Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 04:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe
-
Size
95KB
-
MD5
bbab3adcd6ac40959876a4e811a36444
-
SHA1
bfd24f1ac2e345c34e223cf39a999c898d5ad758
-
SHA256
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef
-
SHA512
f44240ce6aa5cfbbf50c31a03d242cf8a1a0ff1f2b006b2870542c4c0b66580d470c90537f7a2acb9dd2fd7b8b7447d5703334a4d6e4e5ea541e80b98e2ebdfa
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQ0:ymb3NkkiQ3mdBjFIj+qNhvZuHQY00
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/5048-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 35 IoCs
Processes:
resource yara_rule behavioral2/memory/1572-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5048-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3620-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1572-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1860-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4772-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2460-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2904-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/880-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3660-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1180-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3952-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4456-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5040-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4480-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1684-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4540-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4372-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4780-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4384-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ffrrlff.exebhtbtn.exeddjjp.exe7htnht.exeddvpp.exe1djdv.exetbbbbb.exejppjj.exelffxrll.exevdddv.exejdjdd.exexxrfxff.exentthhh.exe1lrlllf.exerllxxfr.exebbbbhb.exejpjjd.exerxfrfff.exe9xxrlff.exetnhbtn.exevdddv.exeppdjp.exethhbtn.exedjvpv.exe5jpjd.exehbbtnt.exevjjpj.exevpdvp.exerxffrrr.exenhbbtt.exepjpjj.exejpvdv.exelfrfxll.exehbbttn.exeppvdv.exevvddd.exefrlfxxl.exebtbbbt.exedvdvd.exevvpjj.exerfxlrrl.exehhbbtt.exehbhbtt.exevjvpd.exexrrxlrl.exerfrrlfx.exedjpjd.exevppjd.exefxxxrrr.exe7bhhbh.exe7htnbb.exevpvvp.exevjpjj.exerrfflll.exe3xlrllr.exebthhtb.exe3bnhtt.exevdddd.exejpvpj.exefrxfxxx.exeffxrrrl.exentnnhb.exevjdvv.exefxrxflx.exepid process 3620 ffrrlff.exe 5048 bhtbtn.exe 1860 ddjjp.exe 2460 7htnht.exe 4772 ddvpp.exe 4860 1djdv.exe 1168 tbbbbb.exe 1784 jppjj.exe 1732 lffxrll.exe 1764 vdddv.exe 2904 jdjdd.exe 880 xxrfxff.exe 2528 ntthhh.exe 3660 1lrlllf.exe 1068 rllxxfr.exe 1180 bbbbhb.exe 3952 jpjjd.exe 4456 rxfrfff.exe 384 9xxrlff.exe 5040 tnhbtn.exe 4480 vdddv.exe 1684 ppdjp.exe 4540 thhbtn.exe 4372 djvpv.exe 2368 5jpjd.exe 4780 hbbtnt.exe 3836 vjjpj.exe 1628 vpdvp.exe 4700 rxffrrr.exe 4384 nhbbtt.exe 5072 pjpjj.exe 4532 jpvdv.exe 2964 lfrfxll.exe 4268 hbbttn.exe 2004 ppvdv.exe 4460 vvddd.exe 1860 frlfxxl.exe 3340 btbbbt.exe 4772 dvdvd.exe 1544 vvpjj.exe 440 rfxlrrl.exe 1168 hhbbtt.exe 2512 hbhbtt.exe 4388 vjvpd.exe 3756 xrrxlrl.exe 404 rfrrlfx.exe 4900 djpjd.exe 368 vppjd.exe 1276 fxxxrrr.exe 3172 7bhhbh.exe 4980 7htnbb.exe 4988 vpvvp.exe 3276 vjpjj.exe 2324 rrfflll.exe 868 3xlrllr.exe 3428 bthhtb.exe 3272 3bnhtt.exe 3352 vdddd.exe 3264 jpvpj.exe 540 frxfxxx.exe 4516 ffxrrrl.exe 1520 ntnnhb.exe 3464 vjdvv.exe 4372 fxrxflx.exe -
Processes:
resource yara_rule behavioral2/memory/1572-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exeffrrlff.exebhtbtn.exeddjjp.exe7htnht.exeddvpp.exe1djdv.exetbbbbb.exejppjj.exelffxrll.exevdddv.exejdjdd.exexxrfxff.exentthhh.exe1lrlllf.exerllxxfr.exebbbbhb.exejpjjd.exerxfrfff.exe9xxrlff.exetnhbtn.exevdddv.exedescription pid process target process PID 1572 wrote to memory of 3620 1572 db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe ffrrlff.exe PID 1572 wrote to memory of 3620 1572 db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe ffrrlff.exe PID 1572 wrote to memory of 3620 1572 db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe ffrrlff.exe PID 3620 wrote to memory of 5048 3620 ffrrlff.exe bhtbtn.exe PID 3620 wrote to memory of 5048 3620 ffrrlff.exe bhtbtn.exe PID 3620 wrote to memory of 5048 3620 ffrrlff.exe bhtbtn.exe PID 5048 wrote to memory of 1860 5048 bhtbtn.exe ddjjp.exe PID 5048 wrote to memory of 1860 5048 bhtbtn.exe ddjjp.exe PID 5048 wrote to memory of 1860 5048 bhtbtn.exe ddjjp.exe PID 1860 wrote to memory of 2460 1860 ddjjp.exe 7htnht.exe PID 1860 wrote to memory of 2460 1860 ddjjp.exe 7htnht.exe PID 1860 wrote to memory of 2460 1860 ddjjp.exe 7htnht.exe PID 2460 wrote to memory of 4772 2460 7htnht.exe ddvpp.exe PID 2460 wrote to memory of 4772 2460 7htnht.exe ddvpp.exe PID 2460 wrote to memory of 4772 2460 7htnht.exe ddvpp.exe PID 4772 wrote to memory of 4860 4772 ddvpp.exe 1djdv.exe PID 4772 wrote to memory of 4860 4772 ddvpp.exe 1djdv.exe PID 4772 wrote to memory of 4860 4772 ddvpp.exe 1djdv.exe PID 4860 wrote to memory of 1168 4860 1djdv.exe tbbbbb.exe PID 4860 wrote to memory of 1168 4860 1djdv.exe tbbbbb.exe PID 4860 wrote to memory of 1168 4860 1djdv.exe tbbbbb.exe PID 1168 wrote to memory of 1784 1168 tbbbbb.exe jppjj.exe PID 1168 wrote to memory of 1784 1168 tbbbbb.exe jppjj.exe PID 1168 wrote to memory of 1784 1168 tbbbbb.exe jppjj.exe PID 1784 wrote to memory of 1732 1784 jppjj.exe lffxrll.exe PID 1784 wrote to memory of 1732 1784 jppjj.exe lffxrll.exe PID 1784 wrote to memory of 1732 1784 jppjj.exe lffxrll.exe PID 1732 wrote to memory of 1764 1732 lffxrll.exe vdddv.exe PID 1732 wrote to memory of 1764 1732 lffxrll.exe vdddv.exe PID 1732 wrote to memory of 1764 1732 lffxrll.exe vdddv.exe PID 1764 wrote to memory of 2904 1764 vdddv.exe jdjdd.exe PID 1764 wrote to memory of 2904 1764 vdddv.exe jdjdd.exe PID 1764 wrote to memory of 2904 1764 vdddv.exe jdjdd.exe PID 2904 wrote to memory of 880 2904 jdjdd.exe xxrfxff.exe PID 2904 wrote to memory of 880 2904 jdjdd.exe xxrfxff.exe PID 2904 wrote to memory of 880 2904 jdjdd.exe xxrfxff.exe PID 880 wrote to memory of 2528 880 xxrfxff.exe ntthhh.exe PID 880 wrote to memory of 2528 880 xxrfxff.exe ntthhh.exe PID 880 wrote to memory of 2528 880 xxrfxff.exe ntthhh.exe PID 2528 wrote to memory of 3660 2528 ntthhh.exe 1lrlllf.exe PID 2528 wrote to memory of 3660 2528 ntthhh.exe 1lrlllf.exe PID 2528 wrote to memory of 3660 2528 ntthhh.exe 1lrlllf.exe PID 3660 wrote to memory of 1068 3660 1lrlllf.exe rllxxfr.exe PID 3660 wrote to memory of 1068 3660 1lrlllf.exe rllxxfr.exe PID 3660 wrote to memory of 1068 3660 1lrlllf.exe rllxxfr.exe PID 1068 wrote to memory of 1180 1068 rllxxfr.exe bbbbhb.exe PID 1068 wrote to memory of 1180 1068 rllxxfr.exe bbbbhb.exe PID 1068 wrote to memory of 1180 1068 rllxxfr.exe bbbbhb.exe PID 1180 wrote to memory of 3952 1180 bbbbhb.exe jpjjd.exe PID 1180 wrote to memory of 3952 1180 bbbbhb.exe jpjjd.exe PID 1180 wrote to memory of 3952 1180 bbbbhb.exe jpjjd.exe PID 3952 wrote to memory of 4456 3952 jpjjd.exe rxfrfff.exe PID 3952 wrote to memory of 4456 3952 jpjjd.exe rxfrfff.exe PID 3952 wrote to memory of 4456 3952 jpjjd.exe rxfrfff.exe PID 4456 wrote to memory of 384 4456 rxfrfff.exe 9xxrlff.exe PID 4456 wrote to memory of 384 4456 rxfrfff.exe 9xxrlff.exe PID 4456 wrote to memory of 384 4456 rxfrfff.exe 9xxrlff.exe PID 384 wrote to memory of 5040 384 9xxrlff.exe tnhbtn.exe PID 384 wrote to memory of 5040 384 9xxrlff.exe tnhbtn.exe PID 384 wrote to memory of 5040 384 9xxrlff.exe tnhbtn.exe PID 5040 wrote to memory of 4480 5040 tnhbtn.exe vdddv.exe PID 5040 wrote to memory of 4480 5040 tnhbtn.exe vdddv.exe PID 5040 wrote to memory of 4480 5040 tnhbtn.exe vdddv.exe PID 4480 wrote to memory of 1684 4480 vdddv.exe ppdjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe"C:\Users\Admin\AppData\Local\Temp\db422738d1b517bcb4fc386f29c67dc4e937fb7700d18c29e0ce327669222fef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\ffrrlff.exec:\ffrrlff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\bhtbtn.exec:\bhtbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\ddjjp.exec:\ddjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\7htnht.exec:\7htnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\ddvpp.exec:\ddvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\1djdv.exec:\1djdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\tbbbbb.exec:\tbbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\jppjj.exec:\jppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\lffxrll.exec:\lffxrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vdddv.exec:\vdddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\jdjdd.exec:\jdjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\xxrfxff.exec:\xxrfxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\ntthhh.exec:\ntthhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1lrlllf.exec:\1lrlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\rllxxfr.exec:\rllxxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\bbbbhb.exec:\bbbbhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\jpjjd.exec:\jpjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\rxfrfff.exec:\rxfrfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\9xxrlff.exec:\9xxrlff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\tnhbtn.exec:\tnhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\vdddv.exec:\vdddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\ppdjp.exec:\ppdjp.exe23⤵
- Executes dropped EXE
PID:1684 -
\??\c:\thhbtn.exec:\thhbtn.exe24⤵
- Executes dropped EXE
PID:4540 -
\??\c:\djvpv.exec:\djvpv.exe25⤵
- Executes dropped EXE
PID:4372 -
\??\c:\5jpjd.exec:\5jpjd.exe26⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hbbtnt.exec:\hbbtnt.exe27⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vjjpj.exec:\vjjpj.exe28⤵
- Executes dropped EXE
PID:3836 -
\??\c:\vpdvp.exec:\vpdvp.exe29⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rxffrrr.exec:\rxffrrr.exe30⤵
- Executes dropped EXE
PID:4700 -
\??\c:\nhbbtt.exec:\nhbbtt.exe31⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pjpjj.exec:\pjpjj.exe32⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jpvdv.exec:\jpvdv.exe33⤵
- Executes dropped EXE
PID:4532 -
\??\c:\lfrfxll.exec:\lfrfxll.exe34⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hbbttn.exec:\hbbttn.exe35⤵
- Executes dropped EXE
PID:4268 -
\??\c:\ppvdv.exec:\ppvdv.exe36⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvddd.exec:\vvddd.exe37⤵
- Executes dropped EXE
PID:4460 -
\??\c:\frlfxxl.exec:\frlfxxl.exe38⤵
- Executes dropped EXE
PID:1860 -
\??\c:\btbbbt.exec:\btbbbt.exe39⤵
- Executes dropped EXE
PID:3340 -
\??\c:\dvdvd.exec:\dvdvd.exe40⤵
- Executes dropped EXE
PID:4772 -
\??\c:\vvpjj.exec:\vvpjj.exe41⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rfxlrrl.exec:\rfxlrrl.exe42⤵
- Executes dropped EXE
PID:440 -
\??\c:\hhbbtt.exec:\hhbbtt.exe43⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hbhbtt.exec:\hbhbtt.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vjvpd.exec:\vjvpd.exe45⤵
- Executes dropped EXE
PID:4388 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe46⤵
- Executes dropped EXE
PID:3756 -
\??\c:\rfrrlfx.exec:\rfrrlfx.exe47⤵
- Executes dropped EXE
PID:404 -
\??\c:\djpjd.exec:\djpjd.exe48⤵
- Executes dropped EXE
PID:4900 -
\??\c:\vppjd.exec:\vppjd.exe49⤵
- Executes dropped EXE
PID:368 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7bhhbh.exec:\7bhhbh.exe51⤵
- Executes dropped EXE
PID:3172 -
\??\c:\7htnbb.exec:\7htnbb.exe52⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vpvvp.exec:\vpvvp.exe53⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vjpjj.exec:\vjpjj.exe54⤵
- Executes dropped EXE
PID:3276 -
\??\c:\rrfflll.exec:\rrfflll.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3xlrllr.exec:\3xlrllr.exe56⤵
- Executes dropped EXE
PID:868 -
\??\c:\bthhtb.exec:\bthhtb.exe57⤵
- Executes dropped EXE
PID:3428 -
\??\c:\3bnhtt.exec:\3bnhtt.exe58⤵
- Executes dropped EXE
PID:3272 -
\??\c:\vdddd.exec:\vdddd.exe59⤵
- Executes dropped EXE
PID:3352 -
\??\c:\jpvpj.exec:\jpvpj.exe60⤵
- Executes dropped EXE
PID:3264 -
\??\c:\frxfxxx.exec:\frxfxxx.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe62⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ntnnhb.exec:\ntnnhb.exe63⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vjdvv.exec:\vjdvv.exe64⤵
- Executes dropped EXE
PID:3464 -
\??\c:\fxrxflx.exec:\fxrxflx.exe65⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tthbhn.exec:\tthbhn.exe66⤵PID:1320
-
\??\c:\pjjdv.exec:\pjjdv.exe67⤵PID:4424
-
\??\c:\rrrlllf.exec:\rrrlllf.exe68⤵PID:1580
-
\??\c:\rlflxrx.exec:\rlflxrx.exe69⤵PID:5028
-
\??\c:\nntbhb.exec:\nntbhb.exe70⤵PID:1980
-
\??\c:\7hbbnn.exec:\7hbbnn.exe71⤵PID:1880
-
\??\c:\ppjvp.exec:\ppjvp.exe72⤵PID:5012
-
\??\c:\rlxrffl.exec:\rlxrffl.exe73⤵PID:1864
-
\??\c:\ffxxrll.exec:\ffxxrll.exe74⤵PID:4952
-
\??\c:\1hnhbb.exec:\1hnhbb.exe75⤵PID:4252
-
\??\c:\pjvvp.exec:\pjvvp.exe76⤵PID:2260
-
\??\c:\jddpv.exec:\jddpv.exe77⤵PID:4756
-
\??\c:\lfffffx.exec:\lfffffx.exe78⤵PID:4460
-
\??\c:\nthhtt.exec:\nthhtt.exe79⤵PID:1444
-
\??\c:\bhnbth.exec:\bhnbth.exe80⤵PID:3976
-
\??\c:\pddpd.exec:\pddpd.exe81⤵PID:932
-
\??\c:\vdpjj.exec:\vdpjj.exe82⤵PID:4772
-
\??\c:\rllfxrr.exec:\rllfxrr.exe83⤵PID:640
-
\??\c:\tbbbtt.exec:\tbbbtt.exe84⤵PID:4848
-
\??\c:\hbhtnt.exec:\hbhtnt.exe85⤵PID:4352
-
\??\c:\3jpjp.exec:\3jpjp.exe86⤵PID:4412
-
\??\c:\frfxrrx.exec:\frfxrrx.exe87⤵PID:4388
-
\??\c:\rfllfff.exec:\rfllfff.exe88⤵PID:3756
-
\??\c:\frrlfxr.exec:\frrlfxr.exe89⤵PID:376
-
\??\c:\nbnnnn.exec:\nbnnnn.exe90⤵PID:2044
-
\??\c:\jdvpp.exec:\jdvpp.exe91⤵PID:3496
-
\??\c:\djdpd.exec:\djdpd.exe92⤵PID:5104
-
\??\c:\flxrlll.exec:\flxrlll.exe93⤵PID:772
-
\??\c:\9rrxxxx.exec:\9rrxxxx.exe94⤵PID:3492
-
\??\c:\bbnntt.exec:\bbnntt.exe95⤵PID:1068
-
\??\c:\bttnnh.exec:\bttnnh.exe96⤵PID:3772
-
\??\c:\vpjvv.exec:\vpjvv.exe97⤵PID:4048
-
\??\c:\vvjdv.exec:\vvjdv.exe98⤵PID:1200
-
\??\c:\7lxrxxr.exec:\7lxrxxr.exe99⤵PID:4804
-
\??\c:\7xfffxl.exec:\7xfffxl.exe100⤵PID:760
-
\??\c:\5hthht.exec:\5hthht.exe101⤵PID:3352
-
\??\c:\thnhbn.exec:\thnhbn.exe102⤵PID:3264
-
\??\c:\djppj.exec:\djppj.exe103⤵PID:540
-
\??\c:\7dvdp.exec:\7dvdp.exe104⤵PID:4516
-
\??\c:\rlflfrx.exec:\rlflfrx.exe105⤵PID:3656
-
\??\c:\fxrlfll.exec:\fxrlfll.exe106⤵PID:4340
-
\??\c:\ffxrrlf.exec:\ffxrrlf.exe107⤵PID:3372
-
\??\c:\nhnhbt.exec:\nhnhbt.exe108⤵PID:4976
-
\??\c:\xxflfrx.exec:\xxflfrx.exe109⤵PID:4880
-
\??\c:\ttttnn.exec:\ttttnn.exe110⤵PID:1492
-
\??\c:\nhtnhh.exec:\nhtnhh.exe111⤵PID:5028
-
\??\c:\vpjdv.exec:\vpjdv.exe112⤵PID:1980
-
\??\c:\pjjdv.exec:\pjjdv.exe113⤵PID:4384
-
\??\c:\fflffff.exec:\fflffff.exe114⤵PID:3268
-
\??\c:\nhbtnn.exec:\nhbtnn.exe115⤵PID:2304
-
\??\c:\hhhbbt.exec:\hhhbbt.exe116⤵PID:1572
-
\??\c:\nhnhtt.exec:\nhnhtt.exe117⤵PID:1788
-
\??\c:\vvddd.exec:\vvddd.exe118⤵PID:4460
-
\??\c:\vjpvv.exec:\vjpvv.exe119⤵PID:4912
-
\??\c:\ffffxxl.exec:\ffffxxl.exe120⤵PID:932
-
\??\c:\xxxfxxf.exec:\xxxfxxf.exe121⤵PID:2100
-
\??\c:\nhtttt.exec:\nhtttt.exe122⤵PID:3440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-