Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 18:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86.exe
-
Size
51KB
-
MD5
58d5d4b198b903e77b0e551ecd4715b3
-
SHA1
95c46184aaa9da1c540191c17add3c93beda3aa6
-
SHA256
11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86
-
SHA512
29bdd342f3245189d19fbf6c0b42604b16515a61293a762d992bc9ab013fa8c8f36173d74fecd442551a145ebd2815aa507a58365749b7b10457dc2c62610c35
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoYb:ymb3NkkiQ3mdBjFoQ
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5796-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5504-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4252-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1580-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1308-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4236-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5796-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5504-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5504-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4584-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4584-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4584-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4584-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4680-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2716-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4212-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4204-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4348-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3520-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2432-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5024-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/624-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4792-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/756-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/896-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3772 tntnbb.exe 5036 jdddd.exe 4252 lffxxxx.exe 3084 bhbbtb.exe 1580 hhhbbb.exe 1308 9vdvp.exe 4236 xlxlfff.exe 5796 xxfxlxf.exe 5504 nnnnnb.exe 4584 7vjvv.exe 4680 7lfxrlf.exe 3848 thtbnb.exe 5332 jdppd.exe 1936 pddjj.exe 2716 7rflfff.exe 4212 nbbbbb.exe 4204 jvjdp.exe 4004 dpvvp.exe 4348 xflfxxf.exe 3520 rlxfllx.exe 2432 hhnhtt.exe 5024 pdjdv.exe 1388 lrflfll.exe 624 rfrllll.exe 4792 bbtttt.exe 60 pjjpv.exe 5756 rllrfrf.exe 5208 bnttnn.exe 756 pdpjd.exe 896 pjjvj.exe 1700 fxrrxfr.exe 1844 ntbbbh.exe 4504 3jvjj.exe 3428 vvpjp.exe 4568 lrfrlff.exe 2864 5fflxfx.exe 4388 thtbht.exe 6056 hhttbh.exe 5140 jdvpv.exe 5564 3rfxrlx.exe 4596 xffxxlf.exe 376 htnnhb.exe 2576 htttnh.exe 5424 ppvvv.exe 4592 xxllllf.exe 3044 lxffxxr.exe 4128 hnttnt.exe 2712 tbnnbh.exe 5568 3pppp.exe 5204 lrllfff.exe 5392 xffxrxx.exe 5020 hbbthb.exe 5324 3dvvd.exe 5300 vdpjd.exe 1436 fxllllr.exe 5460 fxffxfx.exe 5108 1bnhbn.exe 5748 nttbtt.exe 3700 3dvpj.exe 5492 jpdpd.exe 5476 llflfff.exe 4752 xlrxrff.exe 2456 1thhhn.exe 6000 9ntbbh.exe -
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5796-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5504-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5504-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 3772 1316 11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86.exe 82 PID 1316 wrote to memory of 3772 1316 11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86.exe 82 PID 1316 wrote to memory of 3772 1316 11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86.exe 82 PID 3772 wrote to memory of 5036 3772 tntnbb.exe 83 PID 3772 wrote to memory of 5036 3772 tntnbb.exe 83 PID 3772 wrote to memory of 5036 3772 tntnbb.exe 83 PID 5036 wrote to memory of 4252 5036 jdddd.exe 84 PID 5036 wrote to memory of 4252 5036 jdddd.exe 84 PID 5036 wrote to memory of 4252 5036 jdddd.exe 84 PID 4252 wrote to memory of 3084 4252 lffxxxx.exe 85 PID 4252 wrote to memory of 3084 4252 lffxxxx.exe 85 PID 4252 wrote to memory of 3084 4252 lffxxxx.exe 85 PID 3084 wrote to memory of 1580 3084 bhbbtb.exe 86 PID 3084 wrote to memory of 1580 3084 bhbbtb.exe 86 PID 3084 wrote to memory of 1580 3084 bhbbtb.exe 86 PID 1580 wrote to memory of 1308 1580 hhhbbb.exe 87 PID 1580 wrote to memory of 1308 1580 hhhbbb.exe 87 PID 1580 wrote to memory of 1308 1580 hhhbbb.exe 87 PID 1308 wrote to memory of 4236 1308 9vdvp.exe 88 PID 1308 wrote to memory of 4236 1308 9vdvp.exe 88 PID 1308 wrote to memory of 4236 1308 9vdvp.exe 88 PID 4236 wrote to memory of 5796 4236 xlxlfff.exe 89 PID 4236 wrote to memory of 5796 4236 xlxlfff.exe 89 PID 4236 wrote to memory of 5796 4236 xlxlfff.exe 89 PID 5796 wrote to memory of 5504 5796 xxfxlxf.exe 90 PID 5796 wrote to memory of 5504 5796 xxfxlxf.exe 90 PID 5796 wrote to memory of 5504 5796 xxfxlxf.exe 90 PID 5504 wrote to memory of 4584 5504 nnnnnb.exe 91 PID 5504 wrote to memory of 4584 5504 nnnnnb.exe 91 PID 5504 wrote to memory of 4584 5504 nnnnnb.exe 91 PID 4584 wrote to memory of 4680 4584 7vjvv.exe 92 PID 4584 wrote to memory of 4680 4584 7vjvv.exe 92 PID 4584 wrote to memory of 4680 4584 7vjvv.exe 92 PID 4680 wrote to memory of 3848 4680 7lfxrlf.exe 93 PID 4680 wrote to memory of 3848 4680 7lfxrlf.exe 93 PID 4680 wrote to memory of 3848 4680 7lfxrlf.exe 93 PID 3848 wrote to memory of 5332 3848 thtbnb.exe 94 PID 3848 wrote to memory of 5332 3848 thtbnb.exe 94 PID 3848 wrote to memory of 5332 3848 thtbnb.exe 94 PID 5332 wrote to memory of 1936 5332 jdppd.exe 95 PID 5332 wrote to memory of 1936 5332 jdppd.exe 95 PID 5332 wrote to memory of 1936 5332 jdppd.exe 95 PID 1936 wrote to memory of 2716 1936 pddjj.exe 96 PID 1936 wrote to memory of 2716 1936 pddjj.exe 96 PID 1936 wrote to memory of 2716 1936 pddjj.exe 96 PID 2716 wrote to memory of 4212 2716 7rflfff.exe 97 PID 2716 wrote to memory of 4212 2716 7rflfff.exe 97 PID 2716 wrote to memory of 4212 2716 7rflfff.exe 97 PID 4212 wrote to memory of 4204 4212 nbbbbb.exe 98 PID 4212 wrote to memory of 4204 4212 nbbbbb.exe 98 PID 4212 wrote to memory of 4204 4212 nbbbbb.exe 98 PID 4204 wrote to memory of 4004 4204 jvjdp.exe 99 PID 4204 wrote to memory of 4004 4204 jvjdp.exe 99 PID 4204 wrote to memory of 4004 4204 jvjdp.exe 99 PID 4004 wrote to memory of 4348 4004 dpvvp.exe 100 PID 4004 wrote to memory of 4348 4004 dpvvp.exe 100 PID 4004 wrote to memory of 4348 4004 dpvvp.exe 100 PID 4348 wrote to memory of 3520 4348 xflfxxf.exe 101 PID 4348 wrote to memory of 3520 4348 xflfxxf.exe 101 PID 4348 wrote to memory of 3520 4348 xflfxxf.exe 101 PID 3520 wrote to memory of 2432 3520 rlxfllx.exe 102 PID 3520 wrote to memory of 2432 3520 rlxfllx.exe 102 PID 3520 wrote to memory of 2432 3520 rlxfllx.exe 102 PID 2432 wrote to memory of 5024 2432 hhnhtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86.exe"C:\Users\Admin\AppData\Local\Temp\11dcc2f4af4589b79414baabb44e820d6baac523dd810d1d7eb2fcca40bedc86.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\tntnbb.exec:\tntnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\jdddd.exec:\jdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\lffxxxx.exec:\lffxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\bhbbtb.exec:\bhbbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\hhhbbb.exec:\hhhbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\9vdvp.exec:\9vdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\xlxlfff.exec:\xlxlfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\xxfxlxf.exec:\xxfxlxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
\??\c:\nnnnnb.exec:\nnnnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
\??\c:\7vjvv.exec:\7vjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\7lfxrlf.exec:\7lfxrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\thtbnb.exec:\thtbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\jdppd.exec:\jdppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
\??\c:\pddjj.exec:\pddjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7rflfff.exec:\7rflfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nbbbbb.exec:\nbbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\jvjdp.exec:\jvjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\dpvvp.exec:\dpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\xflfxxf.exec:\xflfxxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\rlxfllx.exec:\rlxfllx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\hhnhtt.exec:\hhnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\pdjdv.exec:\pdjdv.exe23⤵
- Executes dropped EXE
PID:5024 -
\??\c:\lrflfll.exec:\lrflfll.exe24⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rfrllll.exec:\rfrllll.exe25⤵
- Executes dropped EXE
PID:624 -
\??\c:\bbtttt.exec:\bbtttt.exe26⤵
- Executes dropped EXE
PID:4792 -
\??\c:\pjjpv.exec:\pjjpv.exe27⤵
- Executes dropped EXE
PID:60 -
\??\c:\rllrfrf.exec:\rllrfrf.exe28⤵
- Executes dropped EXE
PID:5756 -
\??\c:\bnttnn.exec:\bnttnn.exe29⤵
- Executes dropped EXE
PID:5208 -
\??\c:\pdpjd.exec:\pdpjd.exe30⤵
- Executes dropped EXE
PID:756 -
\??\c:\pjjvj.exec:\pjjvj.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe32⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ntbbbh.exec:\ntbbbh.exe33⤵
- Executes dropped EXE
PID:1844 -
\??\c:\3jvjj.exec:\3jvjj.exe34⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vvpjp.exec:\vvpjp.exe35⤵
- Executes dropped EXE
PID:3428 -
\??\c:\lrfrlff.exec:\lrfrlff.exe36⤵
- Executes dropped EXE
PID:4568 -
\??\c:\5fflxfx.exec:\5fflxfx.exe37⤵
- Executes dropped EXE
PID:2864 -
\??\c:\thtbht.exec:\thtbht.exe38⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hhttbh.exec:\hhttbh.exe39⤵
- Executes dropped EXE
PID:6056 -
\??\c:\jdvpv.exec:\jdvpv.exe40⤵
- Executes dropped EXE
PID:5140 -
\??\c:\3rfxrlx.exec:\3rfxrlx.exe41⤵
- Executes dropped EXE
PID:5564 -
\??\c:\xffxxlf.exec:\xffxxlf.exe42⤵
- Executes dropped EXE
PID:4596 -
\??\c:\htnnhb.exec:\htnnhb.exe43⤵
- Executes dropped EXE
PID:376 -
\??\c:\htttnh.exec:\htttnh.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ppvvv.exec:\ppvvv.exe45⤵
- Executes dropped EXE
PID:5424 -
\??\c:\xxllllf.exec:\xxllllf.exe46⤵
- Executes dropped EXE
PID:4592 -
\??\c:\lxffxxr.exec:\lxffxxr.exe47⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hnttnt.exec:\hnttnt.exe48⤵
- Executes dropped EXE
PID:4128 -
\??\c:\tbnnbh.exec:\tbnnbh.exe49⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3pppp.exec:\3pppp.exe50⤵
- Executes dropped EXE
PID:5568 -
\??\c:\lrllfff.exec:\lrllfff.exe51⤵
- Executes dropped EXE
PID:5204 -
\??\c:\xffxrxx.exec:\xffxrxx.exe52⤵
- Executes dropped EXE
PID:5392 -
\??\c:\hbbthb.exec:\hbbthb.exe53⤵
- Executes dropped EXE
PID:5020 -
\??\c:\3dvvd.exec:\3dvvd.exe54⤵
- Executes dropped EXE
PID:5324 -
\??\c:\vdpjd.exec:\vdpjd.exe55⤵
- Executes dropped EXE
PID:5300 -
\??\c:\fxllllr.exec:\fxllllr.exe56⤵
- Executes dropped EXE
PID:1436 -
\??\c:\fxffxfx.exec:\fxffxfx.exe57⤵
- Executes dropped EXE
PID:5460 -
\??\c:\1bnhbn.exec:\1bnhbn.exe58⤵
- Executes dropped EXE
PID:5108 -
\??\c:\nttbtt.exec:\nttbtt.exe59⤵
- Executes dropped EXE
PID:5748 -
\??\c:\3dvpj.exec:\3dvpj.exe60⤵
- Executes dropped EXE
PID:3700 -
\??\c:\jpdpd.exec:\jpdpd.exe61⤵
- Executes dropped EXE
PID:5492 -
\??\c:\llflfff.exec:\llflfff.exe62⤵
- Executes dropped EXE
PID:5476 -
\??\c:\xlrxrff.exec:\xlrxrff.exe63⤵
- Executes dropped EXE
PID:4752 -
\??\c:\1thhhn.exec:\1thhhn.exe64⤵
- Executes dropped EXE
PID:2456 -
\??\c:\9ntbbh.exec:\9ntbbh.exe65⤵
- Executes dropped EXE
PID:6000 -
\??\c:\ppjdj.exec:\ppjdj.exe66⤵PID:5404
-
\??\c:\vvvvv.exec:\vvvvv.exe67⤵PID:4828
-
\??\c:\fxfrllf.exec:\fxfrllf.exe68⤵PID:1944
-
\??\c:\lflfffx.exec:\lflfffx.exe69⤵PID:4468
-
\??\c:\5nhhhh.exec:\5nhhhh.exe70⤵PID:4600
-
\??\c:\nnhhhh.exec:\nnhhhh.exe71⤵PID:3728
-
\??\c:\vjppj.exec:\vjppj.exe72⤵PID:2928
-
\??\c:\9dvdd.exec:\9dvdd.exe73⤵PID:5032
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe74⤵PID:1848
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe75⤵PID:3128
-
\??\c:\7bhhhh.exec:\7bhhhh.exe76⤵PID:4412
-
\??\c:\bnnhhh.exec:\bnnhhh.exe77⤵PID:2276
-
\??\c:\dvvvp.exec:\dvvvp.exe78⤵PID:1676
-
\??\c:\7jppj.exec:\7jppj.exe79⤵PID:5384
-
\??\c:\flxxrxx.exec:\flxxrxx.exe80⤵PID:3800
-
\??\c:\xffrrrr.exec:\xffrrrr.exe81⤵PID:1824
-
\??\c:\lflfrrf.exec:\lflfrrf.exe82⤵PID:4516
-
\??\c:\tnhhhn.exec:\tnhhhn.exe83⤵PID:5504
-
\??\c:\pjvpp.exec:\pjvpp.exe84⤵PID:4924
-
\??\c:\pjpjj.exec:\pjpjj.exe85⤵PID:2520
-
\??\c:\1fxrlrl.exec:\1fxrlrl.exe86⤵PID:1312
-
\??\c:\lrllllf.exec:\lrllllf.exe87⤵PID:3852
-
\??\c:\7tbbnt.exec:\7tbbnt.exe88⤵PID:4616
-
\??\c:\ppddj.exec:\ppddj.exe89⤵PID:428
-
\??\c:\xxxffrx.exec:\xxxffrx.exe90⤵PID:5296
-
\??\c:\ffxlxfl.exec:\ffxlxfl.exe91⤵PID:5248
-
\??\c:\hthtnt.exec:\hthtnt.exe92⤵PID:3456
-
\??\c:\5nnhbb.exec:\5nnhbb.exe93⤵PID:4708
-
\??\c:\pjvpp.exec:\pjvpp.exe94⤵PID:2180
-
\??\c:\pvpjd.exec:\pvpjd.exe95⤵PID:4620
-
\??\c:\lrllfff.exec:\lrllfff.exe96⤵PID:3364
-
\??\c:\7rfffrx.exec:\7rfffrx.exe97⤵PID:5692
-
\??\c:\bbbbtt.exec:\bbbbtt.exe98⤵PID:3688
-
\??\c:\tbhnnt.exec:\tbhnnt.exe99⤵PID:5440
-
\??\c:\jdddd.exec:\jdddd.exe100⤵PID:4520
-
\??\c:\dvdvp.exec:\dvdvp.exe101⤵PID:5804
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe102⤵PID:5612
-
\??\c:\3fxxrrr.exec:\3fxxrrr.exe103⤵PID:2676
-
\??\c:\hhbhhn.exec:\hhbhhn.exe104⤵PID:4792
-
\??\c:\btntbh.exec:\btntbh.exe105⤵PID:60
-
\??\c:\ppdvj.exec:\ppdvj.exe106⤵PID:4916
-
\??\c:\pvdvv.exec:\pvdvv.exe107⤵PID:4312
-
\??\c:\ffxxrrx.exec:\ffxxrrx.exe108⤵PID:3992
-
\??\c:\rffllrx.exec:\rffllrx.exe109⤵PID:808
-
\??\c:\lrrllrr.exec:\lrrllrr.exe110⤵PID:5044
-
\??\c:\hhnnnt.exec:\hhnnnt.exe111⤵PID:2664
-
\??\c:\tnnnhh.exec:\tnnnhh.exe112⤵PID:3752
-
\??\c:\jjvpj.exec:\jjvpj.exe113⤵PID:1576
-
\??\c:\pdddd.exec:\pdddd.exe114⤵PID:2256
-
\??\c:\frrxxxx.exec:\frrxxxx.exe115⤵PID:3420
-
\??\c:\llxrxfl.exec:\llxrxfl.exe116⤵PID:4568
-
\??\c:\tnhtth.exec:\tnhtth.exe117⤵PID:3000
-
\??\c:\bbbnht.exec:\bbbnht.exe118⤵PID:6116
-
\??\c:\ppvdd.exec:\ppvdd.exe119⤵PID:4972
-
\??\c:\jvppd.exec:\jvppd.exe120⤵PID:6136
-
\??\c:\xxrxrff.exec:\xxrxrff.exe121⤵PID:5400
-
\??\c:\rlrllff.exec:\rlrllff.exe122⤵PID:4492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-