Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88a871d4b447bb4d89dfebefb227e844.exe
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
88a871d4b447bb4d89dfebefb227e844.exe
-
Size
108KB
-
MD5
88a871d4b447bb4d89dfebefb227e844
-
SHA1
091d23777a3dec688806adcd7adb85b9bbeb1296
-
SHA256
5d5c7ae429a9d3f0e4eb10fbf1af2c7ebbe2e88b776f517d9547e5ebb2d993da
-
SHA512
1005198dae08f75c3cd7f1f1d3bba980f439499775bbdb3cc20020701a06eece9c5348ce40af941885c0264659955a67a784f3919a45b0f534617a09d3ca5dd2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9ggGQEUIEP:n3C9BRo7tvnJ9iUIA
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral2/memory/1224-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-306-0x0000000000570000-0x0000000000580000-memory.dmp family_blackmoon behavioral2/memory/1592-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3064 pvjjp.exe 2768 fxrlffr.exe 4164 hbthbn.exe 2388 xlfrllf.exe 2816 5thbnh.exe 3188 vpdpd.exe 1620 nnhhtb.exe 3504 pjpjj.exe 764 fflflfr.exe 5104 vjdvd.exe 516 xfxlxrl.exe 1112 1hnhtn.exe 4476 7hhhhb.exe 2580 pdddd.exe 4864 lfxrrfx.exe 2820 jvjpp.exe 816 xlfrlxl.exe 732 xllfxrl.exe 4028 tnbttn.exe 1396 tnbntn.exe 4940 xllfxxr.exe 3480 jpjpp.exe 3580 nthtth.exe 4112 dppjp.exe 2248 1nnhth.exe 1008 lfxlrll.exe 4828 nbtbbt.exe 3564 5lxlffr.exe 2440 hbhbhb.exe 796 lrrrfxl.exe 4960 htnhtn.exe 4572 xxrlfxr.exe 4072 jddjv.exe 856 lrffxff.exe 4980 lflffff.exe 716 3ddpj.exe 2484 nbthtn.exe 2968 vpjvj.exe 3136 hnnbtt.exe 3836 9vjjv.exe 3720 7bhtbb.exe 1720 dpjvd.exe 1416 hhhnhn.exe 2432 jppvp.exe 3260 lllfrlx.exe 1976 ppddv.exe 1592 rfxxxxf.exe 744 ntnbtn.exe 2688 dvvpv.exe 556 fxrlfxx.exe 2620 jvvpv.exe 4476 rxrlxxr.exe 1996 bntttt.exe 2368 dvpdp.exe 1392 hhhbnn.exe 4144 lfxrfxf.exe 4888 lrlfxxl.exe 2252 vjvjd.exe 2420 lfrfllr.exe 984 hbbthb.exe 4528 pdppj.exe 2804 ntbnhb.exe 916 xfxrfrf.exe 1064 9djdd.exe -
resource yara_rule behavioral2/memory/1224-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/796-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-348-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 3064 1224 88a871d4b447bb4d89dfebefb227e844.exe 90 PID 1224 wrote to memory of 3064 1224 88a871d4b447bb4d89dfebefb227e844.exe 90 PID 1224 wrote to memory of 3064 1224 88a871d4b447bb4d89dfebefb227e844.exe 90 PID 3064 wrote to memory of 2768 3064 pvjjp.exe 89 PID 3064 wrote to memory of 2768 3064 pvjjp.exe 89 PID 3064 wrote to memory of 2768 3064 pvjjp.exe 89 PID 2768 wrote to memory of 4164 2768 fxrlffr.exe 88 PID 2768 wrote to memory of 4164 2768 fxrlffr.exe 88 PID 2768 wrote to memory of 4164 2768 fxrlffr.exe 88 PID 4164 wrote to memory of 2388 4164 hbthbn.exe 87 PID 4164 wrote to memory of 2388 4164 hbthbn.exe 87 PID 4164 wrote to memory of 2388 4164 hbthbn.exe 87 PID 2388 wrote to memory of 2816 2388 xlfrllf.exe 86 PID 2388 wrote to memory of 2816 2388 xlfrllf.exe 86 PID 2388 wrote to memory of 2816 2388 xlfrllf.exe 86 PID 2816 wrote to memory of 3188 2816 5thbnh.exe 85 PID 2816 wrote to memory of 3188 2816 5thbnh.exe 85 PID 2816 wrote to memory of 3188 2816 5thbnh.exe 85 PID 3188 wrote to memory of 1620 3188 vpdpd.exe 92 PID 3188 wrote to memory of 1620 3188 vpdpd.exe 92 PID 3188 wrote to memory of 1620 3188 vpdpd.exe 92 PID 1620 wrote to memory of 3504 1620 nnhhtb.exe 91 PID 1620 wrote to memory of 3504 1620 nnhhtb.exe 91 PID 1620 wrote to memory of 3504 1620 nnhhtb.exe 91 PID 3504 wrote to memory of 764 3504 pjpjj.exe 93 PID 3504 wrote to memory of 764 3504 pjpjj.exe 93 PID 3504 wrote to memory of 764 3504 pjpjj.exe 93 PID 764 wrote to memory of 5104 764 fflflfr.exe 94 PID 764 wrote to memory of 5104 764 fflflfr.exe 94 PID 764 wrote to memory of 5104 764 fflflfr.exe 94 PID 5104 wrote to memory of 516 5104 vjdvd.exe 95 PID 5104 wrote to memory of 516 5104 vjdvd.exe 95 PID 5104 wrote to memory of 516 5104 vjdvd.exe 95 PID 516 wrote to memory of 1112 516 xfxlxrl.exe 96 PID 516 wrote to memory of 1112 516 xfxlxrl.exe 96 PID 516 wrote to memory of 1112 516 xfxlxrl.exe 96 PID 1112 wrote to memory of 4476 1112 1hnhtn.exe 97 PID 1112 wrote to memory of 4476 1112 1hnhtn.exe 97 PID 1112 wrote to memory of 4476 1112 1hnhtn.exe 97 PID 4476 wrote to memory of 2580 4476 7hhhhb.exe 98 PID 4476 wrote to memory of 2580 4476 7hhhhb.exe 98 PID 4476 wrote to memory of 2580 4476 7hhhhb.exe 98 PID 2580 wrote to memory of 4864 2580 pdddd.exe 99 PID 2580 wrote to memory of 4864 2580 pdddd.exe 99 PID 2580 wrote to memory of 4864 2580 pdddd.exe 99 PID 4864 wrote to memory of 2820 4864 lfxrrfx.exe 100 PID 4864 wrote to memory of 2820 4864 lfxrrfx.exe 100 PID 4864 wrote to memory of 2820 4864 lfxrrfx.exe 100 PID 2820 wrote to memory of 816 2820 jvjpp.exe 102 PID 2820 wrote to memory of 816 2820 jvjpp.exe 102 PID 2820 wrote to memory of 816 2820 jvjpp.exe 102 PID 816 wrote to memory of 732 816 xlfrlxl.exe 103 PID 816 wrote to memory of 732 816 xlfrlxl.exe 103 PID 816 wrote to memory of 732 816 xlfrlxl.exe 103 PID 732 wrote to memory of 4028 732 xllfxrl.exe 104 PID 732 wrote to memory of 4028 732 xllfxrl.exe 104 PID 732 wrote to memory of 4028 732 xllfxrl.exe 104 PID 4028 wrote to memory of 1396 4028 tnbttn.exe 105 PID 4028 wrote to memory of 1396 4028 tnbttn.exe 105 PID 4028 wrote to memory of 1396 4028 tnbttn.exe 105 PID 1396 wrote to memory of 4940 1396 tnbntn.exe 106 PID 1396 wrote to memory of 4940 1396 tnbntn.exe 106 PID 1396 wrote to memory of 4940 1396 tnbntn.exe 106 PID 4940 wrote to memory of 3480 4940 xllfxxr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\88a871d4b447bb4d89dfebefb227e844.exe"C:\Users\Admin\AppData\Local\Temp\88a871d4b447bb4d89dfebefb227e844.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\pvjjp.exec:\pvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064
-
-
\??\c:\vpdpd.exec:\vpdpd.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\nnhhtb.exec:\nnhhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620
-
-
\??\c:\5thbnh.exec:\5thbnh.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816
-
\??\c:\xlfrllf.exec:\xlfrllf.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388
-
\??\c:\hbthbn.exec:\hbthbn.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164
-
\??\c:\fxrlffr.exec:\fxrlffr.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768
-
\??\c:\pjpjj.exec:\pjpjj.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\fflflfr.exec:\fflflfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vjdvd.exec:\vjdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\1hnhtn.exec:\1hnhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\7hhhhb.exec:\7hhhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\pdddd.exec:\pdddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\lfxrrfx.exec:\lfxrrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\jvjpp.exec:\jvjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xlfrlxl.exec:\xlfrlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\xllfxrl.exec:\xllfxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\tnbttn.exec:\tnbttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\tnbntn.exec:\tnbntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\xllfxxr.exec:\xllfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\jpjpp.exec:\jpjpp.exe15⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nthtth.exec:\nthtth.exe16⤵
- Executes dropped EXE
PID:3580 -
\??\c:\dppjp.exec:\dppjp.exe17⤵
- Executes dropped EXE
PID:4112 -
\??\c:\1nnhth.exec:\1nnhth.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfxlrll.exec:\lfxlrll.exe19⤵
- Executes dropped EXE
PID:1008 -
\??\c:\nbtbbt.exec:\nbtbbt.exe20⤵
- Executes dropped EXE
PID:4828 -
\??\c:\5lxlffr.exec:\5lxlffr.exe21⤵
- Executes dropped EXE
PID:3564 -
\??\c:\hbhbhb.exec:\hbhbhb.exe22⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lrrrfxl.exec:\lrrrfxl.exe23⤵
- Executes dropped EXE
PID:796 -
\??\c:\htnhtn.exec:\htnhtn.exe24⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe25⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jddjv.exec:\jddjv.exe26⤵
- Executes dropped EXE
PID:4072 -
\??\c:\lrffxff.exec:\lrffxff.exe27⤵
- Executes dropped EXE
PID:856 -
\??\c:\lflffff.exec:\lflffff.exe28⤵
- Executes dropped EXE
PID:4980 -
\??\c:\3ddpj.exec:\3ddpj.exe29⤵
- Executes dropped EXE
PID:716 -
\??\c:\nbthtn.exec:\nbthtn.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpjvj.exec:\vpjvj.exe31⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hnnbtt.exec:\hnnbtt.exe32⤵
- Executes dropped EXE
PID:3136 -
\??\c:\9vjjv.exec:\9vjjv.exe33⤵
- Executes dropped EXE
PID:3836 -
\??\c:\7bhtbb.exec:\7bhtbb.exe34⤵
- Executes dropped EXE
PID:3720 -
\??\c:\dpjvd.exec:\dpjvd.exe35⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hhhnhn.exec:\hhhnhn.exe36⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jppvp.exec:\jppvp.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lllfrlx.exec:\lllfrlx.exe38⤵
- Executes dropped EXE
PID:3260 -
\??\c:\ppddv.exec:\ppddv.exe39⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rfxxxxf.exec:\rfxxxxf.exe40⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ntnbtn.exec:\ntnbtn.exe41⤵
- Executes dropped EXE
PID:744 -
\??\c:\dvvpv.exec:\dvvpv.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe43⤵
- Executes dropped EXE
PID:556 -
\??\c:\jvvpv.exec:\jvvpv.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rxrlxxr.exec:\rxrlxxr.exe45⤵
- Executes dropped EXE
PID:4476 -
\??\c:\bntttt.exec:\bntttt.exe46⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvpdp.exec:\dvpdp.exe47⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hhhbnn.exec:\hhhbnn.exe48⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lfxrfxf.exec:\lfxrfxf.exe49⤵
- Executes dropped EXE
PID:4144 -
\??\c:\lrlfxxl.exec:\lrlfxxl.exe50⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vjvjd.exec:\vjvjd.exe51⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lfrfllr.exec:\lfrfllr.exe52⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbbthb.exec:\hbbthb.exe53⤵
- Executes dropped EXE
PID:984 -
\??\c:\pdppj.exec:\pdppj.exe54⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ntbnhb.exec:\ntbnhb.exe55⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xfxrfrf.exec:\xfxrfrf.exe56⤵
- Executes dropped EXE
PID:916 -
\??\c:\9djdd.exec:\9djdd.exe57⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe58⤵PID:4848
-
\??\c:\dvdvv.exec:\dvdvv.exe59⤵PID:2564
-
\??\c:\djvjv.exec:\djvjv.exe60⤵PID:3592
-
\??\c:\xfffxrl.exec:\xfffxrl.exe61⤵PID:1372
-
\??\c:\tbtthh.exec:\tbtthh.exe62⤵PID:3564
-
\??\c:\1vvpj.exec:\1vvpj.exe63⤵PID:1340
-
\??\c:\9flxlfx.exec:\9flxlfx.exe64⤵PID:4948
-
\??\c:\dvpjd.exec:\dvpjd.exe65⤵PID:1316
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe66⤵PID:224
-
\??\c:\nbtnhb.exec:\nbtnhb.exe67⤵PID:4932
-
\??\c:\3rlfxxl.exec:\3rlfxxl.exe68⤵PID:4632
-
\??\c:\nbtnhb.exec:\nbtnhb.exe69⤵PID:1368
-
\??\c:\jdpjv.exec:\jdpjv.exe70⤵PID:4984
-
\??\c:\bhnhtn.exec:\bhnhtn.exe71⤵PID:2476
-
\??\c:\ppjpj.exec:\ppjpj.exe72⤵PID:512
-
\??\c:\lrxlrlf.exec:\lrxlrlf.exe73⤵PID:3568
-
\??\c:\tntbbb.exec:\tntbbb.exe74⤵PID:4472
-
\??\c:\rfxxxrr.exec:\rfxxxrr.exe75⤵PID:3176
-
\??\c:\jpvpj.exec:\jpvpj.exe76⤵PID:3504
-
\??\c:\ffffxxx.exec:\ffffxxx.exe77⤵PID:4788
-
\??\c:\9jdvj.exec:\9jdvj.exe78⤵PID:1976
-
\??\c:\ttnhnb.exec:\ttnhnb.exe79⤵PID:4084
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe80⤵PID:1056
-
\??\c:\nttttt.exec:\nttttt.exe81⤵PID:4276
-
\??\c:\3ttnhb.exec:\3ttnhb.exe82⤵PID:4436
-
\??\c:\dpjdv.exec:\dpjdv.exe83⤵PID:1240
-
\??\c:\ntntnh.exec:\ntntnh.exe84⤵PID:4476
-
\??\c:\dvvvj.exec:\dvvvj.exe85⤵PID:4652
-
\??\c:\flfxrlf.exec:\flfxrlf.exe86⤵PID:1628
-
\??\c:\1jdvp.exec:\1jdvp.exe87⤵PID:4816
-
\??\c:\5lfrffr.exec:\5lfrffr.exe88⤵PID:4028
-
\??\c:\tnbbnh.exec:\tnbbnh.exe89⤵PID:4496
-
\??\c:\rlrfxrf.exec:\rlrfxrf.exe90⤵PID:2684
-
\??\c:\htnhbt.exec:\htnhbt.exe91⤵PID:1204
-
\??\c:\7vvjv.exec:\7vvjv.exe92⤵PID:3664
-
\??\c:\rfllffr.exec:\rfllffr.exe93⤵PID:2160
-
\??\c:\jdjdd.exec:\jdjdd.exe94⤵PID:4404
-
\??\c:\5rxxlff.exec:\5rxxlff.exe95⤵PID:2600
-
\??\c:\jjpdp.exec:\jjpdp.exe96⤵PID:4348
-
\??\c:\hnhthb.exec:\hnhthb.exe97⤵PID:4848
-
\??\c:\bnbnbt.exec:\bnbnbt.exe98⤵PID:5024
-
\??\c:\vjppj.exec:\vjppj.exe99⤵PID:2992
-
\??\c:\bbbhbt.exec:\bbbhbt.exe100⤵PID:3032
-
\??\c:\3jjjj.exec:\3jjjj.exe101⤵PID:3736
-
\??\c:\bbbthb.exec:\bbbthb.exe102⤵PID:1536
-
\??\c:\3vvpp.exec:\3vvpp.exe103⤵PID:1816
-
\??\c:\xflllfl.exec:\xflllfl.exe104⤵PID:2016
-
\??\c:\pjjdd.exec:\pjjdd.exe105⤵PID:1580
-
\??\c:\llffffx.exec:\llffffx.exe106⤵PID:4420
-
\??\c:\9httnh.exec:\9httnh.exe107⤵PID:4896
-
\??\c:\pvpjv.exec:\pvpjv.exe108⤵PID:1636
-
\??\c:\nbhhhb.exec:\nbhhhb.exe109⤵PID:2196
-
\??\c:\rrrllll.exec:\rrrllll.exe110⤵PID:1572
-
\??\c:\hbhtth.exec:\hbhtth.exe111⤵PID:4712
-
\??\c:\jvvjd.exec:\jvvjd.exe112⤵PID:1288
-
\??\c:\htnbhb.exec:\htnbhb.exe113⤵PID:1424
-
\??\c:\thtnhh.exec:\thtnhh.exe114⤵PID:2004
-
\??\c:\xlfxfxx.exec:\xlfxfxx.exe115⤵PID:3504
-
\??\c:\hnnbbt.exec:\hnnbbt.exe116⤵PID:4844
-
\??\c:\pjjdj.exec:\pjjdj.exe117⤵PID:516
-
\??\c:\9nhhtn.exec:\9nhhtn.exe118⤵PID:744
-
\??\c:\vppdj.exec:\vppdj.exe119⤵PID:4036
-
\??\c:\thbnbt.exec:\thbnbt.exe120⤵PID:3792
-
\??\c:\hnnbhb.exec:\hnnbhb.exe121⤵PID:3516
-
\??\c:\xxrlrlf.exec:\xxrlrlf.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-