6d102de93fad3ee79b95e4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\lllrrrf.exec:\lllrrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\7htnhh.exec:\7htnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\btbnhb.exec:\btbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\jjdpj.exec:\jjdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lrxlfxf.exec:\lrxlfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\lffrrlr.exec:\lffrrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\fffffll.exec:\fffffll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\dvppj.exec:\dvppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\nhbbtb.exec:\nhbbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\pjjjp.exec:\pjjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\rxffxrl.exec:\rxffxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\jdjjv.exec:\jdjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\7rrrrrr.exec:\7rrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\nbhnnb.exec:\nbhnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\9jdvp.exec:\9jdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\rlxrxxx.exec:\rlxrxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\tbhbbt.exec:\tbhbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\btnhhb.exec:\btnhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\9pjdv.exec:\9pjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\frxrrll.exec:\frxrrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\pvppv.exec:\pvppv.exe23⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xlfxrll.exec:\xlfxrll.exe24⤵
- Executes dropped EXE
PID:2260 -
\??\c:\btnbht.exec:\btnbht.exe25⤵
- Executes dropped EXE
PID:3368 -
\??\c:\dvvjj.exec:\dvvjj.exe26⤵
- Executes dropped EXE
PID:4008 -
\??\c:\thhbnh.exec:\thhbnh.exe27⤵
- Executes dropped EXE
PID:1372 -
\??\c:\9ffxllf.exec:\9ffxllf.exe28⤵
- Executes dropped EXE
PID:5036 -
\??\c:\nhnhnh.exec:\nhnhnh.exe29⤵
- Executes dropped EXE
PID:4016 -
\??\c:\jdppv.exec:\jdppv.exe30⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bbbnhb.exec:\bbbnhb.exe31⤵
- Executes dropped EXE
PID:4580 -
\??\c:\vvpjj.exec:\vvpjj.exe32⤵
- Executes dropped EXE
PID:4924 -
\??\c:\nbhbhb.exec:\nbhbhb.exe33⤵
- Executes dropped EXE
PID:996 -
\??\c:\9xxlxrl.exec:\9xxlxrl.exe34⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vjjdv.exec:\vjjdv.exe35⤵
- Executes dropped EXE
PID:3440 -
\??\c:\rlfxlll.exec:\rlfxlll.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\thnbhb.exec:\thnbhb.exe37⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hntttn.exec:\hntttn.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1vpvv.exec:\1vpvv.exe39⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xxxxxfx.exec:\xxxxxfx.exe40⤵
- Executes dropped EXE
PID:376 -
\??\c:\1thbtt.exec:\1thbtt.exe41⤵
- Executes dropped EXE
PID:4988 -
\??\c:\ddpdd.exec:\ddpdd.exe42⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rrrrrfl.exec:\rrrrrfl.exe43⤵
- Executes dropped EXE
PID:3080 -
\??\c:\xxrxxxr.exec:\xxrxxxr.exe44⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hbnnhb.exec:\hbnnhb.exe45⤵
- Executes dropped EXE
PID:4024 -
\??\c:\ppvpp.exec:\ppvpp.exe46⤵
- Executes dropped EXE
PID:3832 -
\??\c:\1fffxfr.exec:\1fffxfr.exe47⤵
- Executes dropped EXE
PID:2984 -
\??\c:\llxrfxf.exec:\llxrfxf.exe48⤵
- Executes dropped EXE
PID:448 -
\??\c:\ttnhhb.exec:\ttnhhb.exe49⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pdjdd.exec:\pdjdd.exe50⤵
- Executes dropped EXE
PID:3884 -
\??\c:\1xxlfff.exec:\1xxlfff.exe51⤵
- Executes dropped EXE
PID:1076 -
\??\c:\tbnnhh.exec:\tbnnhh.exe52⤵
- Executes dropped EXE
PID:2264 -
\??\c:\djpjd.exec:\djpjd.exe53⤵
- Executes dropped EXE
PID:4624 -
\??\c:\5xxfxxf.exec:\5xxfxxf.exe54⤵
- Executes dropped EXE
PID:4312 -
\??\c:\lllfffl.exec:\lllfffl.exe55⤵
- Executes dropped EXE
PID:2544 -
\??\c:\htbbbn.exec:\htbbbn.exe56⤵
- Executes dropped EXE
PID:3188 -
\??\c:\jvjvp.exec:\jvjvp.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ffrrlll.exec:\ffrrlll.exe58⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lflffxx.exec:\lflffxx.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ttbbbt.exec:\ttbbbt.exe60⤵
- Executes dropped EXE
PID:5108 -
\??\c:\1vpjv.exec:\1vpjv.exe61⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe62⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1tnhbb.exec:\1tnhbb.exe63⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jjpjd.exec:\jjpjd.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pjdpj.exec:\pjdpj.exe65⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe66⤵PID:4388
-
\??\c:\hbhnht.exec:\hbhnht.exe67⤵PID:4904
-
\??\c:\jjpdv.exec:\jjpdv.exe68⤵PID:3524
-
\??\c:\pjvpj.exec:\pjvpj.exe69⤵PID:1424
-
\??\c:\lxlxrlf.exec:\lxlxrlf.exe70⤵PID:3436
-
\??\c:\9xlxlfx.exec:\9xlxlfx.exe71⤵PID:4008
-
\??\c:\bnbtnn.exec:\bnbtnn.exe72⤵PID:4772
-
\??\c:\dppdd.exec:\dppdd.exe73⤵PID:4348
-
\??\c:\xfrxxxx.exec:\xfrxxxx.exe74⤵PID:1840
-
\??\c:\btnnnh.exec:\btnnnh.exe75⤵PID:876
-
\??\c:\vpvvp.exec:\vpvvp.exe76⤵PID:4484
-
\??\c:\pppjv.exec:\pppjv.exe77⤵PID:3216
-
\??\c:\xllfxxr.exec:\xllfxxr.exe78⤵PID:2356
-
\??\c:\thttnn.exec:\thttnn.exe79⤵PID:4928
-
\??\c:\nnbbtn.exec:\nnbbtn.exe80⤵PID:1524
-
\??\c:\3ddvp.exec:\3ddvp.exe81⤵PID:1196
-
\??\c:\rrllfrl.exec:\rrllfrl.exe82⤵PID:4372
-
\??\c:\hhnhhn.exec:\hhnhhn.exe83⤵PID:1612
-
\??\c:\ntbntt.exec:\ntbntt.exe84⤵PID:1988
-
\??\c:\jddvj.exec:\jddvj.exe85⤵PID:3672
-
\??\c:\xlrlxrr.exec:\xlrlxrr.exe86⤵PID:4732
-
\??\c:\fllxrlr.exec:\fllxrlr.exe87⤵PID:1520
-
\??\c:\hntbtb.exec:\hntbtb.exe88⤵PID:3080
-
\??\c:\ddvvp.exec:\ddvvp.exe89⤵PID:1792
-
\??\c:\dvdvd.exec:\dvdvd.exe90⤵PID:4720
-
\??\c:\flffxxx.exec:\flffxxx.exe91⤵PID:2988
-
\??\c:\nbbnnh.exec:\nbbnnh.exe92⤵PID:1984
-
\??\c:\hbtnhh.exec:\hbtnhh.exe93⤵PID:4620
-
\??\c:\3jpjv.exec:\3jpjv.exe94⤵PID:2900
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe95⤵PID:2256
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe96⤵PID:2644
-
\??\c:\bbhbnh.exec:\bbhbnh.exe97⤵PID:3124
-
\??\c:\1jdpd.exec:\1jdpd.exe98⤵PID:2528
-
\??\c:\vvjvj.exec:\vvjvj.exe99⤵PID:2944
-
\??\c:\fffxrxr.exec:\fffxrxr.exe100⤵PID:640
-
\??\c:\hbbthn.exec:\hbbthn.exe101⤵PID:4548
-
\??\c:\djddd.exec:\djddd.exe102⤵PID:3120
-
\??\c:\pdpjv.exec:\pdpjv.exe103⤵PID:1300
-
\??\c:\frrlrlf.exec:\frrlrlf.exe104⤵PID:1332
-
\??\c:\bhtnhh.exec:\bhtnhh.exe105⤵PID:2688
-
\??\c:\ttbtnn.exec:\ttbtnn.exe106⤵PID:3904
-
\??\c:\9pvpj.exec:\9pvpj.exe107⤵PID:3880
-
\??\c:\lrxrrxr.exec:\lrxrrxr.exe108⤵PID:4572
-
\??\c:\flfxrrl.exec:\flfxrrl.exe109⤵PID:1356
-
\??\c:\ddvvd.exec:\ddvvd.exe110⤵PID:4208
-
\??\c:\ppjpj.exec:\ppjpj.exe111⤵PID:3140
-
\??\c:\xfxrffr.exec:\xfxrffr.exe112⤵PID:5064
-
\??\c:\btbtnh.exec:\btbtnh.exe113⤵PID:2220
-
\??\c:\3xlxxxf.exec:\3xlxxxf.exe114⤵PID:1772
-
\??\c:\nhtttb.exec:\nhtttb.exe115⤵PID:1468
-
\??\c:\pdjjd.exec:\pdjjd.exe116⤵PID:4696
-
\??\c:\vjvpp.exec:\vjvpp.exe117⤵PID:3996
-
\??\c:\rxxllrr.exec:\rxxllrr.exe118⤵PID:4928
-
\??\c:\thnnnt.exec:\thnnnt.exe119⤵PID:4316
-
\??\c:\vddvp.exec:\vddvp.exe120⤵PID:4948
-
\??\c:\rxfrlll.exec:\rxfrlll.exe121⤵PID:4124
-
\??\c:\bbhthn.exec:\bbhthn.exe122⤵PID:3568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-