Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c.exe
-
Size
67KB
-
MD5
08f776fa66adaa2709be6cd8ab81f792
-
SHA1
c69f0d2c0aa0e10e5f0be035b1464d4dc510909b
-
SHA256
3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c
-
SHA512
fc7c9fb4994b098b1414e06bf7967f8f9d686fe06d383a55cba8e85a7f5d410a43b0cd7ab33111a3f124709fe93d3a983273ae2ae6a979e3d6ee18cf0075012a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLrx:ymb3NkkiQ3mdBjFIvl358nLrx
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/680-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/680-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5052-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1852-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2596-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1132-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4752-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4752-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2676-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4924-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5004-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1904-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4348-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4568-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4396-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5040-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3764-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/228-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4272-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3184-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 5052 pvvpj.exe 1852 vjpjv.exe 2596 hnbtnn.exe 1132 tthbbb.exe 4752 jpjdv.exe 1956 9fxrffr.exe 4572 lffxrrr.exe 2676 bbbttn.exe 4228 pvvjd.exe 1680 pjjdv.exe 4924 1rxxllf.exe 908 thbnhh.exe 5004 7jdvj.exe 1904 flrlllf.exe 4348 htbnbn.exe 4568 3bbthn.exe 4396 ppdpv.exe 5040 lfxlfrr.exe 3764 hbbbtt.exe 228 btbtnb.exe 4272 pddvp.exe 1856 xrfxllr.exe 3184 bhnhtt.exe 3864 bttnbb.exe 2444 vvdvp.exe 372 jjpjp.exe 1452 3rrlxfr.exe 4676 hbbnnn.exe 2696 5btnbb.exe 5000 nnttbb.exe 1020 tnttbb.exe 4608 jpppd.exe 4500 xrlfxxr.exe 3488 nhbbtt.exe 4968 tbhhbt.exe 1072 vjjjd.exe 4296 lxxlfxx.exe 4360 tbbbnn.exe 3840 3vjjv.exe 3308 jdvvp.exe 740 llfxrll.exe 692 hhnntt.exe 1164 jpvjd.exe 1236 lfffxrf.exe 512 nthtbn.exe 1968 jdvpp.exe 4684 jpjdp.exe 3984 fxxxrll.exe 4556 7nttnb.exe 4784 jjdjd.exe 1440 dpvpp.exe 2684 5flllll.exe 2560 xrrrrrl.exe 4256 tnnbtb.exe 2528 vpvvd.exe 3876 vjjdp.exe 2868 lrlffrl.exe 4652 xflfxrl.exe 64 5nnhhb.exe 1084 nbbthb.exe 5024 ddvvj.exe 1920 pvpjd.exe 32 3xlfrlf.exe 1100 frllffx.exe -
resource yara_rule behavioral2/memory/680-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-193-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 680 wrote to memory of 5052 680 3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c.exe 82 PID 680 wrote to memory of 5052 680 3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c.exe 82 PID 680 wrote to memory of 5052 680 3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c.exe 82 PID 5052 wrote to memory of 1852 5052 pvvpj.exe 83 PID 5052 wrote to memory of 1852 5052 pvvpj.exe 83 PID 5052 wrote to memory of 1852 5052 pvvpj.exe 83 PID 1852 wrote to memory of 2596 1852 vjpjv.exe 84 PID 1852 wrote to memory of 2596 1852 vjpjv.exe 84 PID 1852 wrote to memory of 2596 1852 vjpjv.exe 84 PID 2596 wrote to memory of 1132 2596 hnbtnn.exe 85 PID 2596 wrote to memory of 1132 2596 hnbtnn.exe 85 PID 2596 wrote to memory of 1132 2596 hnbtnn.exe 85 PID 1132 wrote to memory of 4752 1132 tthbbb.exe 86 PID 1132 wrote to memory of 4752 1132 tthbbb.exe 86 PID 1132 wrote to memory of 4752 1132 tthbbb.exe 86 PID 4752 wrote to memory of 1956 4752 jpjdv.exe 87 PID 4752 wrote to memory of 1956 4752 jpjdv.exe 87 PID 4752 wrote to memory of 1956 4752 jpjdv.exe 87 PID 1956 wrote to memory of 4572 1956 9fxrffr.exe 88 PID 1956 wrote to memory of 4572 1956 9fxrffr.exe 88 PID 1956 wrote to memory of 4572 1956 9fxrffr.exe 88 PID 4572 wrote to memory of 2676 4572 lffxrrr.exe 89 PID 4572 wrote to memory of 2676 4572 lffxrrr.exe 89 PID 4572 wrote to memory of 2676 4572 lffxrrr.exe 89 PID 2676 wrote to memory of 4228 2676 bbbttn.exe 90 PID 2676 wrote to memory of 4228 2676 bbbttn.exe 90 PID 2676 wrote to memory of 4228 2676 bbbttn.exe 90 PID 4228 wrote to memory of 1680 4228 pvvjd.exe 91 PID 4228 wrote to memory of 1680 4228 pvvjd.exe 91 PID 4228 wrote to memory of 1680 4228 pvvjd.exe 91 PID 1680 wrote to memory of 4924 1680 pjjdv.exe 92 PID 1680 wrote to memory of 4924 1680 pjjdv.exe 92 PID 1680 wrote to memory of 4924 1680 pjjdv.exe 92 PID 4924 wrote to memory of 908 4924 1rxxllf.exe 93 PID 4924 wrote to memory of 908 4924 1rxxllf.exe 93 PID 4924 wrote to memory of 908 4924 1rxxllf.exe 93 PID 908 wrote to memory of 5004 908 thbnhh.exe 94 PID 908 wrote to memory of 5004 908 thbnhh.exe 94 PID 908 wrote to memory of 5004 908 thbnhh.exe 94 PID 5004 wrote to memory of 1904 5004 7jdvj.exe 95 PID 5004 wrote to memory of 1904 5004 7jdvj.exe 95 PID 5004 wrote to memory of 1904 5004 7jdvj.exe 95 PID 1904 wrote to memory of 4348 1904 flrlllf.exe 96 PID 1904 wrote to memory of 4348 1904 flrlllf.exe 96 PID 1904 wrote to memory of 4348 1904 flrlllf.exe 96 PID 4348 wrote to memory of 4568 4348 htbnbn.exe 97 PID 4348 wrote to memory of 4568 4348 htbnbn.exe 97 PID 4348 wrote to memory of 4568 4348 htbnbn.exe 97 PID 4568 wrote to memory of 4396 4568 3bbthn.exe 98 PID 4568 wrote to memory of 4396 4568 3bbthn.exe 98 PID 4568 wrote to memory of 4396 4568 3bbthn.exe 98 PID 4396 wrote to memory of 5040 4396 ppdpv.exe 99 PID 4396 wrote to memory of 5040 4396 ppdpv.exe 99 PID 4396 wrote to memory of 5040 4396 ppdpv.exe 99 PID 5040 wrote to memory of 3764 5040 lfxlfrr.exe 100 PID 5040 wrote to memory of 3764 5040 lfxlfrr.exe 100 PID 5040 wrote to memory of 3764 5040 lfxlfrr.exe 100 PID 3764 wrote to memory of 228 3764 hbbbtt.exe 101 PID 3764 wrote to memory of 228 3764 hbbbtt.exe 101 PID 3764 wrote to memory of 228 3764 hbbbtt.exe 101 PID 228 wrote to memory of 4272 228 btbtnb.exe 102 PID 228 wrote to memory of 4272 228 btbtnb.exe 102 PID 228 wrote to memory of 4272 228 btbtnb.exe 102 PID 4272 wrote to memory of 1856 4272 pddvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c.exe"C:\Users\Admin\AppData\Local\Temp\3ae0de75564dd6ed8fafb2016d82010d438144f77bdbd5fdd4bd9e61f9af982c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\pvvpj.exec:\pvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\vjpjv.exec:\vjpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\hnbtnn.exec:\hnbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\tthbbb.exec:\tthbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\jpjdv.exec:\jpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\9fxrffr.exec:\9fxrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\lffxrrr.exec:\lffxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\bbbttn.exec:\bbbttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pvvjd.exec:\pvvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\pjjdv.exec:\pjjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\1rxxllf.exec:\1rxxllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\thbnhh.exec:\thbnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\7jdvj.exec:\7jdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\flrlllf.exec:\flrlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\htbnbn.exec:\htbnbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\3bbthn.exec:\3bbthn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\ppdpv.exec:\ppdpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\lfxlfrr.exec:\lfxlfrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\hbbbtt.exec:\hbbbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\btbtnb.exec:\btbtnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\pddvp.exec:\pddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\xrfxllr.exec:\xrfxllr.exe23⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bhnhtt.exec:\bhnhtt.exe24⤵
- Executes dropped EXE
PID:3184 -
\??\c:\bttnbb.exec:\bttnbb.exe25⤵
- Executes dropped EXE
PID:3864 -
\??\c:\vvdvp.exec:\vvdvp.exe26⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jjpjp.exec:\jjpjp.exe27⤵
- Executes dropped EXE
PID:372 -
\??\c:\3rrlxfr.exec:\3rrlxfr.exe28⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hbbnnn.exec:\hbbnnn.exe29⤵
- Executes dropped EXE
PID:4676 -
\??\c:\5btnbb.exec:\5btnbb.exe30⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nnttbb.exec:\nnttbb.exe31⤵
- Executes dropped EXE
PID:5000 -
\??\c:\tnttbb.exec:\tnttbb.exe32⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jpppd.exec:\jpppd.exe33⤵
- Executes dropped EXE
PID:4608 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe34⤵
- Executes dropped EXE
PID:4500 -
\??\c:\nhbbtt.exec:\nhbbtt.exe35⤵
- Executes dropped EXE
PID:3488 -
\??\c:\tbhhbt.exec:\tbhhbt.exe36⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vjjjd.exec:\vjjjd.exe37⤵
- Executes dropped EXE
PID:1072 -
\??\c:\lxxlfxx.exec:\lxxlfxx.exe38⤵
- Executes dropped EXE
PID:4296 -
\??\c:\tbbbnn.exec:\tbbbnn.exe39⤵
- Executes dropped EXE
PID:4360 -
\??\c:\3vjjv.exec:\3vjjv.exe40⤵
- Executes dropped EXE
PID:3840 -
\??\c:\jdvvp.exec:\jdvvp.exe41⤵
- Executes dropped EXE
PID:3308 -
\??\c:\llfxrll.exec:\llfxrll.exe42⤵
- Executes dropped EXE
PID:740 -
\??\c:\hhnntt.exec:\hhnntt.exe43⤵
- Executes dropped EXE
PID:692 -
\??\c:\jpvjd.exec:\jpvjd.exe44⤵
- Executes dropped EXE
PID:1164 -
\??\c:\lfffxrf.exec:\lfffxrf.exe45⤵
- Executes dropped EXE
PID:1236 -
\??\c:\nthtbn.exec:\nthtbn.exe46⤵
- Executes dropped EXE
PID:512 -
\??\c:\jdvpp.exec:\jdvpp.exe47⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jpjdp.exec:\jpjdp.exe48⤵
- Executes dropped EXE
PID:4684 -
\??\c:\fxxxrll.exec:\fxxxrll.exe49⤵
- Executes dropped EXE
PID:3984 -
\??\c:\7nttnb.exec:\7nttnb.exe50⤵
- Executes dropped EXE
PID:4556 -
\??\c:\jjdjd.exec:\jjdjd.exe51⤵
- Executes dropped EXE
PID:4784 -
\??\c:\dpvpp.exec:\dpvpp.exe52⤵
- Executes dropped EXE
PID:1440 -
\??\c:\5flllll.exec:\5flllll.exe53⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe54⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tnnbtb.exec:\tnnbtb.exe55⤵
- Executes dropped EXE
PID:4256 -
\??\c:\vpvvd.exec:\vpvvd.exe56⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vjjdp.exec:\vjjdp.exe57⤵
- Executes dropped EXE
PID:3876 -
\??\c:\lrlffrl.exec:\lrlffrl.exe58⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xflfxrl.exec:\xflfxrl.exe59⤵
- Executes dropped EXE
PID:4652 -
\??\c:\5nnhhb.exec:\5nnhhb.exe60⤵
- Executes dropped EXE
PID:64 -
\??\c:\nbbthb.exec:\nbbthb.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ddvvj.exec:\ddvvj.exe62⤵
- Executes dropped EXE
PID:5024 -
\??\c:\pvpjd.exec:\pvpjd.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3xlfrlf.exec:\3xlfrlf.exe64⤵
- Executes dropped EXE
PID:32 -
\??\c:\frllffx.exec:\frllffx.exe65⤵
- Executes dropped EXE
PID:1100 -
\??\c:\5hhbtb.exec:\5hhbtb.exe66⤵PID:3868
-
\??\c:\tnhthh.exec:\tnhthh.exe67⤵PID:4412
-
\??\c:\7djdp.exec:\7djdp.exe68⤵PID:2960
-
\??\c:\3dvpd.exec:\3dvpd.exe69⤵PID:4388
-
\??\c:\xrfxrll.exec:\xrfxrll.exe70⤵PID:3712
-
\??\c:\rlxrlll.exec:\rlxrlll.exe71⤵PID:2444
-
\??\c:\nnnnhh.exec:\nnnnhh.exe72⤵PID:3532
-
\??\c:\nhnnnh.exec:\nhnnnh.exe73⤵PID:1592
-
\??\c:\vjjdp.exec:\vjjdp.exe74⤵PID:536
-
\??\c:\1xrlfxx.exec:\1xrlfxx.exe75⤵PID:4676
-
\??\c:\rlxfxff.exec:\rlxfxff.exe76⤵PID:2032
-
\??\c:\hnhhbb.exec:\hnhhbb.exe77⤵PID:4896
-
\??\c:\nnbbtt.exec:\nnbbtt.exe78⤵PID:3872
-
\??\c:\9xfxrlf.exec:\9xfxrlf.exe79⤵PID:4768
-
\??\c:\bthhbb.exec:\bthhbb.exe80⤵PID:5008
-
\??\c:\hbttnn.exec:\hbttnn.exe81⤵PID:4672
-
\??\c:\pdvjv.exec:\pdvjv.exe82⤵PID:4900
-
\??\c:\vpdvv.exec:\vpdvv.exe83⤵PID:3536
-
\??\c:\lffrfrl.exec:\lffrfrl.exe84⤵PID:2944
-
\??\c:\lfllfxx.exec:\lfllfxx.exe85⤵PID:4296
-
\??\c:\3tbbth.exec:\3tbbth.exe86⤵PID:3104
-
\??\c:\jvpdv.exec:\jvpdv.exe87⤵PID:4280
-
\??\c:\7lfxllf.exec:\7lfxllf.exe88⤵PID:804
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe89⤵PID:3296
-
\??\c:\nbhhbt.exec:\nbhhbt.exe90⤵PID:800
-
\??\c:\pvvjd.exec:\pvvjd.exe91⤵PID:1944
-
\??\c:\vvpjp.exec:\vvpjp.exe92⤵PID:2996
-
\??\c:\flffrrr.exec:\flffrrr.exe93⤵PID:2784
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe94⤵PID:1880
-
\??\c:\bntnhb.exec:\bntnhb.exe95⤵PID:2676
-
\??\c:\5ddpd.exec:\5ddpd.exe96⤵PID:3056
-
\??\c:\ddjjd.exec:\ddjjd.exe97⤵PID:4956
-
\??\c:\fxrrlll.exec:\fxrrlll.exe98⤵PID:4920
-
\??\c:\fffxrfx.exec:\fffxrfx.exe99⤵PID:2812
-
\??\c:\ntttnn.exec:\ntttnn.exe100⤵PID:2684
-
\??\c:\jvdjp.exec:\jvdjp.exe101⤵PID:2560
-
\??\c:\lllrlrl.exec:\lllrlrl.exe102⤵PID:2584
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe103⤵PID:1700
-
\??\c:\hnhhhb.exec:\hnhhhb.exe104⤵PID:4232
-
\??\c:\3hnnnt.exec:\3hnnnt.exe105⤵PID:1260
-
\??\c:\dpdpp.exec:\dpdpp.exe106⤵PID:4652
-
\??\c:\7xxrfxx.exec:\7xxrfxx.exe107⤵PID:64
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe108⤵PID:1084
-
\??\c:\hhbbtt.exec:\hhbbtt.exe109⤵PID:5024
-
\??\c:\hbbtnh.exec:\hbbtnh.exe110⤵PID:1920
-
\??\c:\vppjp.exec:\vppjp.exe111⤵PID:32
-
\??\c:\vjjdp.exec:\vjjdp.exe112⤵PID:1276
-
\??\c:\rrfxrfx.exec:\rrfxrfx.exe113⤵PID:1856
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe114⤵PID:4412
-
\??\c:\nhtntt.exec:\nhtntt.exe115⤵PID:3964
-
\??\c:\bthhtt.exec:\bthhtt.exe116⤵PID:4580
-
\??\c:\5ddvj.exec:\5ddvj.exe117⤵PID:1460
-
\??\c:\pvvpj.exec:\pvvpj.exe118⤵PID:1428
-
\??\c:\xrxxxff.exec:\xrxxxff.exe119⤵PID:1452
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe120⤵PID:3304
-
\??\c:\3hhnhb.exec:\3hhnhb.exe121⤵PID:5112
-
\??\c:\djvjd.exec:\djvjd.exe122⤵PID:4552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-