Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe
-
Size
87KB
-
MD5
f8bbd7b634a2ae5149184cd972f2ee97
-
SHA1
553890ea5944beb6a270d185d3747acc2b4a7742
-
SHA256
af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9
-
SHA512
e0118a67ae84a099649997f967fff17e146a0b0102d123d9362007660d539f91033887a2cf04e81a603410932efc763745a4a924a7d94c794c2647cfa2908326
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1grORPfr0k890C0:ymb3NkkiQ3mdBjFoLk8Pk890C0
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/216-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/216-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2376-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2084-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1656-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1164-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4112-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2224-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2224-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2276-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1068-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2952-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2040-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1244-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1500-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1108-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2732-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2792-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2976-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1392-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4124-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1480-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2228-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2988-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4056-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2376 1bbtnn.exe 2084 3jpvp.exe 1656 rxlxfrr.exe 1164 nhtttn.exe 1452 dvjdp.exe 4112 xflflfx.exe 2224 7jjjd.exe 2276 xlfxxxr.exe 1068 bnhbtt.exe 2952 ppjjd.exe 1348 ddjdd.exe 2040 xxlfllx.exe 1244 nbhbtn.exe 1500 bnnbth.exe 1108 lfllflf.exe 4728 7bbnht.exe 2732 hbttnb.exe 3124 jvdvj.exe 2792 jjddp.exe 2976 1bhhnh.exe 4144 ttnhbb.exe 740 djpjj.exe 1392 pdvjd.exe 4124 ffrlxfx.exe 224 tnhhbb.exe 1480 jpdvj.exe 1228 9jpdp.exe 2228 rfxlffx.exe 1488 9ffxrlf.exe 2988 tnbttt.exe 4056 dppvj.exe 4640 rxfrfxf.exe 4912 ntbthh.exe 3608 vjjdv.exe 4732 xxrrrxf.exe 596 rfllflr.exe 5068 btbbbb.exe 1312 hnhbnb.exe 4380 dppjv.exe 1528 jvdvv.exe 3500 lxxrllf.exe 3568 fxrlflf.exe 520 htnhhb.exe 1656 3ttbtn.exe 1032 9ppjd.exe 2780 djppp.exe 640 lffxflr.exe 3152 frxrllx.exe 2752 7bttnn.exe 2080 hbthtn.exe 1360 jpdjj.exe 2276 pvdvj.exe 5000 9rrlffx.exe 1636 rxrfrfx.exe 3332 hbtttt.exe 1932 tntntn.exe 5032 dpdvp.exe 816 jjddv.exe 1244 xxxrxfx.exe 3176 bbhhtb.exe 2572 nhtnbb.exe 2100 vpppj.exe 3840 pjjjd.exe 2824 1fxrflf.exe -
resource yara_rule behavioral2/memory/216-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 2376 216 af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe 83 PID 216 wrote to memory of 2376 216 af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe 83 PID 216 wrote to memory of 2376 216 af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe 83 PID 2376 wrote to memory of 2084 2376 1bbtnn.exe 84 PID 2376 wrote to memory of 2084 2376 1bbtnn.exe 84 PID 2376 wrote to memory of 2084 2376 1bbtnn.exe 84 PID 2084 wrote to memory of 1656 2084 3jpvp.exe 85 PID 2084 wrote to memory of 1656 2084 3jpvp.exe 85 PID 2084 wrote to memory of 1656 2084 3jpvp.exe 85 PID 1656 wrote to memory of 1164 1656 rxlxfrr.exe 86 PID 1656 wrote to memory of 1164 1656 rxlxfrr.exe 86 PID 1656 wrote to memory of 1164 1656 rxlxfrr.exe 86 PID 1164 wrote to memory of 1452 1164 nhtttn.exe 87 PID 1164 wrote to memory of 1452 1164 nhtttn.exe 87 PID 1164 wrote to memory of 1452 1164 nhtttn.exe 87 PID 1452 wrote to memory of 4112 1452 dvjdp.exe 88 PID 1452 wrote to memory of 4112 1452 dvjdp.exe 88 PID 1452 wrote to memory of 4112 1452 dvjdp.exe 88 PID 4112 wrote to memory of 2224 4112 xflflfx.exe 89 PID 4112 wrote to memory of 2224 4112 xflflfx.exe 89 PID 4112 wrote to memory of 2224 4112 xflflfx.exe 89 PID 2224 wrote to memory of 2276 2224 7jjjd.exe 90 PID 2224 wrote to memory of 2276 2224 7jjjd.exe 90 PID 2224 wrote to memory of 2276 2224 7jjjd.exe 90 PID 2276 wrote to memory of 1068 2276 xlfxxxr.exe 91 PID 2276 wrote to memory of 1068 2276 xlfxxxr.exe 91 PID 2276 wrote to memory of 1068 2276 xlfxxxr.exe 91 PID 1068 wrote to memory of 2952 1068 bnhbtt.exe 92 PID 1068 wrote to memory of 2952 1068 bnhbtt.exe 92 PID 1068 wrote to memory of 2952 1068 bnhbtt.exe 92 PID 2952 wrote to memory of 1348 2952 ppjjd.exe 93 PID 2952 wrote to memory of 1348 2952 ppjjd.exe 93 PID 2952 wrote to memory of 1348 2952 ppjjd.exe 93 PID 1348 wrote to memory of 2040 1348 ddjdd.exe 94 PID 1348 wrote to memory of 2040 1348 ddjdd.exe 94 PID 1348 wrote to memory of 2040 1348 ddjdd.exe 94 PID 2040 wrote to memory of 1244 2040 xxlfllx.exe 95 PID 2040 wrote to memory of 1244 2040 xxlfllx.exe 95 PID 2040 wrote to memory of 1244 2040 xxlfllx.exe 95 PID 1244 wrote to memory of 1500 1244 nbhbtn.exe 96 PID 1244 wrote to memory of 1500 1244 nbhbtn.exe 96 PID 1244 wrote to memory of 1500 1244 nbhbtn.exe 96 PID 1500 wrote to memory of 1108 1500 bnnbth.exe 97 PID 1500 wrote to memory of 1108 1500 bnnbth.exe 97 PID 1500 wrote to memory of 1108 1500 bnnbth.exe 97 PID 1108 wrote to memory of 4728 1108 lfllflf.exe 98 PID 1108 wrote to memory of 4728 1108 lfllflf.exe 98 PID 1108 wrote to memory of 4728 1108 lfllflf.exe 98 PID 4728 wrote to memory of 2732 4728 7bbnht.exe 99 PID 4728 wrote to memory of 2732 4728 7bbnht.exe 99 PID 4728 wrote to memory of 2732 4728 7bbnht.exe 99 PID 2732 wrote to memory of 3124 2732 hbttnb.exe 100 PID 2732 wrote to memory of 3124 2732 hbttnb.exe 100 PID 2732 wrote to memory of 3124 2732 hbttnb.exe 100 PID 3124 wrote to memory of 2792 3124 jvdvj.exe 102 PID 3124 wrote to memory of 2792 3124 jvdvj.exe 102 PID 3124 wrote to memory of 2792 3124 jvdvj.exe 102 PID 2792 wrote to memory of 2976 2792 jjddp.exe 103 PID 2792 wrote to memory of 2976 2792 jjddp.exe 103 PID 2792 wrote to memory of 2976 2792 jjddp.exe 103 PID 2976 wrote to memory of 4144 2976 1bhhnh.exe 104 PID 2976 wrote to memory of 4144 2976 1bhhnh.exe 104 PID 2976 wrote to memory of 4144 2976 1bhhnh.exe 104 PID 4144 wrote to memory of 740 4144 ttnhbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe"C:\Users\Admin\AppData\Local\Temp\af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\1bbtnn.exec:\1bbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\3jpvp.exec:\3jpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\rxlxfrr.exec:\rxlxfrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\nhtttn.exec:\nhtttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\dvjdp.exec:\dvjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\xflflfx.exec:\xflflfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\7jjjd.exec:\7jjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\bnhbtt.exec:\bnhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\ppjjd.exec:\ppjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ddjdd.exec:\ddjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\xxlfllx.exec:\xxlfllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nbhbtn.exec:\nbhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\bnnbth.exec:\bnnbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\lfllflf.exec:\lfllflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\7bbnht.exec:\7bbnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\hbttnb.exec:\hbttnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jvdvj.exec:\jvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\jjddp.exec:\jjddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1bhhnh.exec:\1bhhnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\ttnhbb.exec:\ttnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\djpjj.exec:\djpjj.exe23⤵
- Executes dropped EXE
PID:740 -
\??\c:\pdvjd.exec:\pdvjd.exe24⤵
- Executes dropped EXE
PID:1392 -
\??\c:\ffrlxfx.exec:\ffrlxfx.exe25⤵
- Executes dropped EXE
PID:4124 -
\??\c:\tnhhbb.exec:\tnhhbb.exe26⤵
- Executes dropped EXE
PID:224 -
\??\c:\jpdvj.exec:\jpdvj.exe27⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9jpdp.exec:\9jpdp.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\rfxlffx.exec:\rfxlffx.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe30⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tnbttt.exec:\tnbttt.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dppvj.exec:\dppvj.exe32⤵
- Executes dropped EXE
PID:4056 -
\??\c:\rxfrfxf.exec:\rxfrfxf.exe33⤵
- Executes dropped EXE
PID:4640 -
\??\c:\ntbthh.exec:\ntbthh.exe34⤵
- Executes dropped EXE
PID:4912 -
\??\c:\vjjdv.exec:\vjjdv.exe35⤵
- Executes dropped EXE
PID:3608 -
\??\c:\xxrrrxf.exec:\xxrrrxf.exe36⤵
- Executes dropped EXE
PID:4732 -
\??\c:\rfllflr.exec:\rfllflr.exe37⤵
- Executes dropped EXE
PID:596 -
\??\c:\btbbbb.exec:\btbbbb.exe38⤵
- Executes dropped EXE
PID:5068 -
\??\c:\hnhbnb.exec:\hnhbnb.exe39⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dppjv.exec:\dppjv.exe40⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jvdvv.exec:\jvdvv.exe41⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lxxrllf.exec:\lxxrllf.exe42⤵
- Executes dropped EXE
PID:3500 -
\??\c:\fxrlflf.exec:\fxrlflf.exe43⤵
- Executes dropped EXE
PID:3568 -
\??\c:\htnhhb.exec:\htnhhb.exe44⤵
- Executes dropped EXE
PID:520 -
\??\c:\3ttbtn.exec:\3ttbtn.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9ppjd.exec:\9ppjd.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\djppp.exec:\djppp.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lffxflr.exec:\lffxflr.exe48⤵
- Executes dropped EXE
PID:640 -
\??\c:\frxrllx.exec:\frxrllx.exe49⤵
- Executes dropped EXE
PID:3152 -
\??\c:\7bttnn.exec:\7bttnn.exe50⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbthtn.exec:\hbthtn.exe51⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jpdjj.exec:\jpdjj.exe52⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pvdvj.exec:\pvdvj.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9rrlffx.exec:\9rrlffx.exe54⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rxrfrfx.exec:\rxrfrfx.exe55⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbtttt.exec:\hbtttt.exe56⤵
- Executes dropped EXE
PID:3332 -
\??\c:\tntntn.exec:\tntntn.exe57⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dpdvp.exec:\dpdvp.exe58⤵
- Executes dropped EXE
PID:5032 -
\??\c:\jjddv.exec:\jjddv.exe59⤵
- Executes dropped EXE
PID:816 -
\??\c:\xxxrxfx.exec:\xxxrxfx.exe60⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bbhhtb.exec:\bbhhtb.exe61⤵
- Executes dropped EXE
PID:3176 -
\??\c:\nhtnbb.exec:\nhtnbb.exe62⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vpppj.exec:\vpppj.exe63⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjjjd.exec:\pjjjd.exe64⤵
- Executes dropped EXE
PID:3840 -
\??\c:\1fxrflf.exec:\1fxrflf.exe65⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9ttnhh.exec:\9ttnhh.exe66⤵PID:1044
-
\??\c:\ntnhbt.exec:\ntnhbt.exe67⤵PID:1104
-
\??\c:\vvvvv.exec:\vvvvv.exe68⤵PID:4368
-
\??\c:\9rxlfxf.exec:\9rxlfxf.exe69⤵PID:3912
-
\??\c:\3nnhbh.exec:\3nnhbh.exe70⤵PID:560
-
\??\c:\nhbttn.exec:\nhbttn.exe71⤵PID:3296
-
\??\c:\jdddd.exec:\jdddd.exe72⤵PID:1392
-
\??\c:\jdpjd.exec:\jdpjd.exe73⤵PID:3288
-
\??\c:\xrrlllf.exec:\xrrlllf.exe74⤵PID:4768
-
\??\c:\bbttnb.exec:\bbttnb.exe75⤵PID:4712
-
\??\c:\bhthtt.exec:\bhthtt.exe76⤵PID:2348
-
\??\c:\pjjjj.exec:\pjjjj.exe77⤵PID:2520
-
\??\c:\pddvv.exec:\pddvv.exe78⤵PID:2484
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe79⤵PID:2720
-
\??\c:\rflfxff.exec:\rflfxff.exe80⤵PID:2208
-
\??\c:\nntnnt.exec:\nntnnt.exe81⤵PID:4436
-
\??\c:\pjdvj.exec:\pjdvj.exe82⤵PID:4284
-
\??\c:\7vdvj.exec:\7vdvj.exe83⤵PID:744
-
\??\c:\fxfrllf.exec:\fxfrllf.exe84⤵PID:4300
-
\??\c:\lfxrllx.exec:\lfxrllx.exe85⤵PID:2324
-
\??\c:\btttnn.exec:\btttnn.exe86⤵PID:4820
-
\??\c:\bbhbnt.exec:\bbhbnt.exe87⤵PID:4136
-
\??\c:\pdpdv.exec:\pdpdv.exe88⤵PID:3564
-
\??\c:\dvvpj.exec:\dvvpj.exe89⤵PID:3328
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe90⤵PID:4376
-
\??\c:\frrrrrr.exec:\frrrrrr.exe91⤵PID:1928
-
\??\c:\ttttbb.exec:\ttttbb.exe92⤵PID:1948
-
\??\c:\9nnnbb.exec:\9nnnbb.exe93⤵PID:2376
-
\??\c:\jvjdp.exec:\jvjdp.exe94⤵PID:3652
-
\??\c:\rlxrllf.exec:\rlxrllf.exe95⤵PID:5112
-
\??\c:\xfllxxx.exec:\xfllxxx.exe96⤵PID:1724
-
\??\c:\nbnnhb.exec:\nbnnhb.exe97⤵PID:3408
-
\??\c:\ddvvd.exec:\ddvvd.exe98⤵PID:1632
-
\??\c:\5ddvp.exec:\5ddvp.exe99⤵PID:4760
-
\??\c:\lfrlfff.exec:\lfrlfff.exe100⤵PID:956
-
\??\c:\3tnhbb.exec:\3tnhbb.exe101⤵PID:1508
-
\??\c:\htnhtt.exec:\htnhtt.exe102⤵PID:2488
-
\??\c:\dppjd.exec:\dppjd.exe103⤵PID:1068
-
\??\c:\ddpjd.exec:\ddpjd.exe104⤵PID:4212
-
\??\c:\jdddv.exec:\jdddv.exe105⤵PID:3028
-
\??\c:\rfffrrl.exec:\rfffrrl.exe106⤵PID:1580
-
\??\c:\tbbbtt.exec:\tbbbtt.exe107⤵PID:3228
-
\??\c:\tnnhbh.exec:\tnnhbh.exe108⤵PID:4772
-
\??\c:\nhbhtt.exec:\nhbhtt.exe109⤵PID:1832
-
\??\c:\jvdpd.exec:\jvdpd.exe110⤵PID:1456
-
\??\c:\vdjvp.exec:\vdjvp.exe111⤵PID:3492
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe112⤵PID:1108
-
\??\c:\rxxxlxr.exec:\rxxxlxr.exe113⤵PID:2760
-
\??\c:\nnnnhh.exec:\nnnnhh.exe114⤵PID:1868
-
\??\c:\btbtnn.exec:\btbtnn.exe115⤵PID:4516
-
\??\c:\5tnhtn.exec:\5tnhtn.exe116⤵PID:2948
-
\??\c:\3vvdv.exec:\3vvdv.exe117⤵PID:2152
-
\??\c:\jjvpj.exec:\jjvpj.exe118⤵PID:2892
-
\??\c:\xflfxrr.exec:\xflfxrr.exe119⤵PID:3128
-
\??\c:\7fffrrl.exec:\7fffrrl.exe120⤵PID:560
-
\??\c:\tnnhbb.exec:\tnnhbb.exe121⤵PID:3752
-
\??\c:\ttnhtt.exec:\ttnhtt.exe122⤵PID:2404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-