Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 18:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69.exe
-
Size
61KB
-
MD5
7c1651b6adf4912bdc3760c129c79a1c
-
SHA1
1e3ab0acec576f8fbe4cd35a1d6c46dd9597234f
-
SHA256
10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69
-
SHA512
b58b96bbd23291b32ced209c8b6dbfaf49c647fa66ba95793420e7009cd62ceb5d4ace68aee5aca083de27335921b86e79fbf9d058fbb59001e4602538818d5b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27r:ymb3NkkiQ3mdBjFI9a
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
resource yara_rule behavioral2/memory/380-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-33-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/380-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1332-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4676-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3584-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4504-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4496-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3652-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4384-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4384-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4384-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3644-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3644-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1544-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3604-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1688-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2920-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5108-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2820-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3444-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4920-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1152-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1716-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2080-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3340-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3052-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1332 pvvpj.exe 4676 llflxxl.exe 2816 3tbtbt.exe 4496 5tbtnh.exe 4504 jvdvp.exe 3584 dvjjd.exe 3652 xlfxllf.exe 464 hhhbtn.exe 4384 vddvp.exe 3644 rrxrlfx.exe 5044 1ffrfxr.exe 4952 bnhhbt.exe 1544 pjvpv.exe 3604 1ffxrfx.exe 1688 9nnhbt.exe 2920 vpdpv.exe 5108 lxrfrlf.exe 2820 bhhbtn.exe 2148 bnnhnn.exe 3444 pjpvv.exe 4920 fxrlxrl.exe 4036 ttthbb.exe 1152 tthbhb.exe 4224 1rxlfxf.exe 1716 rrrrlfr.exe 2080 tnnhtt.exe 3340 jvdvj.exe 4236 1flxlxl.exe 2384 bnnhbb.exe 1784 ntthtb.exe 3052 vppjv.exe 4184 9rlxlfx.exe 3724 5xrlxxr.exe 4684 hbtnbt.exe 3704 1vppj.exe 3024 dpjvp.exe 3344 lfffxxx.exe 1952 rrrfxxr.exe 4724 hntbtt.exe 4872 nhhbnn.exe 3844 vpvjj.exe 2288 vjdpj.exe 1820 fxlffxr.exe 3732 rlllfxr.exe 1480 bbnnbb.exe 2060 tnbthh.exe 4072 ppjdp.exe 4068 pvvpd.exe 1864 rllrrlr.exe 4516 lfrlfxx.exe 3116 nbbbtn.exe 3304 vpjdp.exe 1604 pjpjv.exe 2420 jjjdj.exe 4676 frfrlfl.exe 2816 3ttnbt.exe 3448 bnnhtn.exe 2556 hhnbhb.exe 4240 vdvpd.exe 3584 xrlfllf.exe 464 rffrfxl.exe 1860 7bbtth.exe 3332 hbtnbt.exe 3508 ppjjv.exe -
resource yara_rule behavioral2/memory/380-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 380 wrote to memory of 1332 380 10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69.exe 81 PID 380 wrote to memory of 1332 380 10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69.exe 81 PID 380 wrote to memory of 1332 380 10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69.exe 81 PID 1332 wrote to memory of 4676 1332 pvvpj.exe 82 PID 1332 wrote to memory of 4676 1332 pvvpj.exe 82 PID 1332 wrote to memory of 4676 1332 pvvpj.exe 82 PID 4676 wrote to memory of 2816 4676 llflxxl.exe 83 PID 4676 wrote to memory of 2816 4676 llflxxl.exe 83 PID 4676 wrote to memory of 2816 4676 llflxxl.exe 83 PID 2816 wrote to memory of 4496 2816 3tbtbt.exe 84 PID 2816 wrote to memory of 4496 2816 3tbtbt.exe 84 PID 2816 wrote to memory of 4496 2816 3tbtbt.exe 84 PID 4496 wrote to memory of 4504 4496 5tbtnh.exe 85 PID 4496 wrote to memory of 4504 4496 5tbtnh.exe 85 PID 4496 wrote to memory of 4504 4496 5tbtnh.exe 85 PID 4504 wrote to memory of 3584 4504 jvdvp.exe 86 PID 4504 wrote to memory of 3584 4504 jvdvp.exe 86 PID 4504 wrote to memory of 3584 4504 jvdvp.exe 86 PID 3584 wrote to memory of 3652 3584 dvjjd.exe 87 PID 3584 wrote to memory of 3652 3584 dvjjd.exe 87 PID 3584 wrote to memory of 3652 3584 dvjjd.exe 87 PID 3652 wrote to memory of 464 3652 xlfxllf.exe 88 PID 3652 wrote to memory of 464 3652 xlfxllf.exe 88 PID 3652 wrote to memory of 464 3652 xlfxllf.exe 88 PID 464 wrote to memory of 4384 464 hhhbtn.exe 89 PID 464 wrote to memory of 4384 464 hhhbtn.exe 89 PID 464 wrote to memory of 4384 464 hhhbtn.exe 89 PID 4384 wrote to memory of 3644 4384 vddvp.exe 90 PID 4384 wrote to memory of 3644 4384 vddvp.exe 90 PID 4384 wrote to memory of 3644 4384 vddvp.exe 90 PID 3644 wrote to memory of 5044 3644 rrxrlfx.exe 91 PID 3644 wrote to memory of 5044 3644 rrxrlfx.exe 91 PID 3644 wrote to memory of 5044 3644 rrxrlfx.exe 91 PID 5044 wrote to memory of 4952 5044 1ffrfxr.exe 92 PID 5044 wrote to memory of 4952 5044 1ffrfxr.exe 92 PID 5044 wrote to memory of 4952 5044 1ffrfxr.exe 92 PID 4952 wrote to memory of 1544 4952 bnhhbt.exe 93 PID 4952 wrote to memory of 1544 4952 bnhhbt.exe 93 PID 4952 wrote to memory of 1544 4952 bnhhbt.exe 93 PID 1544 wrote to memory of 3604 1544 pjvpv.exe 94 PID 1544 wrote to memory of 3604 1544 pjvpv.exe 94 PID 1544 wrote to memory of 3604 1544 pjvpv.exe 94 PID 3604 wrote to memory of 1688 3604 1ffxrfx.exe 95 PID 3604 wrote to memory of 1688 3604 1ffxrfx.exe 95 PID 3604 wrote to memory of 1688 3604 1ffxrfx.exe 95 PID 1688 wrote to memory of 2920 1688 9nnhbt.exe 96 PID 1688 wrote to memory of 2920 1688 9nnhbt.exe 96 PID 1688 wrote to memory of 2920 1688 9nnhbt.exe 96 PID 2920 wrote to memory of 5108 2920 vpdpv.exe 97 PID 2920 wrote to memory of 5108 2920 vpdpv.exe 97 PID 2920 wrote to memory of 5108 2920 vpdpv.exe 97 PID 5108 wrote to memory of 2820 5108 lxrfrlf.exe 98 PID 5108 wrote to memory of 2820 5108 lxrfrlf.exe 98 PID 5108 wrote to memory of 2820 5108 lxrfrlf.exe 98 PID 2820 wrote to memory of 2148 2820 bhhbtn.exe 99 PID 2820 wrote to memory of 2148 2820 bhhbtn.exe 99 PID 2820 wrote to memory of 2148 2820 bhhbtn.exe 99 PID 2148 wrote to memory of 3444 2148 bnnhnn.exe 100 PID 2148 wrote to memory of 3444 2148 bnnhnn.exe 100 PID 2148 wrote to memory of 3444 2148 bnnhnn.exe 100 PID 3444 wrote to memory of 4920 3444 pjpvv.exe 101 PID 3444 wrote to memory of 4920 3444 pjpvv.exe 101 PID 3444 wrote to memory of 4920 3444 pjpvv.exe 101 PID 4920 wrote to memory of 4036 4920 fxrlxrl.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69.exe"C:\Users\Admin\AppData\Local\Temp\10fa6a3c879539dc8e7f6ca6fc758313752d13b306f8d131f958e7d6f1255c69.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\pvvpj.exec:\pvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\llflxxl.exec:\llflxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\3tbtbt.exec:\3tbtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\5tbtnh.exec:\5tbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jvdvp.exec:\jvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\dvjjd.exec:\dvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\xlfxllf.exec:\xlfxllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\hhhbtn.exec:\hhhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\vddvp.exec:\vddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\1ffrfxr.exec:\1ffrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\bnhhbt.exec:\bnhhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\pjvpv.exec:\pjvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\1ffxrfx.exec:\1ffxrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\9nnhbt.exec:\9nnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\vpdpv.exec:\vpdpv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\bhhbtn.exec:\bhhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bnnhnn.exec:\bnnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pjpvv.exec:\pjpvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\ttthbb.exec:\ttthbb.exe23⤵
- Executes dropped EXE
PID:4036 -
\??\c:\tthbhb.exec:\tthbhb.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1rxlfxf.exec:\1rxlfxf.exe25⤵
- Executes dropped EXE
PID:4224 -
\??\c:\rrrrlfr.exec:\rrrrlfr.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tnnhtt.exec:\tnnhtt.exe27⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jvdvj.exec:\jvdvj.exe28⤵
- Executes dropped EXE
PID:3340 -
\??\c:\1flxlxl.exec:\1flxlxl.exe29⤵
- Executes dropped EXE
PID:4236 -
\??\c:\bnnhbb.exec:\bnnhbb.exe30⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ntthtb.exec:\ntthtb.exe31⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vppjv.exec:\vppjv.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\9rlxlfx.exec:\9rlxlfx.exe33⤵
- Executes dropped EXE
PID:4184 -
\??\c:\5xrlxxr.exec:\5xrlxxr.exe34⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hbtnbt.exec:\hbtnbt.exe35⤵
- Executes dropped EXE
PID:4684 -
\??\c:\1vppj.exec:\1vppj.exe36⤵
- Executes dropped EXE
PID:3704 -
\??\c:\dpjvp.exec:\dpjvp.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lfffxxx.exec:\lfffxxx.exe38⤵
- Executes dropped EXE
PID:3344 -
\??\c:\rrrfxxr.exec:\rrrfxxr.exe39⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hntbtt.exec:\hntbtt.exe40⤵
- Executes dropped EXE
PID:4724 -
\??\c:\nhhbnn.exec:\nhhbnn.exe41⤵
- Executes dropped EXE
PID:4872 -
\??\c:\vpvjj.exec:\vpvjj.exe42⤵
- Executes dropped EXE
PID:3844 -
\??\c:\vjdpj.exec:\vjdpj.exe43⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fxlffxr.exec:\fxlffxr.exe44⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rlllfxr.exec:\rlllfxr.exe45⤵
- Executes dropped EXE
PID:3732 -
\??\c:\bbnnbb.exec:\bbnnbb.exe46⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tnbthh.exec:\tnbthh.exe47⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ppjdp.exec:\ppjdp.exe48⤵
- Executes dropped EXE
PID:4072 -
\??\c:\pvvpd.exec:\pvvpd.exe49⤵
- Executes dropped EXE
PID:4068 -
\??\c:\rllrrlr.exec:\rllrrlr.exe50⤵
- Executes dropped EXE
PID:1864 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe51⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nbbbtn.exec:\nbbbtn.exe52⤵
- Executes dropped EXE
PID:3116 -
\??\c:\vpjdp.exec:\vpjdp.exe53⤵
- Executes dropped EXE
PID:3304 -
\??\c:\pjpjv.exec:\pjpjv.exe54⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jjjdj.exec:\jjjdj.exe55⤵
- Executes dropped EXE
PID:2420 -
\??\c:\frfrlfl.exec:\frfrlfl.exe56⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3ttnbt.exec:\3ttnbt.exe57⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bnnhtn.exec:\bnnhtn.exe58⤵
- Executes dropped EXE
PID:3448 -
\??\c:\hhnbhb.exec:\hhnbhb.exe59⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vdvpd.exec:\vdvpd.exe60⤵
- Executes dropped EXE
PID:4240 -
\??\c:\xrlfllf.exec:\xrlfllf.exe61⤵
- Executes dropped EXE
PID:3584 -
\??\c:\rffrfxl.exec:\rffrfxl.exe62⤵
- Executes dropped EXE
PID:464 -
\??\c:\7bbtth.exec:\7bbtth.exe63⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hbtnbt.exec:\hbtnbt.exe64⤵
- Executes dropped EXE
PID:3332 -
\??\c:\ppjjv.exec:\ppjjv.exe65⤵
- Executes dropped EXE
PID:3508 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe66⤵PID:1020
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe67⤵PID:2156
-
\??\c:\ntnhbt.exec:\ntnhbt.exe68⤵PID:664
-
\??\c:\tnnbnn.exec:\tnnbnn.exe69⤵PID:3800
-
\??\c:\9dvpd.exec:\9dvpd.exe70⤵PID:640
-
\??\c:\jvvjp.exec:\jvvjp.exe71⤵PID:1380
-
\??\c:\xfxrxrl.exec:\xfxrxrl.exe72⤵PID:1512
-
\??\c:\frrlxrl.exec:\frrlxrl.exe73⤵PID:1688
-
\??\c:\5tbthb.exec:\5tbthb.exe74⤵PID:3596
-
\??\c:\bnnhnn.exec:\bnnhnn.exe75⤵PID:4480
-
\??\c:\vdppj.exec:\vdppj.exe76⤵PID:4164
-
\??\c:\pjddv.exec:\pjddv.exe77⤵PID:1900
-
\??\c:\fflfxxf.exec:\fflfxxf.exe78⤵PID:316
-
\??\c:\ntbbtb.exec:\ntbbtb.exe79⤵PID:3444
-
\??\c:\btnnbb.exec:\btnnbb.exe80⤵PID:1404
-
\??\c:\pdjdv.exec:\pdjdv.exe81⤵PID:3612
-
\??\c:\vjjdv.exec:\vjjdv.exe82⤵PID:1984
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe83⤵PID:2680
-
\??\c:\7jdvp.exec:\7jdvp.exe84⤵PID:1956
-
\??\c:\1pjvj.exec:\1pjvj.exe85⤵PID:1008
-
\??\c:\7lrlrrf.exec:\7lrlrrf.exe86⤵PID:812
-
\??\c:\nhhnht.exec:\nhhnht.exe87⤵PID:3536
-
\??\c:\thtnnh.exec:\thtnnh.exe88⤵PID:4588
-
\??\c:\jpdvj.exec:\jpdvj.exe89⤵PID:1416
-
\??\c:\pjpdd.exec:\pjpdd.exe90⤵PID:3056
-
\??\c:\9rrlxrl.exec:\9rrlxrl.exe91⤵PID:1388
-
\??\c:\htnhtt.exec:\htnhtt.exe92⤵PID:4696
-
\??\c:\5vjdj.exec:\5vjdj.exe93⤵PID:1784
-
\??\c:\5vvpd.exec:\5vvpd.exe94⤵PID:4536
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe95⤵PID:2292
-
\??\c:\3fxlfrr.exec:\3fxlfrr.exe96⤵PID:4728
-
\??\c:\nbtbnt.exec:\nbtbnt.exe97⤵PID:2880
-
\??\c:\7hhbnn.exec:\7hhbnn.exe98⤵PID:5068
-
\??\c:\jdvpd.exec:\jdvpd.exe99⤵PID:2440
-
\??\c:\vpvpp.exec:\vpvpp.exe100⤵PID:3188
-
\??\c:\llxlffx.exec:\llxlffx.exe101⤵PID:3452
-
\??\c:\7nhbtt.exec:\7nhbtt.exe102⤵PID:4716
-
\??\c:\bbtnbt.exec:\bbtnbt.exe103⤵PID:5036
-
\??\c:\dppjv.exec:\dppjv.exe104⤵PID:2428
-
\??\c:\pvdpp.exec:\pvdpp.exe105⤵PID:2660
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe106⤵PID:2448
-
\??\c:\xfxrfrl.exec:\xfxrfrl.exe107⤵PID:3820
-
\??\c:\3btnbt.exec:\3btnbt.exe108⤵PID:1396
-
\??\c:\nbbtbb.exec:\nbbtbb.exe109⤵PID:1588
-
\??\c:\ddpjd.exec:\ddpjd.exe110⤵PID:4988
-
\??\c:\jvddp.exec:\jvddp.exe111⤵PID:3208
-
\??\c:\lffrflf.exec:\lffrflf.exe112⤵PID:2132
-
\??\c:\rrrrxxr.exec:\rrrrxxr.exe113⤵PID:4512
-
\??\c:\nhhbtn.exec:\nhhbtn.exe114⤵PID:3568
-
\??\c:\9htbtn.exec:\9htbtn.exe115⤵PID:2024
-
\??\c:\djpdd.exec:\djpdd.exe116⤵PID:2504
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe117⤵PID:4144
-
\??\c:\xlfxlfr.exec:\xlfxlfr.exe118⤵PID:4596
-
\??\c:\5lxxfxl.exec:\5lxxfxl.exe119⤵PID:348
-
\??\c:\hnhbnn.exec:\hnhbnn.exe120⤵PID:4504
-
\??\c:\1vjdp.exec:\1vjdp.exe121⤵PID:4396
-
\??\c:\pvvjv.exec:\pvvjv.exe122⤵PID:2464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-