Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 20:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325.exe
-
Size
225KB
-
MD5
143e24583d8c89d93ee9099b1d6087f5
-
SHA1
54bf3e3a47d3363016d83558decaa567fd3c6be7
-
SHA256
387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325
-
SHA512
601b942a246980999361daf2f53a785c1d7bc4b3579f877ae7b9f80dfba720b61a0f54a8ebfdf79cc6b54254bded22f4f592f5583fe38d53a673faed6fc54cdc
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG6:n3C9BRo7MlrWKo+lxKA
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2964-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/704-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/2964-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3500-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2732-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3800-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2436-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2436-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/812-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1952-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2028-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3960-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1308-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/372-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1564-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4892-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/704-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3668-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2460-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4224-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2388-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2544-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3112-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3500 7tbbhh.exe 3800 jjdpj.exe 2732 ddppp.exe 2436 xxllllr.exe 812 hhtnnn.exe 1704 xxxfllf.exe 1952 tnhnnn.exe 2028 fxxxxff.exe 3036 7frrlrl.exe 3960 tnbbbb.exe 1308 jdjdd.exe 2308 rrxrrfl.exe 372 nbntnt.exe 3060 jvjjv.exe 1564 frffrrl.exe 4892 hnthbh.exe 4248 pppdv.exe 704 rllffxx.exe 3068 hhbtnn.exe 5064 pjjpp.exe 3008 1rlfxrl.exe 1516 hnbbtb.exe 3668 nnnhbh.exe 4368 3pdvv.exe 2460 7frlrxf.exe 4224 pddvp.exe 2388 djjpj.exe 2544 thnntn.exe 3112 jdvdp.exe 3724 3lrfxrf.exe 2624 thnbth.exe 1560 7jjjj.exe 3024 rfxffxx.exe 1652 tnhhnn.exe 3872 pjpvd.exe 3328 pddvp.exe 5100 9xfxxxr.exe 1528 httnnn.exe 2268 ntnnhh.exe 3692 ddvvp.exe 736 lrlffxf.exe 2012 ttnhbh.exe 4916 1pdvj.exe 896 pdjpd.exe 1792 flxfxlf.exe 2120 xxffrff.exe 2308 hthbtt.exe 2160 ddddv.exe 3060 rlxxllr.exe 4068 5bnnhn.exe 4568 7ttttb.exe 3864 ppdpd.exe 2668 1llfflf.exe 2484 5rllffx.exe 5064 bnhhtt.exe 3008 5ddvj.exe 1296 xflrxrx.exe 2632 bthtbb.exe 2428 bbhtnt.exe 4368 jdjvd.exe 2460 llrxxff.exe 1660 llllfff.exe 1048 9hnhbb.exe 3424 ddpjd.exe -
resource yara_rule behavioral2/memory/2964-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 3500 2964 387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325.exe 85 PID 2964 wrote to memory of 3500 2964 387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325.exe 85 PID 2964 wrote to memory of 3500 2964 387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325.exe 85 PID 3500 wrote to memory of 3800 3500 7tbbhh.exe 86 PID 3500 wrote to memory of 3800 3500 7tbbhh.exe 86 PID 3500 wrote to memory of 3800 3500 7tbbhh.exe 86 PID 3800 wrote to memory of 2732 3800 jjdpj.exe 87 PID 3800 wrote to memory of 2732 3800 jjdpj.exe 87 PID 3800 wrote to memory of 2732 3800 jjdpj.exe 87 PID 2732 wrote to memory of 2436 2732 ddppp.exe 88 PID 2732 wrote to memory of 2436 2732 ddppp.exe 88 PID 2732 wrote to memory of 2436 2732 ddppp.exe 88 PID 2436 wrote to memory of 812 2436 xxllllr.exe 89 PID 2436 wrote to memory of 812 2436 xxllllr.exe 89 PID 2436 wrote to memory of 812 2436 xxllllr.exe 89 PID 812 wrote to memory of 1704 812 hhtnnn.exe 90 PID 812 wrote to memory of 1704 812 hhtnnn.exe 90 PID 812 wrote to memory of 1704 812 hhtnnn.exe 90 PID 1704 wrote to memory of 1952 1704 xxxfllf.exe 91 PID 1704 wrote to memory of 1952 1704 xxxfllf.exe 91 PID 1704 wrote to memory of 1952 1704 xxxfllf.exe 91 PID 1952 wrote to memory of 2028 1952 tnhnnn.exe 92 PID 1952 wrote to memory of 2028 1952 tnhnnn.exe 92 PID 1952 wrote to memory of 2028 1952 tnhnnn.exe 92 PID 2028 wrote to memory of 3036 2028 fxxxxff.exe 93 PID 2028 wrote to memory of 3036 2028 fxxxxff.exe 93 PID 2028 wrote to memory of 3036 2028 fxxxxff.exe 93 PID 3036 wrote to memory of 3960 3036 7frrlrl.exe 94 PID 3036 wrote to memory of 3960 3036 7frrlrl.exe 94 PID 3036 wrote to memory of 3960 3036 7frrlrl.exe 94 PID 3960 wrote to memory of 1308 3960 tnbbbb.exe 95 PID 3960 wrote to memory of 1308 3960 tnbbbb.exe 95 PID 3960 wrote to memory of 1308 3960 tnbbbb.exe 95 PID 1308 wrote to memory of 2308 1308 jdjdd.exe 96 PID 1308 wrote to memory of 2308 1308 jdjdd.exe 96 PID 1308 wrote to memory of 2308 1308 jdjdd.exe 96 PID 2308 wrote to memory of 372 2308 rrxrrfl.exe 97 PID 2308 wrote to memory of 372 2308 rrxrrfl.exe 97 PID 2308 wrote to memory of 372 2308 rrxrrfl.exe 97 PID 372 wrote to memory of 3060 372 nbntnt.exe 98 PID 372 wrote to memory of 3060 372 nbntnt.exe 98 PID 372 wrote to memory of 3060 372 nbntnt.exe 98 PID 3060 wrote to memory of 1564 3060 jvjjv.exe 99 PID 3060 wrote to memory of 1564 3060 jvjjv.exe 99 PID 3060 wrote to memory of 1564 3060 jvjjv.exe 99 PID 1564 wrote to memory of 4892 1564 frffrrl.exe 100 PID 1564 wrote to memory of 4892 1564 frffrrl.exe 100 PID 1564 wrote to memory of 4892 1564 frffrrl.exe 100 PID 4892 wrote to memory of 4248 4892 hnthbh.exe 101 PID 4892 wrote to memory of 4248 4892 hnthbh.exe 101 PID 4892 wrote to memory of 4248 4892 hnthbh.exe 101 PID 4248 wrote to memory of 704 4248 pppdv.exe 102 PID 4248 wrote to memory of 704 4248 pppdv.exe 102 PID 4248 wrote to memory of 704 4248 pppdv.exe 102 PID 704 wrote to memory of 3068 704 rllffxx.exe 103 PID 704 wrote to memory of 3068 704 rllffxx.exe 103 PID 704 wrote to memory of 3068 704 rllffxx.exe 103 PID 3068 wrote to memory of 5064 3068 hhbtnn.exe 104 PID 3068 wrote to memory of 5064 3068 hhbtnn.exe 104 PID 3068 wrote to memory of 5064 3068 hhbtnn.exe 104 PID 5064 wrote to memory of 3008 5064 pjjpp.exe 105 PID 5064 wrote to memory of 3008 5064 pjjpp.exe 105 PID 5064 wrote to memory of 3008 5064 pjjpp.exe 105 PID 3008 wrote to memory of 1516 3008 1rlfxrl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325.exe"C:\Users\Admin\AppData\Local\Temp\387cdc0ccefbef793473111da1bd4491487b514bb22db71b9697921429ece325.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7tbbhh.exec:\7tbbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\jjdpj.exec:\jjdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\ddppp.exec:\ddppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xxllllr.exec:\xxllllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hhtnnn.exec:\hhtnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\xxxfllf.exec:\xxxfllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\tnhnnn.exec:\tnhnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\fxxxxff.exec:\fxxxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7frrlrl.exec:\7frrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tnbbbb.exec:\tnbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\jdjdd.exec:\jdjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\rrxrrfl.exec:\rrxrrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nbntnt.exec:\nbntnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\jvjjv.exec:\jvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\frffrrl.exec:\frffrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\hnthbh.exec:\hnthbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\pppdv.exec:\pppdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\rllffxx.exec:\rllffxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\hhbtnn.exec:\hhbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pjjpp.exec:\pjjpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\1rlfxrl.exec:\1rlfxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hnbbtb.exec:\hnbbtb.exe23⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nnnhbh.exec:\nnnhbh.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\3pdvv.exec:\3pdvv.exe25⤵
- Executes dropped EXE
PID:4368 -
\??\c:\7frlrxf.exec:\7frlrxf.exe26⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pddvp.exec:\pddvp.exe27⤵
- Executes dropped EXE
PID:4224 -
\??\c:\djjpj.exec:\djjpj.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\thnntn.exec:\thnntn.exe29⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jdvdp.exec:\jdvdp.exe30⤵
- Executes dropped EXE
PID:3112 -
\??\c:\3lrfxrf.exec:\3lrfxrf.exe31⤵
- Executes dropped EXE
PID:3724 -
\??\c:\thnbth.exec:\thnbth.exe32⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7jjjj.exec:\7jjjj.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\1vvvp.exec:\1vvvp.exe34⤵PID:4404
-
\??\c:\rfxffxx.exec:\rfxffxx.exe35⤵
- Executes dropped EXE
PID:3024 -
\??\c:\tnhhnn.exec:\tnhhnn.exe36⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjpvd.exec:\pjpvd.exe37⤵
- Executes dropped EXE
PID:3872 -
\??\c:\pddvp.exec:\pddvp.exe38⤵
- Executes dropped EXE
PID:3328 -
\??\c:\9xfxxxr.exec:\9xfxxxr.exe39⤵
- Executes dropped EXE
PID:5100 -
\??\c:\httnnn.exec:\httnnn.exe40⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ntnnhh.exec:\ntnnhh.exe41⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ddvvp.exec:\ddvvp.exe42⤵
- Executes dropped EXE
PID:3692 -
\??\c:\lrlffxf.exec:\lrlffxf.exe43⤵
- Executes dropped EXE
PID:736 -
\??\c:\ttnhbh.exec:\ttnhbh.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1pdvj.exec:\1pdvj.exe45⤵
- Executes dropped EXE
PID:4916 -
\??\c:\pdjpd.exec:\pdjpd.exe46⤵
- Executes dropped EXE
PID:896 -
\??\c:\flxfxlf.exec:\flxfxlf.exe47⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xxffrff.exec:\xxffrff.exe48⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hthbtt.exec:\hthbtt.exe49⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ddddv.exec:\ddddv.exe50⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rlxxllr.exec:\rlxxllr.exe51⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5bnnhn.exec:\5bnnhn.exe52⤵
- Executes dropped EXE
PID:4068 -
\??\c:\7ttttb.exec:\7ttttb.exe53⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ppdpd.exec:\ppdpd.exe54⤵
- Executes dropped EXE
PID:3864 -
\??\c:\1llfflf.exec:\1llfflf.exe55⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5rllffx.exec:\5rllffx.exe56⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bnhhtt.exec:\bnhhtt.exe57⤵
- Executes dropped EXE
PID:5064 -
\??\c:\5ddvj.exec:\5ddvj.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xflrxrx.exec:\xflrxrx.exe59⤵
- Executes dropped EXE
PID:1296 -
\??\c:\bthtbb.exec:\bthtbb.exe60⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bbhtnt.exec:\bbhtnt.exe61⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jdjvd.exec:\jdjvd.exe62⤵
- Executes dropped EXE
PID:4368 -
\??\c:\llrxxff.exec:\llrxxff.exe63⤵
- Executes dropped EXE
PID:2460 -
\??\c:\llllfff.exec:\llllfff.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9hnhbb.exec:\9hnhbb.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ddpjd.exec:\ddpjd.exe66⤵
- Executes dropped EXE
PID:3424 -
\??\c:\vvjdj.exec:\vvjdj.exe67⤵PID:1200
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe68⤵PID:3112
-
\??\c:\hthhhb.exec:\hthhhb.exe69⤵PID:3724
-
\??\c:\tnttbt.exec:\tnttbt.exe70⤵PID:212
-
\??\c:\pdvpp.exec:\pdvpp.exe71⤵PID:2056
-
\??\c:\ddppd.exec:\ddppd.exe72⤵PID:4280
-
\??\c:\7lrllxx.exec:\7lrllxx.exe73⤵PID:3500
-
\??\c:\hbbntt.exec:\hbbntt.exe74⤵PID:3144
-
\??\c:\pjddv.exec:\pjddv.exe75⤵PID:4252
-
\??\c:\5ppjj.exec:\5ppjj.exe76⤵PID:1980
-
\??\c:\5llxrrl.exec:\5llxrrl.exe77⤵PID:2436
-
\??\c:\xxxffrl.exec:\xxxffrl.exe78⤵PID:1908
-
\??\c:\ntbnhb.exec:\ntbnhb.exe79⤵PID:1364
-
\??\c:\jjvvv.exec:\jjvvv.exe80⤵PID:4120
-
\??\c:\djppj.exec:\djppj.exe81⤵PID:956
-
\??\c:\xfxlxrl.exec:\xfxlxrl.exe82⤵PID:3016
-
\??\c:\hnbtnb.exec:\hnbtnb.exe83⤵PID:2300
-
\??\c:\bbtnhh.exec:\bbtnhh.exe84⤵PID:4916
-
\??\c:\dddvv.exec:\dddvv.exe85⤵PID:896
-
\??\c:\fxxxxxl.exec:\fxxxxxl.exe86⤵PID:2152
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe87⤵PID:4180
-
\??\c:\httnhh.exec:\httnhh.exe88⤵PID:2932
-
\??\c:\3vjdv.exec:\3vjdv.exe89⤵PID:4448
-
\??\c:\ffffrff.exec:\ffffrff.exe90⤵PID:2136
-
\??\c:\llfxlfx.exec:\llfxlfx.exe91⤵PID:3552
-
\??\c:\htnnnh.exec:\htnnnh.exe92⤵PID:396
-
\??\c:\vjddp.exec:\vjddp.exe93⤵PID:1224
-
\??\c:\rllfrrl.exec:\rllfrrl.exe94⤵PID:5020
-
\??\c:\xxlrfff.exec:\xxlrfff.exe95⤵PID:1900
-
\??\c:\tnnnbb.exec:\tnnnbb.exe96⤵PID:232
-
\??\c:\ntbbnn.exec:\ntbbnn.exe97⤵PID:3828
-
\??\c:\pdvpp.exec:\pdvpp.exe98⤵PID:4416
-
\??\c:\rrxfrxr.exec:\rrxfrxr.exe99⤵PID:3968
-
\??\c:\nhtbnn.exec:\nhtbnn.exe100⤵PID:2612
-
\??\c:\nbbnnn.exec:\nbbnnn.exe101⤵PID:2428
-
\??\c:\jjpdv.exec:\jjpdv.exe102⤵PID:1036
-
\??\c:\7lfxrfl.exec:\7lfxrfl.exe103⤵PID:1768
-
\??\c:\nbthhh.exec:\nbthhh.exe104⤵PID:548
-
\??\c:\bnthhh.exec:\bnthhh.exe105⤵PID:1496
-
\??\c:\vvddd.exec:\vvddd.exe106⤵PID:1732
-
\??\c:\3lrllfr.exec:\3lrllfr.exe107⤵PID:3624
-
\??\c:\frrfxfx.exec:\frrfxfx.exe108⤵PID:1444
-
\??\c:\tbbtnh.exec:\tbbtnh.exe109⤵PID:1472
-
\??\c:\tnnhbb.exec:\tnnhbb.exe110⤵PID:4480
-
\??\c:\1dvvj.exec:\1dvvj.exe111⤵PID:2200
-
\??\c:\pvdvv.exec:\pvdvv.exe112⤵PID:3980
-
\??\c:\rlfxlll.exec:\rlfxlll.exe113⤵PID:428
-
\??\c:\tthbtt.exec:\tthbtt.exe114⤵PID:3088
-
\??\c:\hnntth.exec:\hnntth.exe115⤵PID:1652
-
\??\c:\ddppd.exec:\ddppd.exe116⤵PID:4240
-
\??\c:\7rrrllf.exec:\7rrrllf.exe117⤵PID:3328
-
\??\c:\hnbnnb.exec:\hnbnnb.exe118⤵PID:2436
-
\??\c:\3jjdv.exec:\3jjdv.exe119⤵PID:1908
-
\??\c:\vvdjp.exec:\vvdjp.exe120⤵PID:1364
-
\??\c:\xlffllr.exec:\xlffllr.exe121⤵PID:4120
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe122⤵PID:956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-