Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
General
-
Target
5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52.exe
-
Size
94KB
-
MD5
11638ac20d762b986002e50c98aeca3a
-
SHA1
62e10283c47adaebd9fee7367407e57d3770f839
-
SHA256
5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52
-
SHA512
e4ecf8573a977eff18954511f769221be0954a5d7504bb3628d32d20dae69dff1c63358dfbc274f2f96ddd6ecd41a2039e1e2b44dcff720b78dcad1fed334580
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtQl:ymb3NkkiQ3mdBjFIWeFGyAsJAg2Ql
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/3000-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-63-0x0000000000540000-0x0000000000580000-memory.dmp family_blackmoon behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-35-0x0000000000570000-0x00000000005B0000-memory.dmp family_blackmoon behavioral2/memory/1356-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/3000-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4736-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3112-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4100-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3112-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3432-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3388-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3496-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/764-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3840-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1752-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3568-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2296-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1356-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3412-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3304-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/548-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2740-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1964-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4628-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1308-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3528-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4588-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3696-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4736 xflfxrl.exe 3112 rlrfxrr.exe 4100 dvjjv.exe 2296 fllffxr.exe 3432 ntthth.exe 3388 3nhtnh.exe 3772 1jpjd.exe 400 vvpvj.exe 3568 rrlxrfr.exe 764 flflrrf.exe 3496 9nnnbt.exe 3840 vpjdp.exe 1752 vjdvj.exe 1356 3lfrxll.exe 3956 ddvpj.exe 3412 jpvpd.exe 3304 lxrllfx.exe 548 7bnbhb.exe 368 vvjvj.exe 956 rllrlrl.exe 2740 ffffrrl.exe 3796 nttnnh.exe 4508 dvvvv.exe 1964 flfxxfx.exe 4628 nhnhhb.exe 3528 1vvpd.exe 1308 pjjdv.exe 4588 rflfrrl.exe 5100 hbhhhn.exe 3696 jvvjv.exe 1472 frfxllx.exe 2324 vpppp.exe 2640 jdjjp.exe 1268 llxrrlx.exe 2884 5tthtn.exe 2904 jvjdv.exe 4824 ffffxxf.exe 3848 lffxrrf.exe 4092 hbttnh.exe 3016 vddvd.exe 3680 jdppj.exe 1884 vjpjv.exe 4100 xxrflfx.exe 3080 xxlffxl.exe 4492 1ntnhh.exe 5040 pppjj.exe 3964 ddpjd.exe 1476 frxrrrx.exe 3348 btnhhb.exe 3284 hnnhbb.exe 1944 pjdvj.exe 912 3ddpd.exe 1612 3rrrllf.exe 3984 lxffxxl.exe 636 thnhhb.exe 3840 jjpjv.exe 4808 vpppp.exe 3216 rlfxrll.exe 1356 7rrlrrr.exe 4888 tnnnnn.exe 3688 pjdvv.exe 2992 vjvjj.exe 4728 lfrlrfx.exe 3780 rrxrllf.exe -
resource yara_rule behavioral2/memory/3000-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 4736 3000 5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52.exe 83 PID 3000 wrote to memory of 4736 3000 5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52.exe 83 PID 3000 wrote to memory of 4736 3000 5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52.exe 83 PID 4736 wrote to memory of 3112 4736 xflfxrl.exe 84 PID 4736 wrote to memory of 3112 4736 xflfxrl.exe 84 PID 4736 wrote to memory of 3112 4736 xflfxrl.exe 84 PID 3112 wrote to memory of 4100 3112 rlrfxrr.exe 85 PID 3112 wrote to memory of 4100 3112 rlrfxrr.exe 85 PID 3112 wrote to memory of 4100 3112 rlrfxrr.exe 85 PID 4100 wrote to memory of 2296 4100 dvjjv.exe 86 PID 4100 wrote to memory of 2296 4100 dvjjv.exe 86 PID 4100 wrote to memory of 2296 4100 dvjjv.exe 86 PID 2296 wrote to memory of 3432 2296 fllffxr.exe 87 PID 2296 wrote to memory of 3432 2296 fllffxr.exe 87 PID 2296 wrote to memory of 3432 2296 fllffxr.exe 87 PID 3432 wrote to memory of 3388 3432 ntthth.exe 88 PID 3432 wrote to memory of 3388 3432 ntthth.exe 88 PID 3432 wrote to memory of 3388 3432 ntthth.exe 88 PID 3388 wrote to memory of 3772 3388 3nhtnh.exe 89 PID 3388 wrote to memory of 3772 3388 3nhtnh.exe 89 PID 3388 wrote to memory of 3772 3388 3nhtnh.exe 89 PID 3772 wrote to memory of 400 3772 1jpjd.exe 90 PID 3772 wrote to memory of 400 3772 1jpjd.exe 90 PID 3772 wrote to memory of 400 3772 1jpjd.exe 90 PID 400 wrote to memory of 3568 400 vvpvj.exe 91 PID 400 wrote to memory of 3568 400 vvpvj.exe 91 PID 400 wrote to memory of 3568 400 vvpvj.exe 91 PID 3568 wrote to memory of 764 3568 rrlxrfr.exe 92 PID 3568 wrote to memory of 764 3568 rrlxrfr.exe 92 PID 3568 wrote to memory of 764 3568 rrlxrfr.exe 92 PID 764 wrote to memory of 3496 764 flflrrf.exe 93 PID 764 wrote to memory of 3496 764 flflrrf.exe 93 PID 764 wrote to memory of 3496 764 flflrrf.exe 93 PID 3496 wrote to memory of 3840 3496 9nnnbt.exe 94 PID 3496 wrote to memory of 3840 3496 9nnnbt.exe 94 PID 3496 wrote to memory of 3840 3496 9nnnbt.exe 94 PID 3840 wrote to memory of 1752 3840 vpjdp.exe 95 PID 3840 wrote to memory of 1752 3840 vpjdp.exe 95 PID 3840 wrote to memory of 1752 3840 vpjdp.exe 95 PID 1752 wrote to memory of 1356 1752 vjdvj.exe 96 PID 1752 wrote to memory of 1356 1752 vjdvj.exe 96 PID 1752 wrote to memory of 1356 1752 vjdvj.exe 96 PID 1356 wrote to memory of 3956 1356 3lfrxll.exe 97 PID 1356 wrote to memory of 3956 1356 3lfrxll.exe 97 PID 1356 wrote to memory of 3956 1356 3lfrxll.exe 97 PID 3956 wrote to memory of 3412 3956 ddvpj.exe 98 PID 3956 wrote to memory of 3412 3956 ddvpj.exe 98 PID 3956 wrote to memory of 3412 3956 ddvpj.exe 98 PID 3412 wrote to memory of 3304 3412 jpvpd.exe 99 PID 3412 wrote to memory of 3304 3412 jpvpd.exe 99 PID 3412 wrote to memory of 3304 3412 jpvpd.exe 99 PID 3304 wrote to memory of 548 3304 lxrllfx.exe 100 PID 3304 wrote to memory of 548 3304 lxrllfx.exe 100 PID 3304 wrote to memory of 548 3304 lxrllfx.exe 100 PID 548 wrote to memory of 368 548 7bnbhb.exe 101 PID 548 wrote to memory of 368 548 7bnbhb.exe 101 PID 548 wrote to memory of 368 548 7bnbhb.exe 101 PID 368 wrote to memory of 956 368 vvjvj.exe 102 PID 368 wrote to memory of 956 368 vvjvj.exe 102 PID 368 wrote to memory of 956 368 vvjvj.exe 102 PID 956 wrote to memory of 2740 956 rllrlrl.exe 103 PID 956 wrote to memory of 2740 956 rllrlrl.exe 103 PID 956 wrote to memory of 2740 956 rllrlrl.exe 103 PID 2740 wrote to memory of 3796 2740 ffffrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52.exe"C:\Users\Admin\AppData\Local\Temp\5642ce0610ec996456c14ae3842ea073cb0b9479d8c67cc2fb564b21bbeb7e52.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xflfxrl.exec:\xflfxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\rlrfxrr.exec:\rlrfxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\dvjjv.exec:\dvjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\fllffxr.exec:\fllffxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\ntthth.exec:\ntthth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\3nhtnh.exec:\3nhtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\1jpjd.exec:\1jpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\vvpvj.exec:\vvpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\rrlxrfr.exec:\rrlxrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\flflrrf.exec:\flflrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\9nnnbt.exec:\9nnnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\vpjdp.exec:\vpjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\vjdvj.exec:\vjdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\3lfrxll.exec:\3lfrxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\ddvpj.exec:\ddvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\jpvpd.exec:\jpvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\lxrllfx.exec:\lxrllfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\7bnbhb.exec:\7bnbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\vvjvj.exec:\vvjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\rllrlrl.exec:\rllrlrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\ffffrrl.exec:\ffffrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\nttnnh.exec:\nttnnh.exe23⤵
- Executes dropped EXE
PID:3796 -
\??\c:\dvvvv.exec:\dvvvv.exe24⤵
- Executes dropped EXE
PID:4508 -
\??\c:\flfxxfx.exec:\flfxxfx.exe25⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhnhhb.exec:\nhnhhb.exe26⤵
- Executes dropped EXE
PID:4628 -
\??\c:\1vvpd.exec:\1vvpd.exe27⤵
- Executes dropped EXE
PID:3528 -
\??\c:\pjjdv.exec:\pjjdv.exe28⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rflfrrl.exec:\rflfrrl.exe29⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hbhhhn.exec:\hbhhhn.exe30⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jvvjv.exec:\jvvjv.exe31⤵
- Executes dropped EXE
PID:3696 -
\??\c:\frfxllx.exec:\frfxllx.exe32⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vpppp.exec:\vpppp.exe33⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jdjjp.exec:\jdjjp.exe34⤵
- Executes dropped EXE
PID:2640 -
\??\c:\llxrrlx.exec:\llxrrlx.exe35⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5tthtn.exec:\5tthtn.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jvjdv.exec:\jvjdv.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ffffxxf.exec:\ffffxxf.exe38⤵
- Executes dropped EXE
PID:4824 -
\??\c:\lffxrrf.exec:\lffxrrf.exe39⤵
- Executes dropped EXE
PID:3848 -
\??\c:\hbttnh.exec:\hbttnh.exe40⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vddvd.exec:\vddvd.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jdppj.exec:\jdppj.exe42⤵
- Executes dropped EXE
PID:3680 -
\??\c:\vjpjv.exec:\vjpjv.exe43⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xxrflfx.exec:\xxrflfx.exe44⤵
- Executes dropped EXE
PID:4100 -
\??\c:\xxlffxl.exec:\xxlffxl.exe45⤵
- Executes dropped EXE
PID:3080 -
\??\c:\1ntnhh.exec:\1ntnhh.exe46⤵
- Executes dropped EXE
PID:4492 -
\??\c:\pppjj.exec:\pppjj.exe47⤵
- Executes dropped EXE
PID:5040 -
\??\c:\ddpjd.exec:\ddpjd.exe48⤵
- Executes dropped EXE
PID:3964 -
\??\c:\frxrrrx.exec:\frxrrrx.exe49⤵
- Executes dropped EXE
PID:1476 -
\??\c:\btnhhb.exec:\btnhhb.exe50⤵
- Executes dropped EXE
PID:3348 -
\??\c:\hnnhbb.exec:\hnnhbb.exe51⤵
- Executes dropped EXE
PID:3284 -
\??\c:\pjdvj.exec:\pjdvj.exe52⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3ddpd.exec:\3ddpd.exe53⤵
- Executes dropped EXE
PID:912 -
\??\c:\3rrrllf.exec:\3rrrllf.exe54⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxffxxl.exec:\lxffxxl.exe55⤵
- Executes dropped EXE
PID:3984 -
\??\c:\thnhhb.exec:\thnhhb.exe56⤵
- Executes dropped EXE
PID:636 -
\??\c:\jjpjv.exec:\jjpjv.exe57⤵
- Executes dropped EXE
PID:3840 -
\??\c:\vpppp.exec:\vpppp.exe58⤵
- Executes dropped EXE
PID:4808 -
\??\c:\rlfxrll.exec:\rlfxrll.exe59⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7rrlrrr.exec:\7rrlrrr.exe60⤵
- Executes dropped EXE
PID:1356 -
\??\c:\tnnnnn.exec:\tnnnnn.exe61⤵
- Executes dropped EXE
PID:4888 -
\??\c:\pjdvv.exec:\pjdvv.exe62⤵
- Executes dropped EXE
PID:3688 -
\??\c:\vjvjj.exec:\vjvjj.exe63⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lfrlrfx.exec:\lfrlrfx.exe64⤵
- Executes dropped EXE
PID:4728 -
\??\c:\rrxrllf.exec:\rrxrllf.exe65⤵
- Executes dropped EXE
PID:3780 -
\??\c:\hntnhh.exec:\hntnhh.exe66⤵PID:3640
-
\??\c:\jjjjd.exec:\jjjjd.exe67⤵PID:804
-
\??\c:\vpdpj.exec:\vpdpj.exe68⤵PID:2568
-
\??\c:\9flfffl.exec:\9flfffl.exe69⤵PID:452
-
\??\c:\xlxxxrr.exec:\xlxxxrr.exe70⤵PID:5036
-
\??\c:\bhhnhb.exec:\bhhnhb.exe71⤵PID:428
-
\??\c:\dvjjd.exec:\dvjjd.exe72⤵PID:1964
-
\??\c:\3djdp.exec:\3djdp.exe73⤵PID:4628
-
\??\c:\7rflxff.exec:\7rflxff.exe74⤵PID:3600
-
\??\c:\thnhhh.exec:\thnhhh.exe75⤵PID:2708
-
\??\c:\jjpjd.exec:\jjpjd.exe76⤵PID:3972
-
\??\c:\lrxlxxr.exec:\lrxlxxr.exe77⤵PID:1576
-
\??\c:\xlrlllf.exec:\xlrlllf.exe78⤵PID:4028
-
\??\c:\thhnnh.exec:\thhnnh.exe79⤵PID:1616
-
\??\c:\dvdvp.exec:\dvdvp.exe80⤵PID:2400
-
\??\c:\3vvpp.exec:\3vvpp.exe81⤵PID:4832
-
\??\c:\rfrffff.exec:\rfrffff.exe82⤵PID:2744
-
\??\c:\bnnnnn.exec:\bnnnnn.exe83⤵PID:532
-
\??\c:\tbtttn.exec:\tbtttn.exe84⤵PID:632
-
\??\c:\vjvjj.exec:\vjvjj.exe85⤵PID:2340
-
\??\c:\lffxrrl.exec:\lffxrrl.exe86⤵PID:2176
-
\??\c:\lxrllrr.exec:\lxrllrr.exe87⤵PID:4392
-
\??\c:\5bhtnb.exec:\5bhtnb.exe88⤵PID:1144
-
\??\c:\dvjjv.exec:\dvjjv.exe89⤵PID:2024
-
\??\c:\1rrlfff.exec:\1rrlfff.exe90⤵PID:1264
-
\??\c:\5bnntb.exec:\5bnntb.exe91⤵PID:3504
-
\??\c:\ttnhbb.exec:\ttnhbb.exe92⤵PID:3968
-
\??\c:\bbnnbt.exec:\bbnnbt.exe93⤵PID:4632
-
\??\c:\jjjdd.exec:\jjjdd.exe94⤵PID:3524
-
\??\c:\xflfrrl.exec:\xflfrrl.exe95⤵PID:1112
-
\??\c:\hhbttt.exec:\hhbttt.exe96⤵PID:2140
-
\??\c:\3ppjd.exec:\3ppjd.exe97⤵PID:1916
-
\??\c:\fffxxxx.exec:\fffxxxx.exe98⤵PID:1412
-
\??\c:\9rrrrrl.exec:\9rrrrrl.exe99⤵PID:400
-
\??\c:\bbhntt.exec:\bbhntt.exe100⤵PID:4232
-
\??\c:\ttbtbb.exec:\ttbtbb.exe101⤵PID:1944
-
\??\c:\1jpjp.exec:\1jpjp.exe102⤵PID:3496
-
\??\c:\pjjdd.exec:\pjjdd.exe103⤵PID:1628
-
\??\c:\5flxrrl.exec:\5flxrrl.exe104⤵PID:3664
-
\??\c:\7hnhbb.exec:\7hnhbb.exe105⤵PID:1752
-
\??\c:\nhbnnn.exec:\nhbnnn.exe106⤵PID:1564
-
\??\c:\htbbbt.exec:\htbbbt.exe107⤵PID:2008
-
\??\c:\dddjj.exec:\dddjj.exe108⤵PID:4804
-
\??\c:\lxlllll.exec:\lxlllll.exe109⤵PID:4132
-
\??\c:\llrrrrf.exec:\llrrrrf.exe110⤵PID:3304
-
\??\c:\bnhhbh.exec:\bnhhbh.exe111⤵PID:4820
-
\??\c:\3hhhnn.exec:\3hhhnn.exe112⤵PID:4152
-
\??\c:\ddppj.exec:\ddppj.exe113⤵PID:3640
-
\??\c:\vdjjv.exec:\vdjjv.exe114⤵PID:3060
-
\??\c:\lllrlrr.exec:\lllrlrr.exe115⤵PID:512
-
\??\c:\xfffxlf.exec:\xfffxlf.exe116⤵PID:4508
-
\??\c:\9bnnnn.exec:\9bnnnn.exe117⤵PID:2672
-
\??\c:\9ttbtt.exec:\9ttbtt.exe118⤵PID:4924
-
\??\c:\vpdvp.exec:\vpdvp.exe119⤵PID:2228
-
\??\c:\jjpjv.exec:\jjpjv.exe120⤵PID:3556
-
\??\c:\jjjdd.exec:\jjjdd.exe121⤵PID:2720
-
\??\c:\ffllffx.exec:\ffllffx.exe122⤵PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-