Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032.exe
-
Size
67KB
-
MD5
0a8843d541fd3ea43e8c2695e4f08306
-
SHA1
39533acd276bb220b720171c98083b26b7ba2dca
-
SHA256
d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032
-
SHA512
ffc5e6e79baa7bea7aefd73bc5c274669b26569d818e7196b6832a9e006a4341202504509dbd7b7c695d0508fab89c079346783f5ddd90bf6a01756667ed60ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIVQ:ymb3NkkiQ3mdBjFIFdJ8bG
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/228-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/228-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1776-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1776-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1924-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5012-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3648-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4260-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2416-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4944-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1188-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2532-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4772-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3012-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/512-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4324-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3256-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3324-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1256-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4812-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/964-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1776 lfxfllx.exe 1924 bhtbtn.exe 3224 vdpdv.exe 5012 xflfrrl.exe 3648 xrffxrf.exe 2008 nbhbhb.exe 3628 dpvpj.exe 4260 xxxxxff.exe 2416 ffrrrxr.exe 2592 fxffflr.exe 4944 hbtbht.exe 548 dvddv.exe 1188 ppdvv.exe 2532 rlfffff.exe 4772 5bhhnt.exe 3012 bthhbh.exe 512 dvpjp.exe 2024 frfxxxx.exe 4920 nnbbbh.exe 4324 nnbnhh.exe 3256 jdvvv.exe 3324 5rxlffx.exe 1256 bbtttt.exe 4812 nhnhbh.exe 1604 dvvpj.exe 964 fxxrllf.exe 4132 tnhbtn.exe 3276 9vdvp.exe 3096 pddvj.exe 3688 lxrlxxr.exe 2572 tnnbtt.exe 4456 ppvvv.exe 784 3fxrffx.exe 688 5htthh.exe 3600 pdvpj.exe 3268 jdvdv.exe 408 5vjdj.exe 4296 lxrlxxr.exe 1072 hhbthh.exe 2400 nbhbnn.exe 4732 jppjv.exe 1380 lfrrxxx.exe 1056 thtttt.exe 4552 btnhbb.exe 4004 jjdvv.exe 3304 jddjd.exe 3612 lrxlfxr.exe 1040 bbhbtt.exe 4260 3nttnn.exe 1584 vvvpd.exe 3672 vjdvj.exe 1264 xxfrrrf.exe 4944 fxffxff.exe 3184 3hhbhb.exe 3580 pjjdd.exe 2292 ppvpd.exe 1940 fxfxrrr.exe 4380 frxrlll.exe 4720 bbnhhb.exe 660 3bhbbh.exe 3068 5jjdv.exe 2472 vvvpd.exe 1912 ffffxxr.exe 2176 xrllfff.exe -
resource yara_rule behavioral2/memory/228-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 1776 228 d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032.exe 83 PID 228 wrote to memory of 1776 228 d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032.exe 83 PID 228 wrote to memory of 1776 228 d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032.exe 83 PID 1776 wrote to memory of 1924 1776 lfxfllx.exe 84 PID 1776 wrote to memory of 1924 1776 lfxfllx.exe 84 PID 1776 wrote to memory of 1924 1776 lfxfllx.exe 84 PID 1924 wrote to memory of 3224 1924 bhtbtn.exe 85 PID 1924 wrote to memory of 3224 1924 bhtbtn.exe 85 PID 1924 wrote to memory of 3224 1924 bhtbtn.exe 85 PID 3224 wrote to memory of 5012 3224 vdpdv.exe 86 PID 3224 wrote to memory of 5012 3224 vdpdv.exe 86 PID 3224 wrote to memory of 5012 3224 vdpdv.exe 86 PID 5012 wrote to memory of 3648 5012 xflfrrl.exe 87 PID 5012 wrote to memory of 3648 5012 xflfrrl.exe 87 PID 5012 wrote to memory of 3648 5012 xflfrrl.exe 87 PID 3648 wrote to memory of 2008 3648 xrffxrf.exe 88 PID 3648 wrote to memory of 2008 3648 xrffxrf.exe 88 PID 3648 wrote to memory of 2008 3648 xrffxrf.exe 88 PID 2008 wrote to memory of 3628 2008 nbhbhb.exe 89 PID 2008 wrote to memory of 3628 2008 nbhbhb.exe 89 PID 2008 wrote to memory of 3628 2008 nbhbhb.exe 89 PID 3628 wrote to memory of 4260 3628 dpvpj.exe 90 PID 3628 wrote to memory of 4260 3628 dpvpj.exe 90 PID 3628 wrote to memory of 4260 3628 dpvpj.exe 90 PID 4260 wrote to memory of 2416 4260 xxxxxff.exe 91 PID 4260 wrote to memory of 2416 4260 xxxxxff.exe 91 PID 4260 wrote to memory of 2416 4260 xxxxxff.exe 91 PID 2416 wrote to memory of 2592 2416 ffrrrxr.exe 92 PID 2416 wrote to memory of 2592 2416 ffrrrxr.exe 92 PID 2416 wrote to memory of 2592 2416 ffrrrxr.exe 92 PID 2592 wrote to memory of 4944 2592 fxffflr.exe 93 PID 2592 wrote to memory of 4944 2592 fxffflr.exe 93 PID 2592 wrote to memory of 4944 2592 fxffflr.exe 93 PID 4944 wrote to memory of 548 4944 hbtbht.exe 94 PID 4944 wrote to memory of 548 4944 hbtbht.exe 94 PID 4944 wrote to memory of 548 4944 hbtbht.exe 94 PID 548 wrote to memory of 1188 548 dvddv.exe 95 PID 548 wrote to memory of 1188 548 dvddv.exe 95 PID 548 wrote to memory of 1188 548 dvddv.exe 95 PID 1188 wrote to memory of 2532 1188 ppdvv.exe 96 PID 1188 wrote to memory of 2532 1188 ppdvv.exe 96 PID 1188 wrote to memory of 2532 1188 ppdvv.exe 96 PID 2532 wrote to memory of 4772 2532 rlfffff.exe 97 PID 2532 wrote to memory of 4772 2532 rlfffff.exe 97 PID 2532 wrote to memory of 4772 2532 rlfffff.exe 97 PID 4772 wrote to memory of 3012 4772 5bhhnt.exe 98 PID 4772 wrote to memory of 3012 4772 5bhhnt.exe 98 PID 4772 wrote to memory of 3012 4772 5bhhnt.exe 98 PID 3012 wrote to memory of 512 3012 bthhbh.exe 99 PID 3012 wrote to memory of 512 3012 bthhbh.exe 99 PID 3012 wrote to memory of 512 3012 bthhbh.exe 99 PID 512 wrote to memory of 2024 512 dvpjp.exe 100 PID 512 wrote to memory of 2024 512 dvpjp.exe 100 PID 512 wrote to memory of 2024 512 dvpjp.exe 100 PID 2024 wrote to memory of 4920 2024 frfxxxx.exe 101 PID 2024 wrote to memory of 4920 2024 frfxxxx.exe 101 PID 2024 wrote to memory of 4920 2024 frfxxxx.exe 101 PID 4920 wrote to memory of 4324 4920 nnbbbh.exe 102 PID 4920 wrote to memory of 4324 4920 nnbbbh.exe 102 PID 4920 wrote to memory of 4324 4920 nnbbbh.exe 102 PID 4324 wrote to memory of 3256 4324 nnbnhh.exe 103 PID 4324 wrote to memory of 3256 4324 nnbnhh.exe 103 PID 4324 wrote to memory of 3256 4324 nnbnhh.exe 103 PID 3256 wrote to memory of 3324 3256 jdvvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032.exe"C:\Users\Admin\AppData\Local\Temp\d93aa9ab5622ce245bfe421c2cbe8409d202b6b56918cb8e808332a9290b6032.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\lfxfllx.exec:\lfxfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\bhtbtn.exec:\bhtbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\vdpdv.exec:\vdpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\xflfrrl.exec:\xflfrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xrffxrf.exec:\xrffxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\nbhbhb.exec:\nbhbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\dpvpj.exec:\dpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\xxxxxff.exec:\xxxxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\ffrrrxr.exec:\ffrrrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\fxffflr.exec:\fxffflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hbtbht.exec:\hbtbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\dvddv.exec:\dvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ppdvv.exec:\ppdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\rlfffff.exec:\rlfffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\5bhhnt.exec:\5bhhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\bthhbh.exec:\bthhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\dvpjp.exec:\dvpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\frfxxxx.exec:\frfxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\nnbbbh.exec:\nnbbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\nnbnhh.exec:\nnbnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\jdvvv.exec:\jdvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\5rxlffx.exec:\5rxlffx.exe23⤵
- Executes dropped EXE
PID:3324 -
\??\c:\bbtttt.exec:\bbtttt.exe24⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nhnhbh.exec:\nhnhbh.exe25⤵
- Executes dropped EXE
PID:4812 -
\??\c:\dvvpj.exec:\dvvpj.exe26⤵
- Executes dropped EXE
PID:1604 -
\??\c:\fxxrllf.exec:\fxxrllf.exe27⤵
- Executes dropped EXE
PID:964 -
\??\c:\tnhbtn.exec:\tnhbtn.exe28⤵
- Executes dropped EXE
PID:4132 -
\??\c:\9vdvp.exec:\9vdvp.exe29⤵
- Executes dropped EXE
PID:3276 -
\??\c:\pddvj.exec:\pddvj.exe30⤵
- Executes dropped EXE
PID:3096 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe31⤵
- Executes dropped EXE
PID:3688 -
\??\c:\tnnbtt.exec:\tnnbtt.exe32⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ppvvv.exec:\ppvvv.exe33⤵
- Executes dropped EXE
PID:4456 -
\??\c:\3fxrffx.exec:\3fxrffx.exe34⤵
- Executes dropped EXE
PID:784 -
\??\c:\5htthh.exec:\5htthh.exe35⤵
- Executes dropped EXE
PID:688 -
\??\c:\pdvpj.exec:\pdvpj.exe36⤵
- Executes dropped EXE
PID:3600 -
\??\c:\jdvdv.exec:\jdvdv.exe37⤵
- Executes dropped EXE
PID:3268 -
\??\c:\5vjdj.exec:\5vjdj.exe38⤵
- Executes dropped EXE
PID:408 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe39⤵
- Executes dropped EXE
PID:4296 -
\??\c:\hhbthh.exec:\hhbthh.exe40⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nbhbnn.exec:\nbhbnn.exe41⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jppjv.exec:\jppjv.exe42⤵
- Executes dropped EXE
PID:4732 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe43⤵
- Executes dropped EXE
PID:1380 -
\??\c:\thtttt.exec:\thtttt.exe44⤵
- Executes dropped EXE
PID:1056 -
\??\c:\btnhbb.exec:\btnhbb.exe45⤵
- Executes dropped EXE
PID:4552 -
\??\c:\jjdvv.exec:\jjdvv.exe46⤵
- Executes dropped EXE
PID:4004 -
\??\c:\jddjd.exec:\jddjd.exe47⤵
- Executes dropped EXE
PID:3304 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe48⤵
- Executes dropped EXE
PID:3612 -
\??\c:\bbhbtt.exec:\bbhbtt.exe49⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3nttnn.exec:\3nttnn.exe50⤵
- Executes dropped EXE
PID:4260 -
\??\c:\vvvpd.exec:\vvvpd.exe51⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vjdvj.exec:\vjdvj.exe52⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xxfrrrf.exec:\xxfrrrf.exe53⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fxffxff.exec:\fxffxff.exe54⤵
- Executes dropped EXE
PID:4944 -
\??\c:\3hhbhb.exec:\3hhbhb.exe55⤵
- Executes dropped EXE
PID:3184 -
\??\c:\pjjdd.exec:\pjjdd.exe56⤵
- Executes dropped EXE
PID:3580 -
\??\c:\ppvpd.exec:\ppvpd.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\frxrlll.exec:\frxrlll.exe59⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bbnhhb.exec:\bbnhhb.exe60⤵
- Executes dropped EXE
PID:4720 -
\??\c:\3bhbbh.exec:\3bhbbh.exe61⤵
- Executes dropped EXE
PID:660 -
\??\c:\5jjdv.exec:\5jjdv.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vvvpd.exec:\vvvpd.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ffffxxr.exec:\ffffxxr.exe64⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrllfff.exec:\xrllfff.exe65⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ntnnnb.exec:\ntnnnb.exe66⤵PID:2480
-
\??\c:\nnbnnn.exec:\nnbnnn.exe67⤵PID:2748
-
\??\c:\pddvp.exec:\pddvp.exe68⤵PID:5116
-
\??\c:\jdvjd.exec:\jdvjd.exe69⤵PID:4928
-
\??\c:\vjdvj.exec:\vjdvj.exe70⤵PID:5080
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe71⤵PID:2848
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe72⤵PID:4884
-
\??\c:\bnbbbb.exec:\bnbbbb.exe73⤵PID:3172
-
\??\c:\vpddd.exec:\vpddd.exe74⤵PID:964
-
\??\c:\lllxllf.exec:\lllxllf.exe75⤵PID:4140
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe76⤵PID:2872
-
\??\c:\ttbtnn.exec:\ttbtnn.exe77⤵PID:3144
-
\??\c:\pddvv.exec:\pddvv.exe78⤵PID:3096
-
\??\c:\djppd.exec:\djppd.exe79⤵PID:1708
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe80⤵PID:4424
-
\??\c:\1xxxrlf.exec:\1xxxrlf.exe81⤵PID:404
-
\??\c:\tbbtnt.exec:\tbbtnt.exe82⤵PID:1524
-
\??\c:\jvvpd.exec:\jvvpd.exe83⤵PID:3984
-
\??\c:\pjjdj.exec:\pjjdj.exe84⤵PID:2064
-
\??\c:\5lllxxr.exec:\5lllxxr.exe85⤵PID:1984
-
\??\c:\thhbbb.exec:\thhbbb.exe86⤵PID:2044
-
\??\c:\hbnhbb.exec:\hbnhbb.exe87⤵PID:4568
-
\??\c:\ntnhtt.exec:\ntnhtt.exe88⤵PID:1376
-
\??\c:\pjddv.exec:\pjddv.exe89⤵PID:4952
-
\??\c:\vdjdp.exec:\vdjdp.exe90⤵PID:2792
-
\??\c:\ffxrffx.exec:\ffxrffx.exe91⤵PID:3108
-
\??\c:\htttnn.exec:\htttnn.exe92⤵PID:4996
-
\??\c:\hbhhnb.exec:\hbhhnb.exe93⤵PID:5012
-
\??\c:\9vpjd.exec:\9vpjd.exe94⤵PID:4552
-
\??\c:\dvdvv.exec:\dvdvv.exe95⤵PID:4004
-
\??\c:\xffrlfx.exec:\xffrlfx.exe96⤵PID:3304
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe97⤵PID:3612
-
\??\c:\9hhhtn.exec:\9hhhtn.exe98⤵PID:1040
-
\??\c:\3ttbnb.exec:\3ttbnb.exe99⤵PID:4752
-
\??\c:\pjpjd.exec:\pjpjd.exe100⤵PID:1852
-
\??\c:\3flfxxx.exec:\3flfxxx.exe101⤵PID:4020
-
\??\c:\rlflrrr.exec:\rlflrrr.exe102⤵PID:1264
-
\??\c:\3ttnhh.exec:\3ttnhh.exe103⤵PID:4944
-
\??\c:\nbhbtt.exec:\nbhbtt.exe104⤵PID:3184
-
\??\c:\vvvpj.exec:\vvvpj.exe105⤵PID:4712
-
\??\c:\pjjdv.exec:\pjjdv.exe106⤵PID:1652
-
\??\c:\xflfrrf.exec:\xflfrrf.exe107⤵PID:2432
-
\??\c:\xfllfff.exec:\xfllfff.exe108⤵PID:3152
-
\??\c:\bhhhbt.exec:\bhhhbt.exe109⤵PID:1676
-
\??\c:\bhhbbt.exec:\bhhbbt.exe110⤵PID:512
-
\??\c:\pjpjj.exec:\pjpjj.exe111⤵PID:3068
-
\??\c:\pvdjj.exec:\pvdjj.exe112⤵PID:1772
-
\??\c:\xlfxrll.exec:\xlfxrll.exe113⤵PID:1912
-
\??\c:\xxrrffx.exec:\xxrrffx.exe114⤵PID:3056
-
\??\c:\hhbbbb.exec:\hhbbbb.exe115⤵PID:2136
-
\??\c:\5ttthn.exec:\5ttthn.exe116⤵PID:2748
-
\??\c:\5pjdp.exec:\5pjdp.exe117⤵PID:1384
-
\??\c:\vpjdp.exec:\vpjdp.exe118⤵PID:1232
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe119⤵PID:1792
-
\??\c:\lllfxll.exec:\lllfxll.exe120⤵PID:3316
-
\??\c:\3ttntn.exec:\3ttntn.exe121⤵PID:3148
-
\??\c:\tbbbnn.exec:\tbbbnn.exe122⤵PID:5088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-