Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
- Target 758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5.exe
- Size 78KB
- Sample240620-3nxa7aserc
- SHA256 758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5
- MD5 c15a80603f2c688f4e7d9f596d3bf5ee
- SHA1 9be3bbc626ca6a482c9c60bbf6bf9d73810e2619
- SHA512 5ff66b89ac7443afe4116269724f0e64d31d15197532a7492dbe380f90afa98a3a42baa4fc8cf06b637585bd11f9ec03803561d89c4c096a65aa76e14186c238
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmBgRD:ymb3NkkiQ3mdBjFo73thgQ/wEkMD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3112-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/3112-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3112-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3056-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2832-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4108-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3488-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2044-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2044-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2044-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2044-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2800-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1332-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1992-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3104-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2904-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1244-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1740-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3636-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3172-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/380-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3776-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1924-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/728-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2900-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2664 vvddd.exe 4368 lxfxrxx.exe 1392 xxlfxlf.exe 5096 bbhhhn.exe 3056 dvddd.exe 2832 lrfllrr.exe 4108 9fxrrxr.exe 4996 hhnnnn.exe 3488 ttbttn.exe 2044 9xrrrxx.exe 2800 nbnhtt.exe 1332 pddvp.exe 4608 ffxfrrf.exe 1992 tnhhnn.exe 464 hhtnnh.exe 2552 ddddv.exe 3680 ffffflx.exe 3104 tnttth.exe 4768 hhttbh.exe 1740 vjjjj.exe 2904 ppdvv.exe 1244 fxffxxr.exe 3636 llllxfr.exe 4836 btbtbb.exe 3172 nhnbbn.exe 380 jjppd.exe 3776 llrrlll.exe 1924 thnnhh.exe 2200 1tnnhh.exe 728 vjppp.exe 2900 jdddd.exe 1872 3rfxlrr.exe 2224 bbbbbh.exe 2472 nbtbbb.exe 1388 jpvjd.exe 2436 dddjd.exe 3380 5lrlfff.exe 4052 xrxxxff.exe 3516 hnnhhh.exe 4636 nbnnnh.exe 3444 hbbbtt.exe 4408 jdjjv.exe 3528 rlllfff.exe 872 ffxxffr.exe 4220 nthnhh.exe 2308 btbbbh.exe 2504 pjvpv.exe 5096 pvpjj.exe 4480 3lrrlrl.exe 2368 lrfrlfr.exe 2132 hbhnhn.exe 4700 nnbnnb.exe 2120 dpvpj.exe 5040 ppddv.exe 4848 flflllr.exe 2072 xrxrxff.exe 1736 bthhtt.exe 2800 7ttbbb.exe 1840 jdjdd.exe 2240 jjjpd.exe 3192 xrfffll.exe 4576 lrfrffr.exe 3920 5tbnth.exe 4892 bbhbbh.exe -
resource yara_rule behavioral2/memory/3112-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-205-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3112 wrote to memory of 2664 3112 758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5.exe 83 PID 3112 wrote to memory of 2664 3112 758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5.exe 83 PID 3112 wrote to memory of 2664 3112 758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5.exe 83 PID 2664 wrote to memory of 4368 2664 vvddd.exe 84 PID 2664 wrote to memory of 4368 2664 vvddd.exe 84 PID 2664 wrote to memory of 4368 2664 vvddd.exe 84 PID 4368 wrote to memory of 1392 4368 lxfxrxx.exe 85 PID 4368 wrote to memory of 1392 4368 lxfxrxx.exe 85 PID 4368 wrote to memory of 1392 4368 lxfxrxx.exe 85 PID 1392 wrote to memory of 5096 1392 xxlfxlf.exe 86 PID 1392 wrote to memory of 5096 1392 xxlfxlf.exe 86 PID 1392 wrote to memory of 5096 1392 xxlfxlf.exe 86 PID 5096 wrote to memory of 3056 5096 bbhhhn.exe 87 PID 5096 wrote to memory of 3056 5096 bbhhhn.exe 87 PID 5096 wrote to memory of 3056 5096 bbhhhn.exe 87 PID 3056 wrote to memory of 2832 3056 dvddd.exe 88 PID 3056 wrote to memory of 2832 3056 dvddd.exe 88 PID 3056 wrote to memory of 2832 3056 dvddd.exe 88 PID 2832 wrote to memory of 4108 2832 lrfllrr.exe 89 PID 2832 wrote to memory of 4108 2832 lrfllrr.exe 89 PID 2832 wrote to memory of 4108 2832 lrfllrr.exe 89 PID 4108 wrote to memory of 4996 4108 9fxrrxr.exe 90 PID 4108 wrote to memory of 4996 4108 9fxrrxr.exe 90 PID 4108 wrote to memory of 4996 4108 9fxrrxr.exe 90 PID 4996 wrote to memory of 3488 4996 hhnnnn.exe 91 PID 4996 wrote to memory of 3488 4996 hhnnnn.exe 91 PID 4996 wrote to memory of 3488 4996 hhnnnn.exe 91 PID 3488 wrote to memory of 2044 3488 ttbttn.exe 93 PID 3488 wrote to memory of 2044 3488 ttbttn.exe 93 PID 3488 wrote to memory of 2044 3488 ttbttn.exe 93 PID 2044 wrote to memory of 2800 2044 9xrrrxx.exe 94 PID 2044 wrote to memory of 2800 2044 9xrrrxx.exe 94 PID 2044 wrote to memory of 2800 2044 9xrrrxx.exe 94 PID 2800 wrote to memory of 1332 2800 nbnhtt.exe 95 PID 2800 wrote to memory of 1332 2800 nbnhtt.exe 95 PID 2800 wrote to memory of 1332 2800 nbnhtt.exe 95 PID 1332 wrote to memory of 4608 1332 pddvp.exe 96 PID 1332 wrote to memory of 4608 1332 pddvp.exe 96 PID 1332 wrote to memory of 4608 1332 pddvp.exe 96 PID 4608 wrote to memory of 1992 4608 ffxfrrf.exe 97 PID 4608 wrote to memory of 1992 4608 ffxfrrf.exe 97 PID 4608 wrote to memory of 1992 4608 ffxfrrf.exe 97 PID 1992 wrote to memory of 464 1992 tnhhnn.exe 98 PID 1992 wrote to memory of 464 1992 tnhhnn.exe 98 PID 1992 wrote to memory of 464 1992 tnhhnn.exe 98 PID 464 wrote to memory of 2552 464 hhtnnh.exe 99 PID 464 wrote to memory of 2552 464 hhtnnh.exe 99 PID 464 wrote to memory of 2552 464 hhtnnh.exe 99 PID 2552 wrote to memory of 3680 2552 ddddv.exe 100 PID 2552 wrote to memory of 3680 2552 ddddv.exe 100 PID 2552 wrote to memory of 3680 2552 ddddv.exe 100 PID 3680 wrote to memory of 3104 3680 ffffflx.exe 101 PID 3680 wrote to memory of 3104 3680 ffffflx.exe 101 PID 3680 wrote to memory of 3104 3680 ffffflx.exe 101 PID 3104 wrote to memory of 4768 3104 tnttth.exe 103 PID 3104 wrote to memory of 4768 3104 tnttth.exe 103 PID 3104 wrote to memory of 4768 3104 tnttth.exe 103 PID 4768 wrote to memory of 1740 4768 hhttbh.exe 104 PID 4768 wrote to memory of 1740 4768 hhttbh.exe 104 PID 4768 wrote to memory of 1740 4768 hhttbh.exe 104 PID 1740 wrote to memory of 2904 1740 vjjjj.exe 105 PID 1740 wrote to memory of 2904 1740 vjjjj.exe 105 PID 1740 wrote to memory of 2904 1740 vjjjj.exe 105 PID 2904 wrote to memory of 1244 2904 ppdvv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5.exe"C:\Users\Admin\AppData\Local\Temp\758ea3c8bf7e0b8445633dd4a2af823e568e6b226f5a062bf285263b86d554d5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\vvddd.exec:\vvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\xxlfxlf.exec:\xxlfxlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\bbhhhn.exec:\bbhhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\dvddd.exec:\dvddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lrfllrr.exec:\lrfllrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9fxrrxr.exec:\9fxrrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\hhnnnn.exec:\hhnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\ttbttn.exec:\ttbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\9xrrrxx.exec:\9xrrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\nbnhtt.exec:\nbnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\pddvp.exec:\pddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\tnhhnn.exec:\tnhhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\hhtnnh.exec:\hhtnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\ddddv.exec:\ddddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ffffflx.exec:\ffffflx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\tnttth.exec:\tnttth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\hhttbh.exec:\hhttbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\vjjjj.exec:\vjjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\ppdvv.exec:\ppdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fxffxxr.exec:\fxffxxr.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\llllxfr.exec:\llllxfr.exe24⤵
- Executes dropped EXE
PID:3636 -
\??\c:\btbtbb.exec:\btbtbb.exe25⤵
- Executes dropped EXE
PID:4836 -
\??\c:\nhnbbn.exec:\nhnbbn.exe26⤵
- Executes dropped EXE
PID:3172 -
\??\c:\jjppd.exec:\jjppd.exe27⤵
- Executes dropped EXE
PID:380 -
\??\c:\llrrlll.exec:\llrrlll.exe28⤵
- Executes dropped EXE
PID:3776 -
\??\c:\thnnhh.exec:\thnnhh.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1tnnhh.exec:\1tnnhh.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vjppp.exec:\vjppp.exe31⤵
- Executes dropped EXE
PID:728 -
\??\c:\jdddd.exec:\jdddd.exe32⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3rfxlrr.exec:\3rfxlrr.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bbbbbh.exec:\bbbbbh.exe34⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nbtbbb.exec:\nbtbbb.exe35⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jpvjd.exec:\jpvjd.exe36⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dddjd.exec:\dddjd.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5lrlfff.exec:\5lrlfff.exe38⤵
- Executes dropped EXE
PID:3380 -
\??\c:\xrxxxff.exec:\xrxxxff.exe39⤵
- Executes dropped EXE
PID:4052 -
\??\c:\hnnhhh.exec:\hnnhhh.exe40⤵
- Executes dropped EXE
PID:3516 -
\??\c:\nbnnnh.exec:\nbnnnh.exe41⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hbbbtt.exec:\hbbbtt.exe42⤵
- Executes dropped EXE
PID:3444 -
\??\c:\vvjpd.exec:\vvjpd.exe43⤵PID:3112
-
\??\c:\jdjjv.exec:\jdjjv.exe44⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rlllfff.exec:\rlllfff.exe45⤵
- Executes dropped EXE
PID:3528 -
\??\c:\ffxxffr.exec:\ffxxffr.exe46⤵
- Executes dropped EXE
PID:872 -
\??\c:\nthnhh.exec:\nthnhh.exe47⤵
- Executes dropped EXE
PID:4220 -
\??\c:\btbbbh.exec:\btbbbh.exe48⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pjvpv.exec:\pjvpv.exe49⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pvpjj.exec:\pvpjj.exe50⤵
- Executes dropped EXE
PID:5096 -
\??\c:\3lrrlrl.exec:\3lrrlrl.exe51⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lrfrlfr.exec:\lrfrlfr.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hbhnhn.exec:\hbhnhn.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nnbnnb.exec:\nnbnnb.exe54⤵
- Executes dropped EXE
PID:4700 -
\??\c:\dpvpj.exec:\dpvpj.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ppddv.exec:\ppddv.exe56⤵
- Executes dropped EXE
PID:5040 -
\??\c:\flflllr.exec:\flflllr.exe57⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xrxrxff.exec:\xrxrxff.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bthhtt.exec:\bthhtt.exe59⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7ttbbb.exec:\7ttbbb.exe60⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jdjdd.exec:\jdjdd.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jjjpd.exec:\jjjpd.exe62⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xrfffll.exec:\xrfffll.exe63⤵
- Executes dropped EXE
PID:3192 -
\??\c:\lrfrffr.exec:\lrfrffr.exe64⤵
- Executes dropped EXE
PID:4576 -
\??\c:\5tbnth.exec:\5tbnth.exe65⤵
- Executes dropped EXE
PID:3920 -
\??\c:\bbhbbh.exec:\bbhbbh.exe66⤵
- Executes dropped EXE
PID:4892 -
\??\c:\dpdvv.exec:\dpdvv.exe67⤵PID:2892
-
\??\c:\jdjjv.exec:\jdjjv.exe68⤵PID:2324
-
\??\c:\3rrxrxf.exec:\3rrxrxf.exe69⤵PID:4132
-
\??\c:\rxfffff.exec:\rxfffff.exe70⤵PID:224
-
\??\c:\hbthhn.exec:\hbthhn.exe71⤵PID:2672
-
\??\c:\hhbtbb.exec:\hhbtbb.exe72⤵PID:632
-
\??\c:\jdddv.exec:\jdddv.exe73⤵PID:4936
-
\??\c:\dvpjp.exec:\dvpjp.exe74⤵PID:4992
-
\??\c:\fxxlffx.exec:\fxxlffx.exe75⤵PID:4064
-
\??\c:\ffflrxr.exec:\ffflrxr.exe76⤵PID:2152
-
\??\c:\3rxlxrl.exec:\3rxlxrl.exe77⤵PID:4676
-
\??\c:\nhnnhh.exec:\nhnnhh.exe78⤵PID:3616
-
\??\c:\tthhth.exec:\tthhth.exe79⤵PID:3900
-
\??\c:\7jjdv.exec:\7jjdv.exe80⤵PID:4104
-
\??\c:\5pvvv.exec:\5pvvv.exe81⤵PID:3036
-
\??\c:\9xxrrxx.exec:\9xxrrxx.exe82⤵PID:4988
-
\??\c:\bbtnht.exec:\bbtnht.exe83⤵PID:1924
-
\??\c:\ttttth.exec:\ttttth.exe84⤵PID:4308
-
\??\c:\ppdjp.exec:\ppdjp.exe85⤵PID:1596
-
\??\c:\vpvvd.exec:\vpvvd.exe86⤵PID:392
-
\??\c:\llllrll.exec:\llllrll.exe87⤵PID:2900
-
\??\c:\xllllll.exec:\xllllll.exe88⤵PID:1812
-
\??\c:\hnbntb.exec:\hnbntb.exe89⤵PID:4516
-
\??\c:\nbbbtt.exec:\nbbbtt.exe90⤵PID:3328
-
\??\c:\nnbtnb.exec:\nnbtnb.exe91⤵PID:4372
-
\??\c:\djvjv.exec:\djvjv.exe92⤵PID:4136
-
\??\c:\jjddv.exec:\jjddv.exe93⤵PID:2640
-
\??\c:\rfrxrxr.exec:\rfrxrxr.exe94⤵PID:636
-
\??\c:\xxrrffr.exec:\xxrrffr.exe95⤵PID:1616
-
\??\c:\nntbtt.exec:\nntbtt.exe96⤵PID:4656
-
\??\c:\bbbbhh.exec:\bbbbhh.exe97⤵PID:4416
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe98⤵PID:2652
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe99⤵PID:3956
-
\??\c:\hbnhhn.exec:\hbnhhn.exe100⤵PID:1204
-
\??\c:\vpddv.exec:\vpddv.exe101⤵PID:3648
-
\??\c:\pdjjd.exec:\pdjjd.exe102⤵PID:2156
-
\??\c:\ddjjd.exec:\ddjjd.exe103⤵PID:4688
-
\??\c:\1llrlll.exec:\1llrlll.exe104⤵PID:4012
-
\??\c:\3xffxfx.exec:\3xffxfx.exe105⤵PID:1400
-
\??\c:\tnbhbb.exec:\tnbhbb.exe106⤵PID:4072
-
\??\c:\hbbbhh.exec:\hbbbhh.exe107⤵PID:1532
-
\??\c:\jddvp.exec:\jddvp.exe108⤵PID:3152
-
\??\c:\dvjjp.exec:\dvjjp.exe109⤵PID:1936
-
\??\c:\5rfffrx.exec:\5rfffrx.exe110⤵PID:2764
-
\??\c:\flfxrrx.exec:\flfxrrx.exe111⤵PID:1988
-
\??\c:\tbbbbh.exec:\tbbbbh.exe112⤵PID:3428
-
\??\c:\ttbbbh.exec:\ttbbbh.exe113⤵PID:1744
-
\??\c:\pjpdv.exec:\pjpdv.exe114⤵PID:3640
-
\??\c:\ddjpj.exec:\ddjpj.exe115⤵PID:676
-
\??\c:\rrlfxll.exec:\rrlfxll.exe116⤵PID:1004
-
\??\c:\xlrrrxr.exec:\xlrrrxr.exe117⤵PID:2508
-
\??\c:\nnbntt.exec:\nnbntt.exe118⤵PID:3600
-
\??\c:\hhtttb.exec:\hhtttb.exe119⤵PID:2584
-
\??\c:\dvddv.exec:\dvddv.exe120⤵PID:3720
-
\??\c:\3vvpj.exec:\3vvpj.exe121⤵PID:4040
-
\??\c:\lrrrffr.exec:\lrrrffr.exe122⤵PID:5100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-