Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target 0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78.exe
- Size 73KB
- Sample240613-xvcbpssdml
- SHA256 0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78
- MD5 bd477f1d0006042416c54cf1691b643a
- SHA1 5a9d8c85b5c0f2b680297bbb40ba09ce72ae17d3
- SHA512 190906ea01e9b8e5c0ce5f5d0f23e32d4c531c152caaaad15feeff50d0cd171847fa882dddef560bb77037f6aef187403d62e17d974a8ee248dfe4d8cc700fb4
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPVxpS:ymb3NkkiQ3mdBjFIfvTfCD+HlQLk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/244-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4604-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/688-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2124-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4284-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4340-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/244-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2348-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2348-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2348-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2348-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2520-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4544-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3832-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4524-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1060-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3520-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1072-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/316-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4148-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4112-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/884-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/436-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4792-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2640-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5020-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4896 hhhbtn.exe 688 nbhbbb.exe 4604 5lfffll.exe 2124 5lffffl.exe 4284 hbnbbn.exe 4340 jdddj.exe 244 vvvpd.exe 2348 9ffffrf.exe 2520 hthbbt.exe 4544 vpjpv.exe 4264 frllflf.exe 3832 nnhhhn.exe 4524 pjjjd.exe 1060 9dvvp.exe 3520 xrrfxxx.exe 1072 1hhhnn.exe 316 vvpjj.exe 2844 fllxrrf.exe 4148 5flfrlx.exe 4648 ntbnnn.exe 4112 rlrrflf.exe 3480 xrxrlfx.exe 884 thnnnb.exe 3192 7thnnb.exe 436 jjpjj.exe 4904 3frxrrr.exe 4792 nntbbb.exe 2640 nhnhbb.exe 5020 pdjvd.exe 3752 1xlrffr.exe 3120 tntttt.exe 4092 ddppj.exe 3516 jvdpp.exe 516 rlllfll.exe 2032 lrffflf.exe 992 hhnthn.exe 1668 djpvd.exe 2968 vvvpd.exe 528 rfffxff.exe 3436 5hbhhh.exe 688 nnbntb.exe 4604 vvpvp.exe 1908 xrfflxx.exe 4044 flflrfl.exe 2872 tntnnn.exe 4912 jvvdp.exe 244 jjvpd.exe 5108 flxxrxr.exe 4252 fxxllxr.exe 2496 hbthbh.exe 4244 hbbbtt.exe 1280 dpvvp.exe 4744 vpppp.exe 2100 frllllx.exe 3048 rrxlxxx.exe 1560 7bhhbb.exe 632 nhhtbn.exe 1496 jjppj.exe 2172 xrrllrl.exe 4356 xxlllll.exe 1924 hhnnnn.exe 1632 ppddv.exe 4312 jddpj.exe 2016 7lffxfl.exe -
resource yara_rule behavioral2/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/244-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-194-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 4896 2196 0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78.exe 81 PID 2196 wrote to memory of 4896 2196 0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78.exe 81 PID 2196 wrote to memory of 4896 2196 0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78.exe 81 PID 4896 wrote to memory of 688 4896 hhhbtn.exe 82 PID 4896 wrote to memory of 688 4896 hhhbtn.exe 82 PID 4896 wrote to memory of 688 4896 hhhbtn.exe 82 PID 688 wrote to memory of 4604 688 nbhbbb.exe 83 PID 688 wrote to memory of 4604 688 nbhbbb.exe 83 PID 688 wrote to memory of 4604 688 nbhbbb.exe 83 PID 4604 wrote to memory of 2124 4604 5lfffll.exe 84 PID 4604 wrote to memory of 2124 4604 5lfffll.exe 84 PID 4604 wrote to memory of 2124 4604 5lfffll.exe 84 PID 2124 wrote to memory of 4284 2124 5lffffl.exe 85 PID 2124 wrote to memory of 4284 2124 5lffffl.exe 85 PID 2124 wrote to memory of 4284 2124 5lffffl.exe 85 PID 4284 wrote to memory of 4340 4284 hbnbbn.exe 86 PID 4284 wrote to memory of 4340 4284 hbnbbn.exe 86 PID 4284 wrote to memory of 4340 4284 hbnbbn.exe 86 PID 4340 wrote to memory of 244 4340 jdddj.exe 87 PID 4340 wrote to memory of 244 4340 jdddj.exe 87 PID 4340 wrote to memory of 244 4340 jdddj.exe 87 PID 244 wrote to memory of 2348 244 vvvpd.exe 88 PID 244 wrote to memory of 2348 244 vvvpd.exe 88 PID 244 wrote to memory of 2348 244 vvvpd.exe 88 PID 2348 wrote to memory of 2520 2348 9ffffrf.exe 89 PID 2348 wrote to memory of 2520 2348 9ffffrf.exe 89 PID 2348 wrote to memory of 2520 2348 9ffffrf.exe 89 PID 2520 wrote to memory of 4544 2520 hthbbt.exe 90 PID 2520 wrote to memory of 4544 2520 hthbbt.exe 90 PID 2520 wrote to memory of 4544 2520 hthbbt.exe 90 PID 4544 wrote to memory of 4264 4544 vpjpv.exe 91 PID 4544 wrote to memory of 4264 4544 vpjpv.exe 91 PID 4544 wrote to memory of 4264 4544 vpjpv.exe 91 PID 4264 wrote to memory of 3832 4264 frllflf.exe 92 PID 4264 wrote to memory of 3832 4264 frllflf.exe 92 PID 4264 wrote to memory of 3832 4264 frllflf.exe 92 PID 3832 wrote to memory of 4524 3832 nnhhhn.exe 94 PID 3832 wrote to memory of 4524 3832 nnhhhn.exe 94 PID 3832 wrote to memory of 4524 3832 nnhhhn.exe 94 PID 4524 wrote to memory of 1060 4524 pjjjd.exe 95 PID 4524 wrote to memory of 1060 4524 pjjjd.exe 95 PID 4524 wrote to memory of 1060 4524 pjjjd.exe 95 PID 1060 wrote to memory of 3520 1060 9dvvp.exe 96 PID 1060 wrote to memory of 3520 1060 9dvvp.exe 96 PID 1060 wrote to memory of 3520 1060 9dvvp.exe 96 PID 3520 wrote to memory of 1072 3520 xrrfxxx.exe 97 PID 3520 wrote to memory of 1072 3520 xrrfxxx.exe 97 PID 3520 wrote to memory of 1072 3520 xrrfxxx.exe 97 PID 1072 wrote to memory of 316 1072 1hhhnn.exe 98 PID 1072 wrote to memory of 316 1072 1hhhnn.exe 98 PID 1072 wrote to memory of 316 1072 1hhhnn.exe 98 PID 316 wrote to memory of 2844 316 vvpjj.exe 99 PID 316 wrote to memory of 2844 316 vvpjj.exe 99 PID 316 wrote to memory of 2844 316 vvpjj.exe 99 PID 2844 wrote to memory of 4148 2844 fllxrrf.exe 100 PID 2844 wrote to memory of 4148 2844 fllxrrf.exe 100 PID 2844 wrote to memory of 4148 2844 fllxrrf.exe 100 PID 4148 wrote to memory of 4648 4148 5flfrlx.exe 101 PID 4148 wrote to memory of 4648 4148 5flfrlx.exe 101 PID 4148 wrote to memory of 4648 4148 5flfrlx.exe 101 PID 4648 wrote to memory of 4112 4648 ntbnnn.exe 102 PID 4648 wrote to memory of 4112 4648 ntbnnn.exe 102 PID 4648 wrote to memory of 4112 4648 ntbnnn.exe 102 PID 4112 wrote to memory of 3480 4112 rlrrflf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78.exe"C:\Users\Admin\AppData\Local\Temp\0cd7f7927d293a9bf64043101eea2465ded3b5dee9fff421909e755ffd67dd78.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\hhhbtn.exec:\hhhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\nbhbbb.exec:\nbhbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\5lfffll.exec:\5lfffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\5lffffl.exec:\5lffffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hbnbbn.exec:\hbnbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\jdddj.exec:\jdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\vvvpd.exec:\vvvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\9ffffrf.exec:\9ffffrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\hthbbt.exec:\hthbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vpjpv.exec:\vpjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\frllflf.exec:\frllflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\nnhhhn.exec:\nnhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\pjjjd.exec:\pjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\9dvvp.exec:\9dvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\xrrfxxx.exec:\xrrfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\1hhhnn.exec:\1hhhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\vvpjj.exec:\vvpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\fllxrrf.exec:\fllxrrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5flfrlx.exec:\5flfrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\ntbnnn.exec:\ntbnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\rlrrflf.exec:\rlrrflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\xrxrlfx.exec:\xrxrlfx.exe23⤵
- Executes dropped EXE
PID:3480 -
\??\c:\thnnnb.exec:\thnnnb.exe24⤵
- Executes dropped EXE
PID:884 -
\??\c:\7thnnb.exec:\7thnnb.exe25⤵
- Executes dropped EXE
PID:3192 -
\??\c:\jjpjj.exec:\jjpjj.exe26⤵
- Executes dropped EXE
PID:436 -
\??\c:\3frxrrr.exec:\3frxrrr.exe27⤵
- Executes dropped EXE
PID:4904 -
\??\c:\nntbbb.exec:\nntbbb.exe28⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nhnhbb.exec:\nhnhbb.exe29⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdjvd.exec:\pdjvd.exe30⤵
- Executes dropped EXE
PID:5020 -
\??\c:\1xlrffr.exec:\1xlrffr.exe31⤵
- Executes dropped EXE
PID:3752 -
\??\c:\tntttt.exec:\tntttt.exe32⤵
- Executes dropped EXE
PID:3120 -
\??\c:\ddppj.exec:\ddppj.exe33⤵
- Executes dropped EXE
PID:4092 -
\??\c:\jvdpp.exec:\jvdpp.exe34⤵
- Executes dropped EXE
PID:3516 -
\??\c:\rlllfll.exec:\rlllfll.exe35⤵
- Executes dropped EXE
PID:516 -
\??\c:\lrffflf.exec:\lrffflf.exe36⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hhnthn.exec:\hhnthn.exe37⤵
- Executes dropped EXE
PID:992 -
\??\c:\djpvd.exec:\djpvd.exe38⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vvvpd.exec:\vvvpd.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rfffxff.exec:\rfffxff.exe40⤵
- Executes dropped EXE
PID:528 -
\??\c:\5hbhhh.exec:\5hbhhh.exe41⤵
- Executes dropped EXE
PID:3436 -
\??\c:\nnbntb.exec:\nnbntb.exe42⤵
- Executes dropped EXE
PID:688 -
\??\c:\vvpvp.exec:\vvpvp.exe43⤵
- Executes dropped EXE
PID:4604 -
\??\c:\xrfflxx.exec:\xrfflxx.exe44⤵
- Executes dropped EXE
PID:1908 -
\??\c:\flflrfl.exec:\flflrfl.exe45⤵
- Executes dropped EXE
PID:4044 -
\??\c:\tntnnn.exec:\tntnnn.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jvvdp.exec:\jvvdp.exe47⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jjvpd.exec:\jjvpd.exe48⤵
- Executes dropped EXE
PID:244 -
\??\c:\flxxrxr.exec:\flxxrxr.exe49⤵
- Executes dropped EXE
PID:5108 -
\??\c:\fxxllxr.exec:\fxxllxr.exe50⤵
- Executes dropped EXE
PID:4252 -
\??\c:\hbthbh.exec:\hbthbh.exe51⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbbbtt.exec:\hbbbtt.exe52⤵
- Executes dropped EXE
PID:4244 -
\??\c:\dpvvp.exec:\dpvvp.exe53⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vpppp.exec:\vpppp.exe54⤵
- Executes dropped EXE
PID:4744 -
\??\c:\frllllx.exec:\frllllx.exe55⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rrxlxxx.exec:\rrxlxxx.exe56⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7bhhbb.exec:\7bhhbb.exe57⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nhhtbn.exec:\nhhtbn.exe58⤵
- Executes dropped EXE
PID:632 -
\??\c:\jjppj.exec:\jjppj.exe59⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xrrllrl.exec:\xrrllrl.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xxlllll.exec:\xxlllll.exe61⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hhnnnn.exec:\hhnnnn.exe62⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ppddv.exec:\ppddv.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jddpj.exec:\jddpj.exe64⤵
- Executes dropped EXE
PID:4312 -
\??\c:\7lffxfl.exec:\7lffxfl.exe65⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffrrffr.exec:\ffrrffr.exe66⤵PID:1088
-
\??\c:\tthnnh.exec:\tthnnh.exe67⤵PID:3080
-
\??\c:\ppvvd.exec:\ppvvd.exe68⤵PID:2212
-
\??\c:\9vvvv.exec:\9vvvv.exe69⤵PID:2324
-
\??\c:\rfrrxff.exec:\rfrrxff.exe70⤵PID:5032
-
\??\c:\ffrlxrx.exec:\ffrlxrx.exe71⤵PID:2584
-
\??\c:\hbhbbh.exec:\hbhbbh.exe72⤵PID:4404
-
\??\c:\ddvvj.exec:\ddvvj.exe73⤵PID:3212
-
\??\c:\ppjjj.exec:\ppjjj.exe74⤵PID:1948
-
\??\c:\frxxrrx.exec:\frxxrrx.exe75⤵PID:3492
-
\??\c:\nnhhht.exec:\nnhhht.exe76⤵PID:3284
-
\??\c:\btbbbb.exec:\btbbbb.exe77⤵PID:4640
-
\??\c:\jvddp.exec:\jvddp.exe78⤵PID:3228
-
\??\c:\rfrxrxf.exec:\rfrxrxf.exe79⤵PID:5000
-
\??\c:\1lrrlrl.exec:\1lrrlrl.exe80⤵PID:4072
-
\??\c:\tnntbh.exec:\tnntbh.exe81⤵PID:592
-
\??\c:\9jpdd.exec:\9jpdd.exe82⤵PID:1616
-
\??\c:\xlfxrxr.exec:\xlfxrxr.exe83⤵PID:3296
-
\??\c:\hhnnhb.exec:\hhnnhb.exe84⤵PID:3312
-
\??\c:\1btntt.exec:\1btntt.exe85⤵PID:4576
-
\??\c:\rxxrxxr.exec:\rxxrxxr.exe86⤵PID:4896
-
\??\c:\lrfrffx.exec:\lrfrffx.exe87⤵PID:4872
-
\??\c:\ntbbbb.exec:\ntbbbb.exe88⤵PID:4564
-
\??\c:\3vjjd.exec:\3vjjd.exe89⤵PID:1648
-
\??\c:\7pvvv.exec:\7pvvv.exe90⤵PID:3696
-
\??\c:\rllrlfl.exec:\rllrlfl.exe91⤵PID:2768
-
\??\c:\hntntt.exec:\hntntt.exe92⤵PID:1344
-
\??\c:\bthhbb.exec:\bthhbb.exe93⤵PID:2884
-
\??\c:\dddjj.exec:\dddjj.exe94⤵PID:4908
-
\??\c:\1djdv.exec:\1djdv.exe95⤵PID:4536
-
\??\c:\djjjj.exec:\djjjj.exe96⤵PID:4780
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe97⤵PID:4568
-
\??\c:\rfrrlll.exec:\rfrrlll.exe98⤵PID:4700
-
\??\c:\nhnnnt.exec:\nhnnnt.exe99⤵PID:3340
-
\??\c:\ddpdd.exec:\ddpdd.exe100⤵PID:4524
-
\??\c:\vpdjj.exec:\vpdjj.exe101⤵PID:4992
-
\??\c:\lxxxfxl.exec:\lxxxfxl.exe102⤵PID:2260
-
\??\c:\7fllflf.exec:\7fllflf.exe103⤵PID:3064
-
\??\c:\nhtbbn.exec:\nhtbbn.exe104⤵PID:4696
-
\??\c:\vjpjd.exec:\vjpjd.exe105⤵PID:316
-
\??\c:\7jppp.exec:\7jppp.exe106⤵PID:4056
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe107⤵PID:2428
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe108⤵PID:2708
-
\??\c:\1nnnnn.exec:\1nnnnn.exe109⤵PID:3676
-
\??\c:\7vddv.exec:\7vddv.exe110⤵PID:4864
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe111⤵PID:2092
-
\??\c:\1lxxxfl.exec:\1lxxxfl.exe112⤵PID:5028
-
\??\c:\hhnnnn.exec:\hhnnnn.exe113⤵PID:3872
-
\??\c:\nnbbtt.exec:\nnbbtt.exe114⤵PID:3612
-
\??\c:\3pvpj.exec:\3pvpj.exe115⤵PID:2908
-
\??\c:\djvvp.exec:\djvvp.exe116⤵PID:3280
-
\??\c:\llfffll.exec:\llfffll.exe117⤵PID:1512
-
\??\c:\rfllrxr.exec:\rfllrxr.exe118⤵PID:3212
-
\??\c:\hbttnn.exec:\hbttnn.exe119⤵PID:1948
-
\??\c:\tnntnt.exec:\tnntnt.exe120⤵PID:3492
-
\??\c:\7dppv.exec:\7dppv.exe121⤵PID:824
-
\??\c:\vvjjj.exec:\vvjjj.exe122⤵PID:4640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-