Analysis
-
max time kernel
70s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 22:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe
-
Size
88KB
-
MD5
cc9941d010fe2642e7168bd2eed14266
-
SHA1
dded130601d6a64b3d798a1c2cb760866132b8f7
-
SHA256
47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711
-
SHA512
3d194cbc5319b52d5f4118f079b624a07397f28e538735eb21a8e5cb475b227ceef098ca33e1ca7c6f7de7bda0c54e417099511fd647600621bc29fdf7c321d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkgo:ymb3NkkiQ3mdBjF+3TU2iBRioSumWuF
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3984-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/588-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/3984-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4948-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/728-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2932-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4948-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2248-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3252-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3252-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1456-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/632-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3904-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2580-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/588-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4212-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1360-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4920-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2520-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4948-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4948 ddjjp.exe 2932 jddpv.exe 4608 rrfrffx.exe 1708 hthtth.exe 5064 7djpd.exe 728 vjpvp.exe 3272 lrxlxxx.exe 2248 xlrxrlx.exe 1608 5bbtbb.exe 3252 bttnhb.exe 1952 pvvvp.exe 3688 rlrrrrx.exe 1456 tbhbtt.exe 632 djpjj.exe 3904 lffrlfx.exe 4228 btthbn.exe 1820 jpvvv.exe 2580 xrxxrxx.exe 3224 hbtbbb.exe 2640 vppvj.exe 588 1xxfrxf.exe 2524 bbhhtt.exe 4212 dvpdj.exe 3540 5fffxrr.exe 4876 vjvpp.exe 3288 jddvv.exe 1360 htnnht.exe 4528 xlrxxrf.exe 4920 bhnnht.exe 2520 nhnhbb.exe 4948 5xlffxx.exe 1764 hbnnbt.exe 4564 hnbbnn.exe 4960 jdddp.exe 1780 xlrxxxf.exe 2528 ntbbbh.exe 3680 bntthh.exe 2168 pjpjd.exe 2276 fxfxfxx.exe 744 bbbbth.exe 1272 tnnnbh.exe 1248 5dvpd.exe 3684 3dddv.exe 1456 3rflfll.exe 1588 bhhbhh.exe 2000 tnhhbh.exe 5060 ppdpp.exe 1140 jjpjv.exe 4028 5llllll.exe 4928 nttbhh.exe 624 7httnt.exe 3224 pvjvd.exe 2796 pdjpv.exe 4696 lrxfflr.exe 4992 5lxllfr.exe 1240 ntbbtb.exe 752 3bbhhh.exe 4348 vjpjd.exe 2340 xfffflx.exe 224 flrxfrx.exe 3936 nhnhbb.exe 1264 pjvvv.exe 4336 djppp.exe 4920 xffflrr.exe -
resource yara_rule behavioral2/memory/3984-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/588-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 4948 3984 47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe 89 PID 3984 wrote to memory of 4948 3984 47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe 89 PID 3984 wrote to memory of 4948 3984 47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe 89 PID 4948 wrote to memory of 2932 4948 ddjjp.exe 90 PID 4948 wrote to memory of 2932 4948 ddjjp.exe 90 PID 4948 wrote to memory of 2932 4948 ddjjp.exe 90 PID 2932 wrote to memory of 4608 2932 jddpv.exe 91 PID 2932 wrote to memory of 4608 2932 jddpv.exe 91 PID 2932 wrote to memory of 4608 2932 jddpv.exe 91 PID 4608 wrote to memory of 1708 4608 rrfrffx.exe 92 PID 4608 wrote to memory of 1708 4608 rrfrffx.exe 92 PID 4608 wrote to memory of 1708 4608 rrfrffx.exe 92 PID 1708 wrote to memory of 5064 1708 hthtth.exe 93 PID 1708 wrote to memory of 5064 1708 hthtth.exe 93 PID 1708 wrote to memory of 5064 1708 hthtth.exe 93 PID 5064 wrote to memory of 728 5064 7djpd.exe 94 PID 5064 wrote to memory of 728 5064 7djpd.exe 94 PID 5064 wrote to memory of 728 5064 7djpd.exe 94 PID 728 wrote to memory of 3272 728 vjpvp.exe 95 PID 728 wrote to memory of 3272 728 vjpvp.exe 95 PID 728 wrote to memory of 3272 728 vjpvp.exe 95 PID 3272 wrote to memory of 2248 3272 lrxlxxx.exe 96 PID 3272 wrote to memory of 2248 3272 lrxlxxx.exe 96 PID 3272 wrote to memory of 2248 3272 lrxlxxx.exe 96 PID 2248 wrote to memory of 1608 2248 xlrxrlx.exe 97 PID 2248 wrote to memory of 1608 2248 xlrxrlx.exe 97 PID 2248 wrote to memory of 1608 2248 xlrxrlx.exe 97 PID 1608 wrote to memory of 3252 1608 5bbtbb.exe 98 PID 1608 wrote to memory of 3252 1608 5bbtbb.exe 98 PID 1608 wrote to memory of 3252 1608 5bbtbb.exe 98 PID 3252 wrote to memory of 1952 3252 bttnhb.exe 99 PID 3252 wrote to memory of 1952 3252 bttnhb.exe 99 PID 3252 wrote to memory of 1952 3252 bttnhb.exe 99 PID 1952 wrote to memory of 3688 1952 pvvvp.exe 101 PID 1952 wrote to memory of 3688 1952 pvvvp.exe 101 PID 1952 wrote to memory of 3688 1952 pvvvp.exe 101 PID 3688 wrote to memory of 1456 3688 rlrrrrx.exe 102 PID 3688 wrote to memory of 1456 3688 rlrrrrx.exe 102 PID 3688 wrote to memory of 1456 3688 rlrrrrx.exe 102 PID 1456 wrote to memory of 632 1456 tbhbtt.exe 103 PID 1456 wrote to memory of 632 1456 tbhbtt.exe 103 PID 1456 wrote to memory of 632 1456 tbhbtt.exe 103 PID 632 wrote to memory of 3904 632 djpjj.exe 104 PID 632 wrote to memory of 3904 632 djpjj.exe 104 PID 632 wrote to memory of 3904 632 djpjj.exe 104 PID 3904 wrote to memory of 4228 3904 lffrlfx.exe 105 PID 3904 wrote to memory of 4228 3904 lffrlfx.exe 105 PID 3904 wrote to memory of 4228 3904 lffrlfx.exe 105 PID 4228 wrote to memory of 1820 4228 btthbn.exe 106 PID 4228 wrote to memory of 1820 4228 btthbn.exe 106 PID 4228 wrote to memory of 1820 4228 btthbn.exe 106 PID 1820 wrote to memory of 2580 1820 jpvvv.exe 107 PID 1820 wrote to memory of 2580 1820 jpvvv.exe 107 PID 1820 wrote to memory of 2580 1820 jpvvv.exe 107 PID 2580 wrote to memory of 3224 2580 xrxxrxx.exe 108 PID 2580 wrote to memory of 3224 2580 xrxxrxx.exe 108 PID 2580 wrote to memory of 3224 2580 xrxxrxx.exe 108 PID 3224 wrote to memory of 2640 3224 hbtbbb.exe 109 PID 3224 wrote to memory of 2640 3224 hbtbbb.exe 109 PID 3224 wrote to memory of 2640 3224 hbtbbb.exe 109 PID 2640 wrote to memory of 588 2640 vppvj.exe 110 PID 2640 wrote to memory of 588 2640 vppvj.exe 110 PID 2640 wrote to memory of 588 2640 vppvj.exe 110 PID 588 wrote to memory of 2524 588 1xxfrxf.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe"C:\Users\Admin\AppData\Local\Temp\47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\ddjjp.exec:\ddjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\jddpv.exec:\jddpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rrfrffx.exec:\rrfrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\hthtth.exec:\hthtth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\7djpd.exec:\7djpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vjpvp.exec:\vjpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\lrxlxxx.exec:\lrxlxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\xlrxrlx.exec:\xlrxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\5bbtbb.exec:\5bbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\bttnhb.exec:\bttnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\pvvvp.exec:\pvvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\tbhbtt.exec:\tbhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\djpjj.exec:\djpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\lffrlfx.exec:\lffrlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\btthbn.exec:\btthbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\jpvvv.exec:\jpvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\hbtbbb.exec:\hbtbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vppvj.exec:\vppvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1xxfrxf.exec:\1xxfrxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\bbhhtt.exec:\bbhhtt.exe23⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dvpdj.exec:\dvpdj.exe24⤵
- Executes dropped EXE
PID:4212 -
\??\c:\5fffxrr.exec:\5fffxrr.exe25⤵
- Executes dropped EXE
PID:3540 -
\??\c:\vjvpp.exec:\vjvpp.exe26⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jddvv.exec:\jddvv.exe27⤵
- Executes dropped EXE
PID:3288 -
\??\c:\htnnht.exec:\htnnht.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xlrxxrf.exec:\xlrxxrf.exe29⤵
- Executes dropped EXE
PID:4528 -
\??\c:\bhnnht.exec:\bhnnht.exe30⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nhnhbb.exec:\nhnhbb.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5xlffxx.exec:\5xlffxx.exe32⤵
- Executes dropped EXE
PID:4948 -
\??\c:\hbnnbt.exec:\hbnnbt.exe33⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hnbbnn.exec:\hnbbnn.exe34⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jdddp.exec:\jdddp.exe35⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xlrxxxf.exec:\xlrxxxf.exe36⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ntbbbh.exec:\ntbbbh.exe37⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bntthh.exec:\bntthh.exe38⤵
- Executes dropped EXE
PID:3680 -
\??\c:\pjpjd.exec:\pjpjd.exe39⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe40⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bbbbth.exec:\bbbbth.exe41⤵
- Executes dropped EXE
PID:744 -
\??\c:\tnnnbh.exec:\tnnnbh.exe42⤵
- Executes dropped EXE
PID:1272 -
\??\c:\5dvpd.exec:\5dvpd.exe43⤵
- Executes dropped EXE
PID:1248 -
\??\c:\3dddv.exec:\3dddv.exe44⤵
- Executes dropped EXE
PID:3684 -
\??\c:\3rflfll.exec:\3rflfll.exe45⤵
- Executes dropped EXE
PID:1456 -
\??\c:\bhhbhh.exec:\bhhbhh.exe46⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnhhbh.exec:\tnhhbh.exe47⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ppdpp.exec:\ppdpp.exe48⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jjpjv.exec:\jjpjv.exe49⤵
- Executes dropped EXE
PID:1140 -
\??\c:\5llllll.exec:\5llllll.exe50⤵
- Executes dropped EXE
PID:4028 -
\??\c:\nttbhh.exec:\nttbhh.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\7httnt.exec:\7httnt.exe52⤵
- Executes dropped EXE
PID:624 -
\??\c:\pvjvd.exec:\pvjvd.exe53⤵
- Executes dropped EXE
PID:3224 -
\??\c:\pdjpv.exec:\pdjpv.exe54⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lrxfflr.exec:\lrxfflr.exe55⤵
- Executes dropped EXE
PID:4696 -
\??\c:\5lxllfr.exec:\5lxllfr.exe56⤵
- Executes dropped EXE
PID:4992 -
\??\c:\ntbbtb.exec:\ntbbtb.exe57⤵
- Executes dropped EXE
PID:1240 -
\??\c:\3bbhhh.exec:\3bbhhh.exe58⤵
- Executes dropped EXE
PID:752 -
\??\c:\vjpjd.exec:\vjpjd.exe59⤵
- Executes dropped EXE
PID:4348 -
\??\c:\xfffflx.exec:\xfffflx.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\flrxfrx.exec:\flrxfrx.exe61⤵
- Executes dropped EXE
PID:224 -
\??\c:\nhnhbb.exec:\nhnhbb.exe62⤵
- Executes dropped EXE
PID:3936 -
\??\c:\pjvvv.exec:\pjvvv.exe63⤵
- Executes dropped EXE
PID:1264 -
\??\c:\djppp.exec:\djppp.exe64⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xffflrr.exec:\xffflrr.exe65⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bhhnhh.exec:\bhhnhh.exe66⤵PID:2596
-
\??\c:\vpjdd.exec:\vpjdd.exe67⤵PID:1648
-
\??\c:\vppvp.exec:\vppvp.exe68⤵PID:4948
-
\??\c:\rxfrxrr.exec:\rxfrxrr.exe69⤵PID:3124
-
\??\c:\3flxrll.exec:\3flxrll.exe70⤵PID:116
-
\??\c:\hbtbbn.exec:\hbtbbn.exe71⤵PID:3632
-
\??\c:\pppjd.exec:\pppjd.exe72⤵PID:1568
-
\??\c:\pvjvd.exec:\pvjvd.exe73⤵PID:1756
-
\??\c:\rflrrlf.exec:\rflrrlf.exe74⤵PID:4400
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe75⤵PID:2248
-
\??\c:\nbbhbh.exec:\nbbhbh.exe76⤵PID:3360
-
\??\c:\dvddd.exec:\dvddd.exe77⤵PID:804
-
\??\c:\9dvjv.exec:\9dvjv.exe78⤵PID:4048
-
\??\c:\lfrlfff.exec:\lfrlfff.exe79⤵PID:1272
-
\??\c:\rlxflfr.exec:\rlxflfr.exe80⤵PID:528
-
\??\c:\btbnht.exec:\btbnht.exe81⤵PID:1456
-
\??\c:\vjvvp.exec:\vjvvp.exe82⤵PID:4536
-
\??\c:\9jjvp.exec:\9jjvp.exe83⤵PID:3904
-
\??\c:\xfrlxxf.exec:\xfrlxxf.exe84⤵PID:3236
-
\??\c:\flrrlfr.exec:\flrrlfr.exe85⤵PID:2540
-
\??\c:\nbnnhn.exec:\nbnnhn.exe86⤵PID:1632
-
\??\c:\hhhhnt.exec:\hhhhnt.exe87⤵PID:1420
-
\??\c:\djpjd.exec:\djpjd.exe88⤵PID:1692
-
\??\c:\vdddv.exec:\vdddv.exe89⤵PID:2640
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe90⤵PID:3692
-
\??\c:\rrxrfxf.exec:\rrxrfxf.exe91⤵PID:3096
-
\??\c:\nnhhhh.exec:\nnhhhh.exe92⤵PID:2324
-
\??\c:\7dvpv.exec:\7dvpv.exe93⤵PID:4908
-
\??\c:\pdvpp.exec:\pdvpp.exe94⤵PID:3540
-
\??\c:\lffrrll.exec:\lffrrll.exe95⤵PID:540
-
\??\c:\5rlxxll.exec:\5rlxxll.exe96⤵PID:3288
-
\??\c:\hbtttt.exec:\hbtttt.exe97⤵PID:224
-
\??\c:\btbthh.exec:\btbthh.exe98⤵PID:2608
-
\??\c:\pdjdv.exec:\pdjdv.exe99⤵PID:4968
-
\??\c:\fxrxfxf.exec:\fxrxfxf.exe100⤵PID:2460
-
\??\c:\ttnbht.exec:\ttnbht.exe101⤵PID:228
-
\??\c:\ttbntb.exec:\ttbntb.exe102⤵PID:2596
-
\??\c:\dpjjj.exec:\dpjjj.exe103⤵PID:5048
-
\??\c:\llrlxxf.exec:\llrlxxf.exe104⤵PID:3340
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe105⤵PID:1188
-
\??\c:\btnhbh.exec:\btnhbh.exe106⤵PID:1676
-
\??\c:\tbbtnh.exec:\tbbtnh.exe107⤵PID:636
-
\??\c:\jpdvv.exec:\jpdvv.exe108⤵PID:3276
-
\??\c:\llxrllr.exec:\llxrllr.exe109⤵PID:1780
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe110⤵PID:3856
-
\??\c:\tnnbbt.exec:\tnnbbt.exe111⤵PID:2680
-
\??\c:\hnhhnb.exec:\hnhhnb.exe112⤵PID:2304
-
\??\c:\9jjjj.exec:\9jjjj.exe113⤵PID:3940
-
\??\c:\pjpjp.exec:\pjpjp.exe114⤵PID:4940
-
\??\c:\frxxflf.exec:\frxxflf.exe115⤵PID:4428
-
\??\c:\rfxrlll.exec:\rfxrlll.exe116⤵PID:3244
-
\??\c:\jdjdd.exec:\jdjdd.exe117⤵PID:3144
-
\??\c:\lfllllr.exec:\lfllllr.exe118⤵PID:2804
-
\??\c:\lrlffrl.exec:\lrlffrl.exe119⤵PID:3900
-
\??\c:\nhhbtt.exec:\nhhbtt.exe120⤵PID:1632
-
\??\c:\1nbtbb.exec:\1nbtbb.exe121⤵PID:3492
-
\??\c:\3pdjv.exec:\3pdjv.exe122⤵PID:588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-