Analysis
- max time kernel
149s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c.exe
- Size 75KB
- Sample240519-23frbagb2z
- SHA256 6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c
- MD5 100ad383a9b6a467051cabd96f8c1b9f
- SHA1 d2cdea4e16a9c8a6f7527647b42a0caa9a589fd2
- SHA512 4acf36d81367fb54c5ea82976a979c18208c1d3c7f8d3a2a401cef0115bd71f0b88fbadf3b11919bc06a3b5813bb4d5142d44a904c4c2e5afaf13af1a6c73937
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1APk:ymb3NkkiQ3mdBjFIsIVbpUOk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4888-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/4888-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3400-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1724-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/864-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1796-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2156-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2156-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2156-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4960-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1232-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1232-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1232-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4304-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2196-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1388-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2288-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5084-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3564-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2684-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1552-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4816-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3984-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2072-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4932-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2388-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3400 pppjv.exe 1724 rrrllxx.exe 4584 9tbnhb.exe 864 jpppp.exe 1796 7pjpp.exe 1452 fxfrrlf.exe 3124 hnnntn.exe 2156 pdddd.exe 4960 nnnntn.exe 1232 jpppp.exe 4304 nhthhh.exe 2196 vvpdd.exe 4912 frrrfrr.exe 4576 rxrxrxr.exe 1388 bhbnnh.exe 4612 jjjpp.exe 2288 xrrrfff.exe 5084 hhhnht.exe 3564 vjppp.exe 2684 ffrrffr.exe 1552 9bnbhh.exe 4816 ddvvp.exe 4636 1llrfxx.exe 4028 ntnhhh.exe 3984 pdppj.exe 2072 1lrlxrr.exe 3676 thhbtn.exe 3688 dvvjv.exe 4904 xlrlfxx.exe 4932 bnbbhn.exe 2388 5dpvd.exe 676 fflffff.exe 2244 lrrrffl.exe 5036 vpppp.exe 2780 xrfrfxx.exe 980 htnhbt.exe 4140 thhhnn.exe 4332 7pppp.exe 5016 5xrrfxx.exe 5024 hhhhht.exe 4356 7bhhhn.exe 3396 pjdjd.exe 2804 flrrlll.exe 4628 ttttnn.exe 3116 dpdjp.exe 3832 jpvvv.exe 1748 tbbhtn.exe 3048 nhnhtb.exe 1056 jvjdp.exe 548 9flfxlf.exe 4380 1lxfffl.exe 4148 bbthhh.exe 3076 jvvvp.exe 1792 jjpjd.exe 4476 rllllll.exe 1616 ffrrrxx.exe 568 tbbbbb.exe 4976 vjvpp.exe 4860 ffxxffr.exe 920 htbhth.exe 2200 nbbbbb.exe 4352 dvddd.exe 2748 rxfffxx.exe 2328 hhbthb.exe -
resource yara_rule behavioral2/memory/4888-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-209-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 3400 4888 6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c.exe 82 PID 4888 wrote to memory of 3400 4888 6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c.exe 82 PID 4888 wrote to memory of 3400 4888 6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c.exe 82 PID 3400 wrote to memory of 1724 3400 pppjv.exe 83 PID 3400 wrote to memory of 1724 3400 pppjv.exe 83 PID 3400 wrote to memory of 1724 3400 pppjv.exe 83 PID 1724 wrote to memory of 4584 1724 rrrllxx.exe 84 PID 1724 wrote to memory of 4584 1724 rrrllxx.exe 84 PID 1724 wrote to memory of 4584 1724 rrrllxx.exe 84 PID 4584 wrote to memory of 864 4584 9tbnhb.exe 85 PID 4584 wrote to memory of 864 4584 9tbnhb.exe 85 PID 4584 wrote to memory of 864 4584 9tbnhb.exe 85 PID 864 wrote to memory of 1796 864 jpppp.exe 86 PID 864 wrote to memory of 1796 864 jpppp.exe 86 PID 864 wrote to memory of 1796 864 jpppp.exe 86 PID 1796 wrote to memory of 1452 1796 7pjpp.exe 87 PID 1796 wrote to memory of 1452 1796 7pjpp.exe 87 PID 1796 wrote to memory of 1452 1796 7pjpp.exe 87 PID 1452 wrote to memory of 3124 1452 fxfrrlf.exe 88 PID 1452 wrote to memory of 3124 1452 fxfrrlf.exe 88 PID 1452 wrote to memory of 3124 1452 fxfrrlf.exe 88 PID 3124 wrote to memory of 2156 3124 hnnntn.exe 89 PID 3124 wrote to memory of 2156 3124 hnnntn.exe 89 PID 3124 wrote to memory of 2156 3124 hnnntn.exe 89 PID 2156 wrote to memory of 4960 2156 pdddd.exe 90 PID 2156 wrote to memory of 4960 2156 pdddd.exe 90 PID 2156 wrote to memory of 4960 2156 pdddd.exe 90 PID 4960 wrote to memory of 1232 4960 nnnntn.exe 91 PID 4960 wrote to memory of 1232 4960 nnnntn.exe 91 PID 4960 wrote to memory of 1232 4960 nnnntn.exe 91 PID 1232 wrote to memory of 4304 1232 jpppp.exe 92 PID 1232 wrote to memory of 4304 1232 jpppp.exe 92 PID 1232 wrote to memory of 4304 1232 jpppp.exe 92 PID 4304 wrote to memory of 2196 4304 nhthhh.exe 93 PID 4304 wrote to memory of 2196 4304 nhthhh.exe 93 PID 4304 wrote to memory of 2196 4304 nhthhh.exe 93 PID 2196 wrote to memory of 4912 2196 vvpdd.exe 94 PID 2196 wrote to memory of 4912 2196 vvpdd.exe 94 PID 2196 wrote to memory of 4912 2196 vvpdd.exe 94 PID 4912 wrote to memory of 4576 4912 frrrfrr.exe 95 PID 4912 wrote to memory of 4576 4912 frrrfrr.exe 95 PID 4912 wrote to memory of 4576 4912 frrrfrr.exe 95 PID 4576 wrote to memory of 1388 4576 rxrxrxr.exe 96 PID 4576 wrote to memory of 1388 4576 rxrxrxr.exe 96 PID 4576 wrote to memory of 1388 4576 rxrxrxr.exe 96 PID 1388 wrote to memory of 4612 1388 bhbnnh.exe 97 PID 1388 wrote to memory of 4612 1388 bhbnnh.exe 97 PID 1388 wrote to memory of 4612 1388 bhbnnh.exe 97 PID 4612 wrote to memory of 2288 4612 jjjpp.exe 98 PID 4612 wrote to memory of 2288 4612 jjjpp.exe 98 PID 4612 wrote to memory of 2288 4612 jjjpp.exe 98 PID 2288 wrote to memory of 5084 2288 xrrrfff.exe 99 PID 2288 wrote to memory of 5084 2288 xrrrfff.exe 99 PID 2288 wrote to memory of 5084 2288 xrrrfff.exe 99 PID 5084 wrote to memory of 3564 5084 hhhnht.exe 100 PID 5084 wrote to memory of 3564 5084 hhhnht.exe 100 PID 5084 wrote to memory of 3564 5084 hhhnht.exe 100 PID 3564 wrote to memory of 2684 3564 vjppp.exe 101 PID 3564 wrote to memory of 2684 3564 vjppp.exe 101 PID 3564 wrote to memory of 2684 3564 vjppp.exe 101 PID 2684 wrote to memory of 1552 2684 ffrrffr.exe 102 PID 2684 wrote to memory of 1552 2684 ffrrffr.exe 102 PID 2684 wrote to memory of 1552 2684 ffrrffr.exe 102 PID 1552 wrote to memory of 4816 1552 9bnbhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c.exe"C:\Users\Admin\AppData\Local\Temp\6fcfcbdda541d25169b4067b795533fc70e27f47caf08f86fafde608faf4960c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\pppjv.exec:\pppjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\rrrllxx.exec:\rrrllxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\9tbnhb.exec:\9tbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\jpppp.exec:\jpppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\7pjpp.exec:\7pjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\fxfrrlf.exec:\fxfrrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\hnnntn.exec:\hnnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pdddd.exec:\pdddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\nnnntn.exec:\nnnntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\jpppp.exec:\jpppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\nhthhh.exec:\nhthhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\vvpdd.exec:\vvpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\frrrfrr.exec:\frrrfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\rxrxrxr.exec:\rxrxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\bhbnnh.exec:\bhbnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\jjjpp.exec:\jjjpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\xrrrfff.exec:\xrrrfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\hhhnht.exec:\hhhnht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\vjppp.exec:\vjppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\ffrrffr.exec:\ffrrffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\9bnbhh.exec:\9bnbhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\ddvvp.exec:\ddvvp.exe23⤵
- Executes dropped EXE
PID:4816 -
\??\c:\1llrfxx.exec:\1llrfxx.exe24⤵
- Executes dropped EXE
PID:4636 -
\??\c:\ntnhhh.exec:\ntnhhh.exe25⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pdppj.exec:\pdppj.exe26⤵
- Executes dropped EXE
PID:3984 -
\??\c:\1lrlxrr.exec:\1lrlxrr.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\thhbtn.exec:\thhbtn.exe28⤵
- Executes dropped EXE
PID:3676 -
\??\c:\dvvjv.exec:\dvvjv.exe29⤵
- Executes dropped EXE
PID:3688 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe30⤵
- Executes dropped EXE
PID:4904 -
\??\c:\bnbbhn.exec:\bnbbhn.exe31⤵
- Executes dropped EXE
PID:4932 -
\??\c:\5dpvd.exec:\5dpvd.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fflffff.exec:\fflffff.exe33⤵
- Executes dropped EXE
PID:676 -
\??\c:\lrrrffl.exec:\lrrrffl.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vpppp.exec:\vpppp.exe35⤵
- Executes dropped EXE
PID:5036 -
\??\c:\xrfrfxx.exec:\xrfrfxx.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\htnhbt.exec:\htnhbt.exe37⤵
- Executes dropped EXE
PID:980 -
\??\c:\thhhnn.exec:\thhhnn.exe38⤵
- Executes dropped EXE
PID:4140 -
\??\c:\7pppp.exec:\7pppp.exe39⤵
- Executes dropped EXE
PID:4332 -
\??\c:\5xrrfxx.exec:\5xrrfxx.exe40⤵
- Executes dropped EXE
PID:5016 -
\??\c:\hhhhht.exec:\hhhhht.exe41⤵
- Executes dropped EXE
PID:5024 -
\??\c:\7bhhhn.exec:\7bhhhn.exe42⤵
- Executes dropped EXE
PID:4356 -
\??\c:\pjdjd.exec:\pjdjd.exe43⤵
- Executes dropped EXE
PID:3396 -
\??\c:\flrrlll.exec:\flrrlll.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ttttnn.exec:\ttttnn.exe45⤵
- Executes dropped EXE
PID:4628 -
\??\c:\dpdjp.exec:\dpdjp.exe46⤵
- Executes dropped EXE
PID:3116 -
\??\c:\jpvvv.exec:\jpvvv.exe47⤵
- Executes dropped EXE
PID:3832 -
\??\c:\tbbhtn.exec:\tbbhtn.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nhnhtb.exec:\nhnhtb.exe49⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jvjdp.exec:\jvjdp.exe50⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9flfxlf.exec:\9flfxlf.exe51⤵
- Executes dropped EXE
PID:548 -
\??\c:\1lxfffl.exec:\1lxfffl.exe52⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bbthhh.exec:\bbthhh.exe53⤵
- Executes dropped EXE
PID:4148 -
\??\c:\jvvvp.exec:\jvvvp.exe54⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jjpjd.exec:\jjpjd.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rllllll.exec:\rllllll.exe56⤵
- Executes dropped EXE
PID:4476 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe57⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tbbbbb.exec:\tbbbbb.exe58⤵
- Executes dropped EXE
PID:568 -
\??\c:\vjvpp.exec:\vjvpp.exe59⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ffxxffr.exec:\ffxxffr.exe60⤵
- Executes dropped EXE
PID:4860 -
\??\c:\htbhth.exec:\htbhth.exe61⤵
- Executes dropped EXE
PID:920 -
\??\c:\nbbbbb.exec:\nbbbbb.exe62⤵
- Executes dropped EXE
PID:2200 -
\??\c:\dvddd.exec:\dvddd.exe63⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rxfffxx.exec:\rxfffxx.exe64⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hhbthb.exec:\hhbthb.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bhbhth.exec:\bhbhth.exe66⤵PID:4252
-
\??\c:\jdpdv.exec:\jdpdv.exe67⤵PID:1948
-
\??\c:\rflllrr.exec:\rflllrr.exe68⤵PID:4816
-
\??\c:\nhthtn.exec:\nhthtn.exe69⤵PID:3956
-
\??\c:\9vjjj.exec:\9vjjj.exe70⤵PID:5060
-
\??\c:\rlrlffx.exec:\rlrlffx.exe71⤵PID:2060
-
\??\c:\7rrlffr.exec:\7rrlffr.exe72⤵PID:2016
-
\??\c:\hhnnnn.exec:\hhnnnn.exe73⤵PID:2072
-
\??\c:\5jppp.exec:\5jppp.exe74⤵PID:3676
-
\??\c:\rxrffff.exec:\rxrffff.exe75⤵PID:792
-
\??\c:\hnnbnh.exec:\hnnbnh.exe76⤵PID:4904
-
\??\c:\vvjvd.exec:\vvjvd.exe77⤵PID:532
-
\??\c:\vjpdv.exec:\vjpdv.exe78⤵PID:1496
-
\??\c:\fxxlfxl.exec:\fxxlfxl.exe79⤵PID:4788
-
\??\c:\hbtnnh.exec:\hbtnnh.exe80⤵PID:3324
-
\??\c:\dvvvd.exec:\dvvvd.exe81⤵PID:2244
-
\??\c:\xrxrffl.exec:\xrxrffl.exe82⤵PID:2516
-
\??\c:\1xllflr.exec:\1xllflr.exe83⤵PID:4992
-
\??\c:\thbhhh.exec:\thbhhh.exe84⤵PID:4140
-
\??\c:\jvddd.exec:\jvddd.exe85⤵PID:2348
-
\??\c:\ppjjd.exec:\ppjjd.exe86⤵PID:3532
-
\??\c:\9lxrxrf.exec:\9lxrxrf.exe87⤵PID:3276
-
\??\c:\ttbhnn.exec:\ttbhnn.exe88⤵PID:3412
-
\??\c:\dvddp.exec:\dvddp.exe89⤵PID:2140
-
\??\c:\frllrrx.exec:\frllrrx.exe90⤵PID:4040
-
\??\c:\bnnbth.exec:\bnnbth.exe91⤵PID:1968
-
\??\c:\ppvvv.exec:\ppvvv.exe92⤵PID:3248
-
\??\c:\vvvvp.exec:\vvvvp.exe93⤵PID:3136
-
\??\c:\rllfxfx.exec:\rllfxfx.exe94⤵PID:1236
-
\??\c:\ppvvj.exec:\ppvvj.exe95⤵PID:2004
-
\??\c:\flrllrr.exec:\flrllrr.exe96⤵PID:2156
-
\??\c:\hnnnnh.exec:\hnnnnh.exe97⤵PID:2652
-
\??\c:\dpvpj.exec:\dpvpj.exe98⤵PID:1512
-
\??\c:\7bbbbn.exec:\7bbbbn.exe99⤵PID:4792
-
\??\c:\nbbttt.exec:\nbbttt.exe100⤵PID:3964
-
\??\c:\jpvpp.exec:\jpvpp.exe101⤵PID:3460
-
\??\c:\vpvpv.exec:\vpvpv.exe102⤵PID:1128
-
\??\c:\xffffll.exec:\xffffll.exe103⤵PID:4576
-
\??\c:\5xrxxxx.exec:\5xrxxxx.exe104⤵PID:2084
-
\??\c:\hnnhbb.exec:\hnnhbb.exe105⤵PID:5072
-
\??\c:\9bbbtb.exec:\9bbbtb.exe106⤵PID:952
-
\??\c:\1jvpp.exec:\1jvpp.exe107⤵PID:4312
-
\??\c:\7rxfxlf.exec:\7rxfxlf.exe108⤵PID:2656
-
\??\c:\3htntt.exec:\3htntt.exe109⤵PID:2748
-
\??\c:\tnhhnh.exec:\tnhhnh.exe110⤵PID:2180
-
\??\c:\vdpjv.exec:\vdpjv.exe111⤵PID:4868
-
\??\c:\1vdvv.exec:\1vdvv.exe112⤵PID:2676
-
\??\c:\xxffllx.exec:\xxffllx.exe113⤵PID:1436
-
\??\c:\bbbbtn.exec:\bbbbtn.exe114⤵PID:1172
-
\??\c:\5nnhhb.exec:\5nnhhb.exe115⤵PID:716
-
\??\c:\dvvpv.exec:\dvvpv.exe116⤵PID:1668
-
\??\c:\lxxlllx.exec:\lxxlllx.exe117⤵PID:4932
-
\??\c:\xfrxxlr.exec:\xfrxxlr.exe118⤵PID:3792
-
\??\c:\thtnnn.exec:\thtnnn.exe119⤵PID:1084
-
\??\c:\djdvd.exec:\djdvd.exe120⤵PID:1496
-
\??\c:\vppvj.exec:\vppvj.exe121⤵PID:4788
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe122⤵PID:3324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-