Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 08:01
Static task
static1
Behavioral task
behavioral1
Sample
d7b947c8f4365722e24b430542fb015c86d7dafc180e300279e9742e4f6fe8ae.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d7b947c8f4365722e24b430542fb015c86d7dafc180e300279e9742e4f6fe8ae.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe
Resource
win7-20240508-en
General
-
Target
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe
-
Size
86KB
-
MD5
7fff6d0a3cdbf7320ab4f7a378c92c85
-
SHA1
de363c54132e4276e51d6a15f95b9e157aa98592
-
SHA256
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45
-
SHA512
cb3aef588e122b0da6efb4d3e730cd3b1a4967591919d25469e20ae8748991007531ed3bf24bb73adb73f6919ff8a6151056b116d46be3229bfa10f1faf89a3b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9jXX8:ymb3NkkiQ3mdBjFo73tvn+Yp9jn8
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral4/memory/644-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/3924-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/556-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/1388-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral4/memory/1388-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/1812-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/3692-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/512-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/5072-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/4436-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/1080-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/3728-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/2252-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/4640-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/3488-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/2056-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/1316-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/4440-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/4540-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/4620-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/2740-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/3400-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/2004-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/1408-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral4/memory/2280-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dpppj.exexxlrfll.exebnhhht.exenntbth.exe7lrlfff.exe1nbbtb.exehthttn.exevpvvp.exexlxrrrr.exehhbbbh.exevvjpp.exefffffrx.exefflllrr.exehbbbtb.exevpddp.exe5xffxfx.exe7tnttb.exe9jjjd.exe7vjjd.exerrxxrrr.exenbnntb.exeddjjd.exedvddv.exexflfrxx.exebbbbhn.exejvvpj.exe9pvvp.exe5bnnhn.exentbbtn.exevvvjj.exefrllffl.exeflxxlrr.exetnhnnt.exevpddd.exepdjjj.exexfxxxfl.exetttttt.exetttbbb.exevdppj.exeddpvd.exe5frrllr.exe7xllrrx.exenththn.exennhnhh.exe1pvvv.exejvvpd.exe9xlllrr.exeflllflf.exe7htbtb.exerxxxxff.exe7rxllrf.exe5tthnt.exetbthhn.exevjvpj.exepjvjp.exefrlflxx.exennbbnt.exetttbbb.exejpvvv.exepdppp.exerlxxrxx.exe1xlxxll.exennbbnt.exenhtnnh.exepid process 3924 dpppj.exe 556 xxlrfll.exe 1388 bnhhht.exe 1812 nntbth.exe 4520 7lrlfff.exe 3692 1nbbtb.exe 512 hthttn.exe 5072 vpvvp.exe 4436 xlxrrrr.exe 1080 hhbbbh.exe 2196 vvjpp.exe 2888 fffffrx.exe 3728 fflllrr.exe 2252 hbbbtb.exe 4640 vpddp.exe 3488 5xffxfx.exe 2056 7tnttb.exe 1168 9jjjd.exe 3452 7vjjd.exe 1316 rrxxrrr.exe 1284 nbnntb.exe 4440 ddjjd.exe 2860 dvddv.exe 4540 xflfrxx.exe 4620 bbbbhn.exe 2740 jvvpj.exe 3400 9pvvp.exe 2004 5bnnhn.exe 1408 ntbbtn.exe 3840 vvvjj.exe 2280 frllffl.exe 4336 flxxlrr.exe 1536 tnhnnt.exe 232 vpddd.exe 3568 pdjjj.exe 696 xfxxxfl.exe 3924 tttttt.exe 3740 tttbbb.exe 4168 vdppj.exe 3748 ddpvd.exe 1528 5frrllr.exe 392 7xllrrx.exe 4104 nththn.exe 4480 nnhnhh.exe 2816 1pvvv.exe 3980 jvvpd.exe 3208 9xlllrr.exe 1384 flllflf.exe 1872 7htbtb.exe 4996 rxxxxff.exe 1648 7rxllrf.exe 1000 5tthnt.exe 2556 tbthhn.exe 2472 vjvpj.exe 1560 pjvjp.exe 2752 frlflxx.exe 4652 nnbbnt.exe 2760 tttbbb.exe 4808 jpvvv.exe 684 pdppp.exe 3908 rlxxrxx.exe 1276 1xlxxll.exe 868 nnbbnt.exe 4452 nhtnnh.exe -
Processes:
resource yara_rule behavioral4/memory/644-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/3924-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/556-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/1388-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/1812-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/3692-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/512-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/5072-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/4436-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/1080-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/3728-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/2252-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/4640-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/3488-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/2056-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/1316-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/4440-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/4540-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/4620-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/2740-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/3400-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/2004-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/1408-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral4/memory/2280-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exedpppj.exexxlrfll.exebnhhht.exenntbth.exe7lrlfff.exe1nbbtb.exehthttn.exevpvvp.exexlxrrrr.exehhbbbh.exevvjpp.exefffffrx.exefflllrr.exehbbbtb.exevpddp.exe5xffxfx.exe7tnttb.exe9jjjd.exe7vjjd.exerrxxrrr.exenbnntb.exedescription pid process target process PID 644 wrote to memory of 3924 644 d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe dpppj.exe PID 644 wrote to memory of 3924 644 d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe dpppj.exe PID 644 wrote to memory of 3924 644 d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe dpppj.exe PID 3924 wrote to memory of 556 3924 dpppj.exe xxlrfll.exe PID 3924 wrote to memory of 556 3924 dpppj.exe xxlrfll.exe PID 3924 wrote to memory of 556 3924 dpppj.exe xxlrfll.exe PID 556 wrote to memory of 1388 556 xxlrfll.exe bnhhht.exe PID 556 wrote to memory of 1388 556 xxlrfll.exe bnhhht.exe PID 556 wrote to memory of 1388 556 xxlrfll.exe bnhhht.exe PID 1388 wrote to memory of 1812 1388 bnhhht.exe nntbth.exe PID 1388 wrote to memory of 1812 1388 bnhhht.exe nntbth.exe PID 1388 wrote to memory of 1812 1388 bnhhht.exe nntbth.exe PID 1812 wrote to memory of 4520 1812 nntbth.exe 7lrlfff.exe PID 1812 wrote to memory of 4520 1812 nntbth.exe 7lrlfff.exe PID 1812 wrote to memory of 4520 1812 nntbth.exe 7lrlfff.exe PID 4520 wrote to memory of 3692 4520 7lrlfff.exe 1nbbtb.exe PID 4520 wrote to memory of 3692 4520 7lrlfff.exe 1nbbtb.exe PID 4520 wrote to memory of 3692 4520 7lrlfff.exe 1nbbtb.exe PID 3692 wrote to memory of 512 3692 1nbbtb.exe hthttn.exe PID 3692 wrote to memory of 512 3692 1nbbtb.exe hthttn.exe PID 3692 wrote to memory of 512 3692 1nbbtb.exe hthttn.exe PID 512 wrote to memory of 5072 512 hthttn.exe vpvvp.exe PID 512 wrote to memory of 5072 512 hthttn.exe vpvvp.exe PID 512 wrote to memory of 5072 512 hthttn.exe vpvvp.exe PID 5072 wrote to memory of 4436 5072 vpvvp.exe xlxrrrr.exe PID 5072 wrote to memory of 4436 5072 vpvvp.exe xlxrrrr.exe PID 5072 wrote to memory of 4436 5072 vpvvp.exe xlxrrrr.exe PID 4436 wrote to memory of 1080 4436 xlxrrrr.exe hhbbbh.exe PID 4436 wrote to memory of 1080 4436 xlxrrrr.exe hhbbbh.exe PID 4436 wrote to memory of 1080 4436 xlxrrrr.exe hhbbbh.exe PID 1080 wrote to memory of 2196 1080 hhbbbh.exe vvjpp.exe PID 1080 wrote to memory of 2196 1080 hhbbbh.exe vvjpp.exe PID 1080 wrote to memory of 2196 1080 hhbbbh.exe vvjpp.exe PID 2196 wrote to memory of 2888 2196 vvjpp.exe fffffrx.exe PID 2196 wrote to memory of 2888 2196 vvjpp.exe fffffrx.exe PID 2196 wrote to memory of 2888 2196 vvjpp.exe fffffrx.exe PID 2888 wrote to memory of 3728 2888 fffffrx.exe fflllrr.exe PID 2888 wrote to memory of 3728 2888 fffffrx.exe fflllrr.exe PID 2888 wrote to memory of 3728 2888 fffffrx.exe fflllrr.exe PID 3728 wrote to memory of 2252 3728 fflllrr.exe hbbbtb.exe PID 3728 wrote to memory of 2252 3728 fflllrr.exe hbbbtb.exe PID 3728 wrote to memory of 2252 3728 fflllrr.exe hbbbtb.exe PID 2252 wrote to memory of 4640 2252 hbbbtb.exe vpddp.exe PID 2252 wrote to memory of 4640 2252 hbbbtb.exe vpddp.exe PID 2252 wrote to memory of 4640 2252 hbbbtb.exe vpddp.exe PID 4640 wrote to memory of 3488 4640 vpddp.exe 5xffxfx.exe PID 4640 wrote to memory of 3488 4640 vpddp.exe 5xffxfx.exe PID 4640 wrote to memory of 3488 4640 vpddp.exe 5xffxfx.exe PID 3488 wrote to memory of 2056 3488 5xffxfx.exe 7tnttb.exe PID 3488 wrote to memory of 2056 3488 5xffxfx.exe 7tnttb.exe PID 3488 wrote to memory of 2056 3488 5xffxfx.exe 7tnttb.exe PID 2056 wrote to memory of 1168 2056 7tnttb.exe 9jjjd.exe PID 2056 wrote to memory of 1168 2056 7tnttb.exe 9jjjd.exe PID 2056 wrote to memory of 1168 2056 7tnttb.exe 9jjjd.exe PID 1168 wrote to memory of 3452 1168 9jjjd.exe 7vjjd.exe PID 1168 wrote to memory of 3452 1168 9jjjd.exe 7vjjd.exe PID 1168 wrote to memory of 3452 1168 9jjjd.exe 7vjjd.exe PID 3452 wrote to memory of 1316 3452 7vjjd.exe rrxxrrr.exe PID 3452 wrote to memory of 1316 3452 7vjjd.exe rrxxrrr.exe PID 3452 wrote to memory of 1316 3452 7vjjd.exe rrxxrrr.exe PID 1316 wrote to memory of 1284 1316 rrxxrrr.exe nbnntb.exe PID 1316 wrote to memory of 1284 1316 rrxxrrr.exe nbnntb.exe PID 1316 wrote to memory of 1284 1316 rrxxrrr.exe nbnntb.exe PID 1284 wrote to memory of 4440 1284 nbnntb.exe ddjjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe"C:\Users\Admin\AppData\Local\Temp\d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\dpppj.exec:\dpppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\xxlrfll.exec:\xxlrfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\bnhhht.exec:\bnhhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\nntbth.exec:\nntbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\7lrlfff.exec:\7lrlfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\1nbbtb.exec:\1nbbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\hthttn.exec:\hthttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\vpvvp.exec:\vpvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\hhbbbh.exec:\hhbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\vvjpp.exec:\vvjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\fffffrx.exec:\fffffrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fflllrr.exec:\fflllrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\hbbbtb.exec:\hbbbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vpddp.exec:\vpddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\5xffxfx.exec:\5xffxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\7tnttb.exec:\7tnttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\9jjjd.exec:\9jjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\7vjjd.exec:\7vjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\nbnntb.exec:\nbnntb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\ddjjd.exec:\ddjjd.exe23⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dvddv.exec:\dvddv.exe24⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xflfrxx.exec:\xflfrxx.exe25⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bbbbhn.exec:\bbbbhn.exe26⤵
- Executes dropped EXE
PID:4620 -
\??\c:\jvvpj.exec:\jvvpj.exe27⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9pvvp.exec:\9pvvp.exe28⤵
- Executes dropped EXE
PID:3400 -
\??\c:\5bnnhn.exec:\5bnnhn.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ntbbtn.exec:\ntbbtn.exe30⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vvvjj.exec:\vvvjj.exe31⤵
- Executes dropped EXE
PID:3840 -
\??\c:\frllffl.exec:\frllffl.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\flxxlrr.exec:\flxxlrr.exe33⤵
- Executes dropped EXE
PID:4336 -
\??\c:\tnhnnt.exec:\tnhnnt.exe34⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vpddd.exec:\vpddd.exe35⤵
- Executes dropped EXE
PID:232 -
\??\c:\pdjjj.exec:\pdjjj.exe36⤵
- Executes dropped EXE
PID:3568 -
\??\c:\9rlrlfl.exec:\9rlrlfl.exe37⤵PID:4376
-
\??\c:\xfxxxfl.exec:\xfxxxfl.exe38⤵
- Executes dropped EXE
PID:696 -
\??\c:\tttttt.exec:\tttttt.exe39⤵
- Executes dropped EXE
PID:3924 -
\??\c:\tttbbb.exec:\tttbbb.exe40⤵
- Executes dropped EXE
PID:3740 -
\??\c:\vdppj.exec:\vdppj.exe41⤵
- Executes dropped EXE
PID:4168 -
\??\c:\ddpvd.exec:\ddpvd.exe42⤵
- Executes dropped EXE
PID:3748 -
\??\c:\5frrllr.exec:\5frrllr.exe43⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7xllrrx.exec:\7xllrrx.exe44⤵
- Executes dropped EXE
PID:392 -
\??\c:\nththn.exec:\nththn.exe45⤵
- Executes dropped EXE
PID:4104 -
\??\c:\nnhnhh.exec:\nnhnhh.exe46⤵
- Executes dropped EXE
PID:4480 -
\??\c:\1pvvv.exec:\1pvvv.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jvvpd.exec:\jvvpd.exe48⤵
- Executes dropped EXE
PID:3980 -
\??\c:\9xlllrr.exec:\9xlllrr.exe49⤵
- Executes dropped EXE
PID:3208 -
\??\c:\flllflf.exec:\flllflf.exe50⤵
- Executes dropped EXE
PID:1384 -
\??\c:\7htbtb.exec:\7htbtb.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rxxxxff.exec:\rxxxxff.exe52⤵
- Executes dropped EXE
PID:4996 -
\??\c:\7rxllrf.exec:\7rxllrf.exe53⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5tthnt.exec:\5tthnt.exe54⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tbthhn.exec:\tbthhn.exe55⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vjvpj.exec:\vjvpj.exe56⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pjvjp.exec:\pjvjp.exe57⤵
- Executes dropped EXE
PID:1560 -
\??\c:\frlflxx.exec:\frlflxx.exe58⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nnbbnt.exec:\nnbbnt.exe59⤵
- Executes dropped EXE
PID:4652 -
\??\c:\tttbbb.exec:\tttbbb.exe60⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jpvvv.exec:\jpvvv.exe61⤵
- Executes dropped EXE
PID:4808 -
\??\c:\pdppp.exec:\pdppp.exe62⤵
- Executes dropped EXE
PID:684 -
\??\c:\rlxxrxx.exec:\rlxxrxx.exe63⤵
- Executes dropped EXE
PID:3908 -
\??\c:\1xlxxll.exec:\1xlxxll.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nnbbnt.exec:\nnbbnt.exe65⤵
- Executes dropped EXE
PID:868 -
\??\c:\nhtnnh.exec:\nhtnnh.exe66⤵
- Executes dropped EXE
PID:4452 -
\??\c:\djppv.exec:\djppv.exe67⤵PID:2256
-
\??\c:\djvpd.exec:\djvpd.exe68⤵PID:3076
-
\??\c:\frfffrx.exec:\frfffrx.exe69⤵PID:4084
-
\??\c:\5rllrxl.exec:\5rllrxl.exe70⤵PID:400
-
\??\c:\bhtttt.exec:\bhtttt.exe71⤵PID:592
-
\??\c:\nbnbtb.exec:\nbnbtb.exe72⤵PID:3500
-
\??\c:\dpppp.exec:\dpppp.exe73⤵PID:2740
-
\??\c:\5vjdv.exec:\5vjdv.exe74⤵PID:3224
-
\??\c:\frrrllr.exec:\frrrllr.exe75⤵PID:2152
-
\??\c:\5rfffff.exec:\5rfffff.exe76⤵PID:4992
-
\??\c:\9hnntt.exec:\9hnntt.exe77⤵PID:1364
-
\??\c:\btbbhh.exec:\btbbhh.exe78⤵PID:3840
-
\??\c:\vpjjv.exec:\vpjjv.exe79⤵PID:2224
-
\??\c:\pjppj.exec:\pjppj.exe80⤵PID:2440
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe81⤵PID:220
-
\??\c:\9rffxfl.exec:\9rffxfl.exe82⤵PID:4404
-
\??\c:\7nbnhh.exec:\7nbnhh.exe83⤵PID:4524
-
\??\c:\jjpvv.exec:\jjpvv.exe84⤵PID:3572
-
\??\c:\ffrxxff.exec:\ffrxxff.exe85⤵PID:696
-
\??\c:\rffxxrl.exec:\rffxxrl.exe86⤵PID:556
-
\??\c:\btbbhn.exec:\btbbhn.exe87⤵PID:920
-
\??\c:\3dppj.exec:\3dppj.exe88⤵PID:468
-
\??\c:\jvjdp.exec:\jvjdp.exe89⤵PID:3748
-
\??\c:\llxxffx.exec:\llxxffx.exe90⤵PID:1528
-
\??\c:\rrfffll.exec:\rrfffll.exe91⤵PID:3804
-
\??\c:\nhhhhh.exec:\nhhhhh.exe92⤵PID:2532
-
\??\c:\nhnttb.exec:\nhnttb.exe93⤵PID:1816
-
\??\c:\pvvpv.exec:\pvvpv.exe94⤵PID:5072
-
\??\c:\3jvvd.exec:\3jvvd.exe95⤵PID:452
-
\??\c:\xrlxxrl.exec:\xrlxxrl.exe96⤵PID:2624
-
\??\c:\bhhhht.exec:\bhhhht.exe97⤵PID:2236
-
\??\c:\nttttb.exec:\nttttb.exe98⤵PID:1872
-
\??\c:\vjvdv.exec:\vjvdv.exe99⤵PID:4996
-
\??\c:\jdjjd.exec:\jdjjd.exe100⤵PID:4984
-
\??\c:\7frrrxr.exec:\7frrrxr.exe101⤵PID:2368
-
\??\c:\rxffrrx.exec:\rxffrrx.exe102⤵PID:4880
-
\??\c:\btnnnn.exec:\btnnnn.exe103⤵PID:1344
-
\??\c:\vjppp.exec:\vjppp.exe104⤵PID:4640
-
\??\c:\jvdpp.exec:\jvdpp.exe105⤵PID:4828
-
\??\c:\lrxrllf.exec:\lrxrllf.exe106⤵PID:1460
-
\??\c:\tnhbtt.exec:\tnhbtt.exe107⤵PID:4448
-
\??\c:\nbhnhn.exec:\nbhnhn.exe108⤵PID:2828
-
\??\c:\vjjjd.exec:\vjjjd.exe109⤵PID:1316
-
\??\c:\ddppp.exec:\ddppp.exe110⤵PID:3656
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe111⤵PID:1628
-
\??\c:\thnnnh.exec:\thnnnh.exe112⤵PID:4440
-
\??\c:\7hbbtt.exec:\7hbbtt.exe113⤵PID:3388
-
\??\c:\jdvvv.exec:\jdvvv.exe114⤵PID:4048
-
\??\c:\llrlllx.exec:\llrlllx.exe115⤵PID:2452
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe116⤵PID:3556
-
\??\c:\tthhtb.exec:\tthhtb.exe117⤵PID:4620
-
\??\c:\btnbbb.exec:\btnbbb.exe118⤵PID:4024
-
\??\c:\1jpdv.exec:\1jpdv.exe119⤵PID:2740
-
\??\c:\pjppv.exec:\pjppv.exe120⤵PID:2560
-
\??\c:\tbnhnn.exec:\tbnhnn.exe121⤵PID:4484
-
\??\c:\hnbhbh.exec:\hnbhbh.exe122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-