Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
General
-
Target
eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30.exe
-
Size
83KB
-
MD5
28bf184021871f69603c2203842cb27f
-
SHA1
74952714a78d9dedcf5038f9e6f6def10fb41d26
-
SHA256
eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30
-
SHA512
a4324340e349aea6a0c6764824b2de0d9691436cc1f483fbb93d44b0a31cb5534a16e1a1edcb7201070b295dad8f49367d320948e47ac95d9c4cb1c25d7c2fff
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjvHo+WdNc:ymb3NkkiQ3mdBjFo73yX+vI+qW
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2900-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/2900-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5008-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1488-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1796-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1508-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4516-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/392-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1988-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2372-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2372-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2372-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/316-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4296-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2172-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4232-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2848-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1372-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3912-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4752-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3088-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3644-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1700-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3316-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1688-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 5008 jvvpj.exe 2456 fffxrff.exe 1488 bhhtnn.exe 1796 7ppdv.exe 1508 jvpjd.exe 4516 rffrrll.exe 392 xxfxlxr.exe 1988 5nnbtn.exe 2372 tnhbtn.exe 4288 ddvpj.exe 316 ttbtbn.exe 3300 dppjd.exe 4296 5lrlxxr.exe 2172 llrllff.exe 4232 ddjjv.exe 2848 rxfrxxr.exe 1372 xrrxrlf.exe 4348 rxxrlfr.exe 3912 bthbtt.exe 4644 9pjdv.exe 4752 9rrfrlf.exe 1608 7ffxllx.exe 3088 hhnbtn.exe 1852 ppvpj.exe 3644 1fxrrxx.exe 4384 lrrlfff.exe 1700 7lrlffx.exe 3316 httnnh.exe 3980 dvvvv.exe 1688 djjdv.exe 2256 lxfrrrx.exe 4572 1htntt.exe 4996 3nbttt.exe 2836 9jjpj.exe 4680 1xffrll.exe 4588 frxrlll.exe 1332 1nntnn.exe 3792 tnnhbh.exe 4460 pjvdd.exe 2688 djjdv.exe 2656 3fxrffr.exe 648 rrrlllf.exe 2272 7nnnhn.exe 960 nbhbbb.exe 1660 vvjjd.exe 636 xllfxrl.exe 4684 rffxrrr.exe 4604 btbbtb.exe 2900 tbhbtt.exe 4216 jddvp.exe 2816 jpddv.exe 456 xlrlfxr.exe 4024 nhnhbb.exe 1796 jdjjj.exe 4616 9vvdj.exe 1064 frlllrl.exe 1664 lxfxllf.exe 4640 3bbbbb.exe 920 jddvj.exe 1440 ppdvp.exe 3216 frxrfff.exe 4324 7rffxff.exe 1652 nbthhh.exe 4132 vvdjd.exe -
resource yara_rule behavioral2/memory/2900-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 5008 2900 eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30.exe 81 PID 2900 wrote to memory of 5008 2900 eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30.exe 81 PID 2900 wrote to memory of 5008 2900 eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30.exe 81 PID 5008 wrote to memory of 2456 5008 jvvpj.exe 82 PID 5008 wrote to memory of 2456 5008 jvvpj.exe 82 PID 5008 wrote to memory of 2456 5008 jvvpj.exe 82 PID 2456 wrote to memory of 1488 2456 fffxrff.exe 83 PID 2456 wrote to memory of 1488 2456 fffxrff.exe 83 PID 2456 wrote to memory of 1488 2456 fffxrff.exe 83 PID 1488 wrote to memory of 1796 1488 bhhtnn.exe 84 PID 1488 wrote to memory of 1796 1488 bhhtnn.exe 84 PID 1488 wrote to memory of 1796 1488 bhhtnn.exe 84 PID 1796 wrote to memory of 1508 1796 7ppdv.exe 85 PID 1796 wrote to memory of 1508 1796 7ppdv.exe 85 PID 1796 wrote to memory of 1508 1796 7ppdv.exe 85 PID 1508 wrote to memory of 4516 1508 jvpjd.exe 86 PID 1508 wrote to memory of 4516 1508 jvpjd.exe 86 PID 1508 wrote to memory of 4516 1508 jvpjd.exe 86 PID 4516 wrote to memory of 392 4516 rffrrll.exe 87 PID 4516 wrote to memory of 392 4516 rffrrll.exe 87 PID 4516 wrote to memory of 392 4516 rffrrll.exe 87 PID 392 wrote to memory of 1988 392 xxfxlxr.exe 88 PID 392 wrote to memory of 1988 392 xxfxlxr.exe 88 PID 392 wrote to memory of 1988 392 xxfxlxr.exe 88 PID 1988 wrote to memory of 2372 1988 5nnbtn.exe 89 PID 1988 wrote to memory of 2372 1988 5nnbtn.exe 89 PID 1988 wrote to memory of 2372 1988 5nnbtn.exe 89 PID 2372 wrote to memory of 4288 2372 tnhbtn.exe 90 PID 2372 wrote to memory of 4288 2372 tnhbtn.exe 90 PID 2372 wrote to memory of 4288 2372 tnhbtn.exe 90 PID 4288 wrote to memory of 316 4288 ddvpj.exe 91 PID 4288 wrote to memory of 316 4288 ddvpj.exe 91 PID 4288 wrote to memory of 316 4288 ddvpj.exe 91 PID 316 wrote to memory of 3300 316 ttbtbn.exe 92 PID 316 wrote to memory of 3300 316 ttbtbn.exe 92 PID 316 wrote to memory of 3300 316 ttbtbn.exe 92 PID 3300 wrote to memory of 4296 3300 dppjd.exe 93 PID 3300 wrote to memory of 4296 3300 dppjd.exe 93 PID 3300 wrote to memory of 4296 3300 dppjd.exe 93 PID 4296 wrote to memory of 2172 4296 5lrlxxr.exe 94 PID 4296 wrote to memory of 2172 4296 5lrlxxr.exe 94 PID 4296 wrote to memory of 2172 4296 5lrlxxr.exe 94 PID 2172 wrote to memory of 4232 2172 llrllff.exe 95 PID 2172 wrote to memory of 4232 2172 llrllff.exe 95 PID 2172 wrote to memory of 4232 2172 llrllff.exe 95 PID 4232 wrote to memory of 2848 4232 ddjjv.exe 96 PID 4232 wrote to memory of 2848 4232 ddjjv.exe 96 PID 4232 wrote to memory of 2848 4232 ddjjv.exe 96 PID 2848 wrote to memory of 1372 2848 rxfrxxr.exe 97 PID 2848 wrote to memory of 1372 2848 rxfrxxr.exe 97 PID 2848 wrote to memory of 1372 2848 rxfrxxr.exe 97 PID 1372 wrote to memory of 4348 1372 xrrxrlf.exe 98 PID 1372 wrote to memory of 4348 1372 xrrxrlf.exe 98 PID 1372 wrote to memory of 4348 1372 xrrxrlf.exe 98 PID 4348 wrote to memory of 3912 4348 rxxrlfr.exe 99 PID 4348 wrote to memory of 3912 4348 rxxrlfr.exe 99 PID 4348 wrote to memory of 3912 4348 rxxrlfr.exe 99 PID 3912 wrote to memory of 4644 3912 bthbtt.exe 100 PID 3912 wrote to memory of 4644 3912 bthbtt.exe 100 PID 3912 wrote to memory of 4644 3912 bthbtt.exe 100 PID 4644 wrote to memory of 4752 4644 9pjdv.exe 101 PID 4644 wrote to memory of 4752 4644 9pjdv.exe 101 PID 4644 wrote to memory of 4752 4644 9pjdv.exe 101 PID 4752 wrote to memory of 1608 4752 9rrfrlf.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30.exe"C:\Users\Admin\AppData\Local\Temp\eafd5d60ee3814d89231114c995ff23a6fbf254e9646dba612bd556842158f30.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jvvpj.exec:\jvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\fffxrff.exec:\fffxrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bhhtnn.exec:\bhhtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\7ppdv.exec:\7ppdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\jvpjd.exec:\jvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\rffrrll.exec:\rffrrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\xxfxlxr.exec:\xxfxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\5nnbtn.exec:\5nnbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\tnhbtn.exec:\tnhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\ddvpj.exec:\ddvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\ttbtbn.exec:\ttbtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\dppjd.exec:\dppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\5lrlxxr.exec:\5lrlxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\llrllff.exec:\llrllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\ddjjv.exec:\ddjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rxfrxxr.exec:\rxfrxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xrrxrlf.exec:\xrrxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\rxxrlfr.exec:\rxxrlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\bthbtt.exec:\bthbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\9pjdv.exec:\9pjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\9rrfrlf.exec:\9rrfrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\7ffxllx.exec:\7ffxllx.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hhnbtn.exec:\hhnbtn.exe24⤵
- Executes dropped EXE
PID:3088 -
\??\c:\ppvpj.exec:\ppvpj.exe25⤵
- Executes dropped EXE
PID:1852 -
\??\c:\1fxrrxx.exec:\1fxrrxx.exe26⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lrrlfff.exec:\lrrlfff.exe27⤵
- Executes dropped EXE
PID:4384 -
\??\c:\7lrlffx.exec:\7lrlffx.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\httnnh.exec:\httnnh.exe29⤵
- Executes dropped EXE
PID:3316 -
\??\c:\dvvvv.exec:\dvvvv.exe30⤵
- Executes dropped EXE
PID:3980 -
\??\c:\djjdv.exec:\djjdv.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lxfrrrx.exec:\lxfrrrx.exe32⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1htntt.exec:\1htntt.exe33⤵
- Executes dropped EXE
PID:4572 -
\??\c:\3nbttt.exec:\3nbttt.exe34⤵
- Executes dropped EXE
PID:4996 -
\??\c:\9jjpj.exec:\9jjpj.exe35⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1xffrll.exec:\1xffrll.exe36⤵
- Executes dropped EXE
PID:4680 -
\??\c:\frxrlll.exec:\frxrlll.exe37⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1nntnn.exec:\1nntnn.exe38⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tnnhbh.exec:\tnnhbh.exe39⤵
- Executes dropped EXE
PID:3792 -
\??\c:\pjvdd.exec:\pjvdd.exe40⤵
- Executes dropped EXE
PID:4460 -
\??\c:\djjdv.exec:\djjdv.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3fxrffr.exec:\3fxrffr.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rrrlllf.exec:\rrrlllf.exe43⤵
- Executes dropped EXE
PID:648 -
\??\c:\7nnnhn.exec:\7nnnhn.exe44⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nbhbbb.exec:\nbhbbb.exe45⤵
- Executes dropped EXE
PID:960 -
\??\c:\vvjjd.exec:\vvjjd.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xllfxrl.exec:\xllfxrl.exe47⤵
- Executes dropped EXE
PID:636 -
\??\c:\rffxrrr.exec:\rffxrrr.exe48⤵
- Executes dropped EXE
PID:4684 -
\??\c:\btbbtb.exec:\btbbtb.exe49⤵
- Executes dropped EXE
PID:4604 -
\??\c:\tbhbtt.exec:\tbhbtt.exe50⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jddvp.exec:\jddvp.exe51⤵
- Executes dropped EXE
PID:4216 -
\??\c:\jpddv.exec:\jpddv.exe52⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe53⤵
- Executes dropped EXE
PID:456 -
\??\c:\nhnhbb.exec:\nhnhbb.exe54⤵
- Executes dropped EXE
PID:4024 -
\??\c:\jdjjj.exec:\jdjjj.exe55⤵
- Executes dropped EXE
PID:1796 -
\??\c:\9vvdj.exec:\9vvdj.exe56⤵
- Executes dropped EXE
PID:4616 -
\??\c:\frlllrl.exec:\frlllrl.exe57⤵
- Executes dropped EXE
PID:1064 -
\??\c:\lxfxllf.exec:\lxfxllf.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3bbbbb.exec:\3bbbbb.exe59⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jddvj.exec:\jddvj.exe60⤵
- Executes dropped EXE
PID:920 -
\??\c:\ppdvp.exec:\ppdvp.exe61⤵
- Executes dropped EXE
PID:1440 -
\??\c:\frxrfff.exec:\frxrfff.exe62⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7rffxff.exec:\7rffxff.exe63⤵
- Executes dropped EXE
PID:4324 -
\??\c:\nbthhh.exec:\nbthhh.exe64⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vvdjd.exec:\vvdjd.exe65⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vdjdp.exec:\vdjdp.exe66⤵PID:2472
-
\??\c:\lrlflfx.exec:\lrlflfx.exe67⤵PID:3476
-
\??\c:\thbthb.exec:\thbthb.exe68⤵PID:1524
-
\??\c:\tnnbtt.exec:\tnnbtt.exe69⤵PID:4296
-
\??\c:\dpdpp.exec:\dpdpp.exe70⤵PID:1328
-
\??\c:\frlxrlx.exec:\frlxrlx.exe71⤵PID:1632
-
\??\c:\5rrxllr.exec:\5rrxllr.exe72⤵PID:4932
-
\??\c:\1nnttt.exec:\1nnttt.exe73⤵PID:3624
-
\??\c:\vppjv.exec:\vppjv.exe74⤵PID:4236
-
\??\c:\vjjdp.exec:\vjjdp.exe75⤵PID:4568
-
\??\c:\xllfrrl.exec:\xllfrrl.exe76⤵PID:4688
-
\??\c:\hbhbnn.exec:\hbhbnn.exe77⤵PID:2296
-
\??\c:\hbhtnn.exec:\hbhtnn.exe78⤵PID:3872
-
\??\c:\pdpdv.exec:\pdpdv.exe79⤵PID:4592
-
\??\c:\xllfrrl.exec:\xllfrrl.exe80⤵PID:4752
-
\??\c:\xxllllf.exec:\xxllllf.exe81⤵PID:2380
-
\??\c:\3dppv.exec:\3dppv.exe82⤵PID:4408
-
\??\c:\1jpjv.exec:\1jpjv.exe83⤵PID:1192
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe84⤵PID:1464
-
\??\c:\1tnnhb.exec:\1tnnhb.exe85⤵PID:1244
-
\??\c:\htbtnn.exec:\htbtnn.exe86⤵PID:4872
-
\??\c:\jvdvv.exec:\jvdvv.exe87⤵PID:2396
-
\??\c:\vpjjv.exec:\vpjjv.exe88⤵PID:4844
-
\??\c:\fxrlxfx.exec:\fxrlxfx.exe89⤵PID:3144
-
\??\c:\bhbtnn.exec:\bhbtnn.exe90⤵PID:4008
-
\??\c:\thhbnn.exec:\thhbnn.exe91⤵PID:4328
-
\??\c:\vvvvv.exec:\vvvvv.exe92⤵PID:384
-
\??\c:\fxffflf.exec:\fxffflf.exe93⤵PID:3860
-
\??\c:\fflfllr.exec:\fflfllr.exe94⤵PID:4572
-
\??\c:\hbbbbb.exec:\hbbbbb.exe95⤵PID:2032
-
\??\c:\dppjd.exec:\dppjd.exe96⤵PID:2376
-
\??\c:\pjppd.exec:\pjppd.exe97⤵PID:4652
-
\??\c:\rlxlrrr.exec:\rlxlrrr.exe98⤵PID:2468
-
\??\c:\fflllll.exec:\fflllll.exe99⤵PID:4020
-
\??\c:\bhhnnh.exec:\bhhnnh.exe100⤵PID:1948
-
\??\c:\jjdpp.exec:\jjdpp.exe101⤵PID:4856
-
\??\c:\jppjv.exec:\jppjv.exe102⤵PID:3652
-
\??\c:\3ffxrlf.exec:\3ffxrlf.exe103⤵PID:2952
-
\??\c:\hbhhtt.exec:\hbhhtt.exe104⤵PID:648
-
\??\c:\bttnnn.exec:\bttnnn.exe105⤵PID:3496
-
\??\c:\jdjdd.exec:\jdjdd.exe106⤵PID:3408
-
\??\c:\jjvpd.exec:\jjvpd.exe107⤵PID:1660
-
\??\c:\9frlffx.exec:\9frlffx.exe108⤵PID:636
-
\??\c:\rxffxrl.exec:\rxffxrl.exe109⤵PID:1836
-
\??\c:\tntbtt.exec:\tntbtt.exe110⤵PID:816
-
\??\c:\9vvvp.exec:\9vvvp.exe111⤵PID:2412
-
\??\c:\7ddvj.exec:\7ddvj.exe112⤵PID:3432
-
\??\c:\5lrfxrr.exec:\5lrfxrr.exe113⤵PID:3848
-
\??\c:\lffxxrr.exec:\lffxxrr.exe114⤵PID:4704
-
\??\c:\7hbbtn.exec:\7hbbtn.exe115⤵PID:400
-
\??\c:\1ntnbb.exec:\1ntnbb.exe116⤵PID:3036
-
\??\c:\vppjv.exec:\vppjv.exe117⤵PID:4616
-
\??\c:\frfxrlf.exec:\frfxrlf.exe118⤵PID:2876
-
\??\c:\fxrxxxr.exec:\fxrxxxr.exe119⤵PID:392
-
\??\c:\bttnnh.exec:\bttnnh.exe120⤵PID:2080
-
\??\c:\dvpjd.exec:\dvpjd.exe121⤵PID:920
-
\??\c:\7dvpd.exec:\7dvpd.exe122⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-