Analysis
- max time kernel
150s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639.exe
- Size 93KB
- Sample240518-agsefaad64
- SHA256 89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639
- MD5 96b7688de37096407e1285d7c3944fbe
- SHA1 9c5d47b117cea772e1456edb274da52198d9ccae
- SHA512 c98d698e8959c0dd868a7f2aa7c841cc85abb9cb66bd545d405f9bd9a19d60ceaba99da4277c9c1c3d8d2fa05b5a37b6e1d49445dc8570236c2a0643062f31de
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlR3hnjKXIQSe9oEi:ymb3NkkiQ3mdBjFoLucjDilOZhoV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4864-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/1476-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4864-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1476-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1052-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4304-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4476-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2824-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2452-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3420-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3420-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3420-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3420-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4872-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1020-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3160-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4216-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2008-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4764-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/540-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4468-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/440-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5012-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2588-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4412-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2292-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2168-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1772-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4864 pjpjd.exe 1052 dddjd.exe 4304 jjpjd.exe 4476 rrlrxrl.exe 2824 rlxxxxx.exe 4936 5nnnnt.exe 516 vpjpd.exe 1932 3flfxll.exe 2452 tntnht.exe 3420 pdvpj.exe 464 fllfxxr.exe 4872 ntnnnn.exe 1020 vjddd.exe 3160 fllfrrf.exe 4216 hbtbth.exe 2008 pjpjd.exe 4764 frrrfxr.exe 540 hhnhhh.exe 1616 dvvvv.exe 4468 rxlrrrr.exe 440 bhhbbb.exe 5012 pjppv.exe 1452 fflflfl.exe 2588 1hbbbb.exe 2920 vjppp.exe 4412 ffrfxrr.exe 2292 nthhbb.exe 5016 vpjpv.exe 2168 fxrlfff.exe 1772 btbttt.exe 1936 jdjjj.exe 1532 xrrrlrr.exe 4992 rlrlfff.exe 1912 tnbbhn.exe 3384 jjdvv.exe 1976 lllxxxx.exe 4980 hnnnnt.exe 2940 hntnnt.exe 4428 pjvpp.exe 3740 lrlffxr.exe 2664 7tbhtn.exe 392 ppdjp.exe 4304 djddj.exe 2356 lxlfxxl.exe 4988 hhhbhh.exe 4668 nnnnnt.exe 3080 ppdpd.exe 3152 rxrfxrf.exe 2360 9bhbnn.exe 1932 hhtntn.exe 372 pddvv.exe 3420 3xfxrrf.exe 1048 fxrrrrl.exe 1436 ttntbn.exe 1660 vpdvj.exe 1020 dvdjp.exe 1080 tbbbbb.exe 3232 dpvvj.exe 404 5xffxxx.exe 2012 bbtbtb.exe 3940 7bhhnb.exe 3960 ddpjp.exe 4360 rrfxrrr.exe 2788 xllrxxx.exe -
resource yara_rule behavioral2/memory/1476-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-199-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 4864 1476 89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639.exe 83 PID 1476 wrote to memory of 4864 1476 89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639.exe 83 PID 1476 wrote to memory of 4864 1476 89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639.exe 83 PID 4864 wrote to memory of 1052 4864 pjpjd.exe 84 PID 4864 wrote to memory of 1052 4864 pjpjd.exe 84 PID 4864 wrote to memory of 1052 4864 pjpjd.exe 84 PID 1052 wrote to memory of 4304 1052 dddjd.exe 85 PID 1052 wrote to memory of 4304 1052 dddjd.exe 85 PID 1052 wrote to memory of 4304 1052 dddjd.exe 85 PID 4304 wrote to memory of 4476 4304 jjpjd.exe 86 PID 4304 wrote to memory of 4476 4304 jjpjd.exe 86 PID 4304 wrote to memory of 4476 4304 jjpjd.exe 86 PID 4476 wrote to memory of 2824 4476 rrlrxrl.exe 87 PID 4476 wrote to memory of 2824 4476 rrlrxrl.exe 87 PID 4476 wrote to memory of 2824 4476 rrlrxrl.exe 87 PID 2824 wrote to memory of 4936 2824 rlxxxxx.exe 88 PID 2824 wrote to memory of 4936 2824 rlxxxxx.exe 88 PID 2824 wrote to memory of 4936 2824 rlxxxxx.exe 88 PID 4936 wrote to memory of 516 4936 5nnnnt.exe 89 PID 4936 wrote to memory of 516 4936 5nnnnt.exe 89 PID 4936 wrote to memory of 516 4936 5nnnnt.exe 89 PID 516 wrote to memory of 1932 516 vpjpd.exe 90 PID 516 wrote to memory of 1932 516 vpjpd.exe 90 PID 516 wrote to memory of 1932 516 vpjpd.exe 90 PID 1932 wrote to memory of 2452 1932 3flfxll.exe 91 PID 1932 wrote to memory of 2452 1932 3flfxll.exe 91 PID 1932 wrote to memory of 2452 1932 3flfxll.exe 91 PID 2452 wrote to memory of 3420 2452 tntnht.exe 92 PID 2452 wrote to memory of 3420 2452 tntnht.exe 92 PID 2452 wrote to memory of 3420 2452 tntnht.exe 92 PID 3420 wrote to memory of 464 3420 pdvpj.exe 93 PID 3420 wrote to memory of 464 3420 pdvpj.exe 93 PID 3420 wrote to memory of 464 3420 pdvpj.exe 93 PID 464 wrote to memory of 4872 464 fllfxxr.exe 94 PID 464 wrote to memory of 4872 464 fllfxxr.exe 94 PID 464 wrote to memory of 4872 464 fllfxxr.exe 94 PID 4872 wrote to memory of 1020 4872 ntnnnn.exe 95 PID 4872 wrote to memory of 1020 4872 ntnnnn.exe 95 PID 4872 wrote to memory of 1020 4872 ntnnnn.exe 95 PID 1020 wrote to memory of 3160 1020 vjddd.exe 96 PID 1020 wrote to memory of 3160 1020 vjddd.exe 96 PID 1020 wrote to memory of 3160 1020 vjddd.exe 96 PID 3160 wrote to memory of 4216 3160 fllfrrf.exe 97 PID 3160 wrote to memory of 4216 3160 fllfrrf.exe 97 PID 3160 wrote to memory of 4216 3160 fllfrrf.exe 97 PID 4216 wrote to memory of 2008 4216 hbtbth.exe 98 PID 4216 wrote to memory of 2008 4216 hbtbth.exe 98 PID 4216 wrote to memory of 2008 4216 hbtbth.exe 98 PID 2008 wrote to memory of 4764 2008 pjpjd.exe 99 PID 2008 wrote to memory of 4764 2008 pjpjd.exe 99 PID 2008 wrote to memory of 4764 2008 pjpjd.exe 99 PID 4764 wrote to memory of 540 4764 frrrfxr.exe 100 PID 4764 wrote to memory of 540 4764 frrrfxr.exe 100 PID 4764 wrote to memory of 540 4764 frrrfxr.exe 100 PID 540 wrote to memory of 1616 540 hhnhhh.exe 101 PID 540 wrote to memory of 1616 540 hhnhhh.exe 101 PID 540 wrote to memory of 1616 540 hhnhhh.exe 101 PID 1616 wrote to memory of 4468 1616 dvvvv.exe 102 PID 1616 wrote to memory of 4468 1616 dvvvv.exe 102 PID 1616 wrote to memory of 4468 1616 dvvvv.exe 102 PID 4468 wrote to memory of 440 4468 rxlrrrr.exe 103 PID 4468 wrote to memory of 440 4468 rxlrrrr.exe 103 PID 4468 wrote to memory of 440 4468 rxlrrrr.exe 103 PID 440 wrote to memory of 5012 440 bhhbbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639.exe"C:\Users\Admin\AppData\Local\Temp\89968a8f89dedc350a05664378abbd4efae6698cfd4a2ed2f8c4981e6c897639.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\pjpjd.exec:\pjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\dddjd.exec:\dddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jjpjd.exec:\jjpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\rrlrxrl.exec:\rrlrxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\5nnnnt.exec:\5nnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\vpjpd.exec:\vpjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\3flfxll.exec:\3flfxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tntnht.exec:\tntnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\pdvpj.exec:\pdvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\fllfxxr.exec:\fllfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\ntnnnn.exec:\ntnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\vjddd.exec:\vjddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\fllfrrf.exec:\fllfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\hbtbth.exec:\hbtbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\pjpjd.exec:\pjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\frrrfxr.exec:\frrrfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\hhnhhh.exec:\hhnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\dvvvv.exec:\dvvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\rxlrrrr.exec:\rxlrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\bhhbbb.exec:\bhhbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\pjppv.exec:\pjppv.exe23⤵
- Executes dropped EXE
PID:5012 -
\??\c:\fflflfl.exec:\fflflfl.exe24⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1hbbbb.exec:\1hbbbb.exe25⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vjppp.exec:\vjppp.exe26⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ffrfxrr.exec:\ffrfxrr.exe27⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nthhbb.exec:\nthhbb.exe28⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vpjpv.exec:\vpjpv.exe29⤵
- Executes dropped EXE
PID:5016 -
\??\c:\fxrlfff.exec:\fxrlfff.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\btbttt.exec:\btbttt.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdjjj.exec:\jdjjj.exe32⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xrrrlrr.exec:\xrrrlrr.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rlrlfff.exec:\rlrlfff.exe34⤵
- Executes dropped EXE
PID:4992 -
\??\c:\tnbbhn.exec:\tnbbhn.exe35⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jjdvv.exec:\jjdvv.exe36⤵
- Executes dropped EXE
PID:3384 -
\??\c:\lllxxxx.exec:\lllxxxx.exe37⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hnnnnt.exec:\hnnnnt.exe38⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hntnnt.exec:\hntnnt.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjvpp.exec:\pjvpp.exe40⤵
- Executes dropped EXE
PID:4428 -
\??\c:\lrlffxr.exec:\lrlffxr.exe41⤵
- Executes dropped EXE
PID:3740 -
\??\c:\7tbhtn.exec:\7tbhtn.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ppdjp.exec:\ppdjp.exe43⤵
- Executes dropped EXE
PID:392 -
\??\c:\djddj.exec:\djddj.exe44⤵
- Executes dropped EXE
PID:4304 -
\??\c:\lxlfxxl.exec:\lxlfxxl.exe45⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hhhbhh.exec:\hhhbhh.exe46⤵
- Executes dropped EXE
PID:4988 -
\??\c:\nnnnnt.exec:\nnnnnt.exe47⤵
- Executes dropped EXE
PID:4668 -
\??\c:\ppdpd.exec:\ppdpd.exe48⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rxrfxrf.exec:\rxrfxrf.exe49⤵
- Executes dropped EXE
PID:3152 -
\??\c:\9bhbnn.exec:\9bhbnn.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hhtntn.exec:\hhtntn.exe51⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pddvv.exec:\pddvv.exe52⤵
- Executes dropped EXE
PID:372 -
\??\c:\3xfxrrf.exec:\3xfxrrf.exe53⤵
- Executes dropped EXE
PID:3420 -
\??\c:\fxrrrrl.exec:\fxrrrrl.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ttntbn.exec:\ttntbn.exe55⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vpdvj.exec:\vpdvj.exe56⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dvdjp.exec:\dvdjp.exe57⤵
- Executes dropped EXE
PID:1020 -
\??\c:\tbbbbb.exec:\tbbbbb.exe58⤵
- Executes dropped EXE
PID:1080 -
\??\c:\dpvvj.exec:\dpvvj.exe59⤵
- Executes dropped EXE
PID:3232 -
\??\c:\5xffxxx.exec:\5xffxxx.exe60⤵
- Executes dropped EXE
PID:404 -
\??\c:\bbtbtb.exec:\bbtbtb.exe61⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7bhhnb.exec:\7bhhnb.exe62⤵
- Executes dropped EXE
PID:3940 -
\??\c:\ddpjp.exec:\ddpjp.exe63⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe64⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xllrxxx.exec:\xllrxxx.exe65⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3tbbnt.exec:\3tbbnt.exe66⤵PID:2532
-
\??\c:\9thhnt.exec:\9thhnt.exe67⤵PID:2708
-
\??\c:\xrrffxx.exec:\xrrffxx.exe68⤵PID:4724
-
\??\c:\htbtnn.exec:\htbtnn.exe69⤵PID:3876
-
\??\c:\djjjj.exec:\djjjj.exe70⤵PID:4960
-
\??\c:\jjpjj.exec:\jjpjj.exe71⤵PID:1736
-
\??\c:\fflfflr.exec:\fflfflr.exe72⤵PID:1748
-
\??\c:\tnntbb.exec:\tnntbb.exe73⤵PID:3924
-
\??\c:\djvdv.exec:\djvdv.exe74⤵PID:864
-
\??\c:\3djvp.exec:\3djvp.exe75⤵PID:4556
-
\??\c:\tnnhbh.exec:\tnnhbh.exe76⤵PID:1564
-
\??\c:\dvvvp.exec:\dvvvp.exe77⤵PID:4176
-
\??\c:\jpjvd.exec:\jpjvd.exe78⤵PID:4704
-
\??\c:\lrlxxxx.exec:\lrlxxxx.exe79⤵PID:2752
-
\??\c:\dvvpv.exec:\dvvpv.exe80⤵PID:4616
-
\??\c:\fxlffxf.exec:\fxlffxf.exe81⤵PID:940
-
\??\c:\ffxxfrf.exec:\ffxxfrf.exe82⤵PID:4864
-
\??\c:\bbhbtb.exec:\bbhbtb.exe83⤵PID:5084
-
\??\c:\vvjjp.exec:\vvjjp.exe84⤵PID:1548
-
\??\c:\lfrrxff.exec:\lfrrxff.exe85⤵PID:920
-
\??\c:\rllfrff.exec:\rllfrff.exe86⤵PID:3472
-
\??\c:\bhhhhh.exec:\bhhhhh.exe87⤵PID:4788
-
\??\c:\ddjjj.exec:\ddjjj.exe88⤵PID:536
-
\??\c:\xlrlllf.exec:\xlrlllf.exe89⤵PID:1472
-
\??\c:\fflfxfl.exec:\fflfxfl.exe90⤵PID:1788
-
\??\c:\bhhhhn.exec:\bhhhhn.exe91⤵PID:1464
-
\??\c:\1jpjj.exec:\1jpjj.exe92⤵PID:3768
-
\??\c:\llxxxfl.exec:\llxxxfl.exe93⤵PID:2452
-
\??\c:\lrlllrr.exec:\lrlllrr.exe94⤵PID:1568
-
\??\c:\btbbbb.exec:\btbbbb.exe95⤵PID:464
-
\??\c:\tbntnn.exec:\tbntnn.exe96⤵PID:1284
-
\??\c:\nbhhbb.exec:\nbhhbb.exe97⤵PID:4872
-
\??\c:\1dvvj.exec:\1dvvj.exe98⤵PID:3716
-
\??\c:\1flrlll.exec:\1flrlll.exe99⤵PID:1940
-
\??\c:\lxxxxll.exec:\lxxxxll.exe100⤵PID:4488
-
\??\c:\hbtttb.exec:\hbtttb.exe101⤵PID:2328
-
\??\c:\bttbtt.exec:\bttbtt.exe102⤵PID:704
-
\??\c:\vddjv.exec:\vddjv.exe103⤵PID:4248
-
\??\c:\rxflrxx.exec:\rxflrxx.exe104⤵PID:1556
-
\??\c:\flxxffr.exec:\flxxffr.exe105⤵PID:2888
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe106⤵PID:4904
-
\??\c:\htnhhh.exec:\htnhhh.exe107⤵PID:4596
-
\??\c:\nhtnnt.exec:\nhtnnt.exe108⤵PID:3940
-
\??\c:\1pvdd.exec:\1pvdd.exe109⤵PID:2676
-
\??\c:\jppjv.exec:\jppjv.exe110⤵PID:4700
-
\??\c:\ffffxff.exec:\ffffxff.exe111⤵PID:2532
-
\??\c:\lfrrrff.exec:\lfrrrff.exe112⤵PID:1240
-
\??\c:\bhbhnt.exec:\bhbhnt.exe113⤵PID:2032
-
\??\c:\1nhbhh.exec:\1nhbhh.exe114⤵PID:3508
-
\??\c:\pvjvj.exec:\pvjvj.exe115⤵PID:4756
-
\??\c:\dpdvp.exec:\dpdvp.exe116⤵PID:3924
-
\??\c:\lrxxfff.exec:\lrxxfff.exe117⤵PID:2140
-
\??\c:\rrxrlll.exec:\rrxrlll.exe118⤵PID:2420
-
\??\c:\hbnhhh.exec:\hbnhhh.exe119⤵PID:5060
-
\??\c:\3ntnbh.exec:\3ntnbh.exe120⤵PID:4852
-
\??\c:\djvjv.exec:\djvjv.exe121⤵PID:2940
-
\??\c:\vjddp.exec:\vjddp.exe122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-