Analysis
-
max time kernel
79s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b.exe
-
Size
56KB
-
MD5
e6e289d7da43b219357e6b84f76f2502
-
SHA1
a48dab30d929ccb20c41dfe7ae4b11d984c0d51e
-
SHA256
60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b
-
SHA512
5d1b458484d321a4d70d26a3358c336079c2748bfe08b7dd90189025a379724b81ee1695c0f26cd7cb8c881bd15ee86224b96bfcc35944d2df70d9e52e717625
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chV/5:ymb3NkkiQ3mdBjF0crR
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3372-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/616-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-57-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 35 IoCs
resource yara_rule behavioral2/memory/3372-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3372-9-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/616-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3196-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4932-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4436-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2100-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4788-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1456-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/856-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3612-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1500-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4828-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4696-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2304-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1144-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4484-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2464-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1524-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4172-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4172-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4172-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4172-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1136-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5016-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1960-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1960-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1960-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1732 pddvv.exe 1960 jdvpj.exe 5016 rrlfxxf.exe 1136 fxfxrrl.exe 4172 hbbbbb.exe 1524 htnnnn.exe 2464 jjjdd.exe 4484 dvvpj.exe 1144 5lrrlxx.exe 5044 lffffff.exe 2304 nhhnnn.exe 1752 dpdvj.exe 4696 vvvpv.exe 1448 7jjjd.exe 4828 7rxxlll.exe 1500 rflffll.exe 3612 tnhnhn.exe 856 bhhhtb.exe 1456 3jpjd.exe 616 jjjjd.exe 4788 rrrrlll.exe 4092 1xxxxll.exe 2384 nhtnhh.exe 2100 7ppjd.exe 4436 fxfffff.exe 4508 xrlrlrr.exe 2568 hbbtnt.exe 2744 nhnhhh.exe 5056 3jvdv.exe 4932 3vvpj.exe 3196 lllfrxx.exe 2440 xlllrrl.exe 1496 9thhbb.exe 1156 nhnhbb.exe 2212 jvddd.exe 4432 vpvvp.exe 700 xlxrrxx.exe 2216 lxxxxxx.exe 3988 hbhbnn.exe 4800 3nhhbb.exe 3040 9jpjv.exe 1196 7pjdv.exe 3648 pvvjd.exe 1720 rfrlfff.exe 2464 rrffffl.exe 2676 nbbnhh.exe 1152 tnnhbb.exe 3288 7dddv.exe 1988 ddddd.exe 384 ffrllrr.exe 4072 7xxxrrl.exe 3376 flfrrxl.exe 408 bhntth.exe 5072 htnnbh.exe 460 vvjdv.exe 1452 jjjjj.exe 3548 xxfxrrr.exe 848 rlfxrfx.exe 3180 nhhbtt.exe 920 nthnhn.exe 776 jjjdv.exe 2696 jpdpp.exe 4184 rllrlxx.exe 2156 rlffxff.exe -
resource yara_rule behavioral2/memory/3372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-12-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 1732 3372 60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b.exe 83 PID 3372 wrote to memory of 1732 3372 60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b.exe 83 PID 3372 wrote to memory of 1732 3372 60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b.exe 83 PID 1732 wrote to memory of 1960 1732 pddvv.exe 84 PID 1732 wrote to memory of 1960 1732 pddvv.exe 84 PID 1732 wrote to memory of 1960 1732 pddvv.exe 84 PID 1960 wrote to memory of 5016 1960 jdvpj.exe 85 PID 1960 wrote to memory of 5016 1960 jdvpj.exe 85 PID 1960 wrote to memory of 5016 1960 jdvpj.exe 85 PID 5016 wrote to memory of 1136 5016 rrlfxxf.exe 86 PID 5016 wrote to memory of 1136 5016 rrlfxxf.exe 86 PID 5016 wrote to memory of 1136 5016 rrlfxxf.exe 86 PID 1136 wrote to memory of 4172 1136 fxfxrrl.exe 87 PID 1136 wrote to memory of 4172 1136 fxfxrrl.exe 87 PID 1136 wrote to memory of 4172 1136 fxfxrrl.exe 87 PID 4172 wrote to memory of 1524 4172 hbbbbb.exe 88 PID 4172 wrote to memory of 1524 4172 hbbbbb.exe 88 PID 4172 wrote to memory of 1524 4172 hbbbbb.exe 88 PID 1524 wrote to memory of 2464 1524 htnnnn.exe 89 PID 1524 wrote to memory of 2464 1524 htnnnn.exe 89 PID 1524 wrote to memory of 2464 1524 htnnnn.exe 89 PID 2464 wrote to memory of 4484 2464 jjjdd.exe 90 PID 2464 wrote to memory of 4484 2464 jjjdd.exe 90 PID 2464 wrote to memory of 4484 2464 jjjdd.exe 90 PID 4484 wrote to memory of 1144 4484 dvvpj.exe 91 PID 4484 wrote to memory of 1144 4484 dvvpj.exe 91 PID 4484 wrote to memory of 1144 4484 dvvpj.exe 91 PID 1144 wrote to memory of 5044 1144 5lrrlxx.exe 92 PID 1144 wrote to memory of 5044 1144 5lrrlxx.exe 92 PID 1144 wrote to memory of 5044 1144 5lrrlxx.exe 92 PID 5044 wrote to memory of 2304 5044 lffffff.exe 93 PID 5044 wrote to memory of 2304 5044 lffffff.exe 93 PID 5044 wrote to memory of 2304 5044 lffffff.exe 93 PID 2304 wrote to memory of 1752 2304 nhhnnn.exe 94 PID 2304 wrote to memory of 1752 2304 nhhnnn.exe 94 PID 2304 wrote to memory of 1752 2304 nhhnnn.exe 94 PID 1752 wrote to memory of 4696 1752 dpdvj.exe 95 PID 1752 wrote to memory of 4696 1752 dpdvj.exe 95 PID 1752 wrote to memory of 4696 1752 dpdvj.exe 95 PID 4696 wrote to memory of 1448 4696 vvvpv.exe 344 PID 4696 wrote to memory of 1448 4696 vvvpv.exe 344 PID 4696 wrote to memory of 1448 4696 vvvpv.exe 344 PID 1448 wrote to memory of 4828 1448 7jjjd.exe 97 PID 1448 wrote to memory of 4828 1448 7jjjd.exe 97 PID 1448 wrote to memory of 4828 1448 7jjjd.exe 97 PID 4828 wrote to memory of 1500 4828 7rxxlll.exe 98 PID 4828 wrote to memory of 1500 4828 7rxxlll.exe 98 PID 4828 wrote to memory of 1500 4828 7rxxlll.exe 98 PID 1500 wrote to memory of 3612 1500 rflffll.exe 99 PID 1500 wrote to memory of 3612 1500 rflffll.exe 99 PID 1500 wrote to memory of 3612 1500 rflffll.exe 99 PID 3612 wrote to memory of 856 3612 tnhnhn.exe 101 PID 3612 wrote to memory of 856 3612 tnhnhn.exe 101 PID 3612 wrote to memory of 856 3612 tnhnhn.exe 101 PID 856 wrote to memory of 1456 856 bhhhtb.exe 389 PID 856 wrote to memory of 1456 856 bhhhtb.exe 389 PID 856 wrote to memory of 1456 856 bhhhtb.exe 389 PID 1456 wrote to memory of 616 1456 3jpjd.exe 103 PID 1456 wrote to memory of 616 1456 3jpjd.exe 103 PID 1456 wrote to memory of 616 1456 3jpjd.exe 103 PID 616 wrote to memory of 4788 616 jjjjd.exe 104 PID 616 wrote to memory of 4788 616 jjjjd.exe 104 PID 616 wrote to memory of 4788 616 jjjjd.exe 104 PID 4788 wrote to memory of 4092 4788 rrrrlll.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b.exe"C:\Users\Admin\AppData\Local\Temp\60769ef80ed3561395e20a8a323753a7dddfc1652a2ba38f5ef8baac0113aa4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\pddvv.exec:\pddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jdvpj.exec:\jdvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\hbbbbb.exec:\hbbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\htnnnn.exec:\htnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\jjjdd.exec:\jjjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\dvvpj.exec:\dvvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\5lrrlxx.exec:\5lrrlxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\lffffff.exec:\lffffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\nhhnnn.exec:\nhhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\dpdvj.exec:\dpdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\vvvpv.exec:\vvvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\7jjjd.exec:\7jjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\7rxxlll.exec:\7rxxlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\rflffll.exec:\rflffll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\tnhnhn.exec:\tnhnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\bhhhtb.exec:\bhhhtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\3jpjd.exec:\3jpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\jjjjd.exec:\jjjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\rrrrlll.exec:\rrrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\1xxxxll.exec:\1xxxxll.exe23⤵
- Executes dropped EXE
PID:4092 -
\??\c:\nhtnhh.exec:\nhtnhh.exe24⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7ppjd.exec:\7ppjd.exe25⤵
- Executes dropped EXE
PID:2100 -
\??\c:\fxfffff.exec:\fxfffff.exe26⤵
- Executes dropped EXE
PID:4436 -
\??\c:\xrlrlrr.exec:\xrlrlrr.exe27⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hbbtnt.exec:\hbbtnt.exe28⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhnhhh.exec:\nhnhhh.exe29⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3jvdv.exec:\3jvdv.exe30⤵
- Executes dropped EXE
PID:5056 -
\??\c:\3vvpj.exec:\3vvpj.exe31⤵
- Executes dropped EXE
PID:4932 -
\??\c:\lllfrxx.exec:\lllfrxx.exe32⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xlllrrl.exec:\xlllrrl.exe33⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9thhbb.exec:\9thhbb.exe34⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nhnhbb.exec:\nhnhbb.exe35⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jvddd.exec:\jvddd.exe36⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vpvvp.exec:\vpvvp.exe37⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xlxrrxx.exec:\xlxrrxx.exe38⤵
- Executes dropped EXE
PID:700 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbhbnn.exec:\hbhbnn.exe40⤵
- Executes dropped EXE
PID:3988 -
\??\c:\3nhhbb.exec:\3nhhbb.exe41⤵
- Executes dropped EXE
PID:4800 -
\??\c:\9jpjv.exec:\9jpjv.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7pjdv.exec:\7pjdv.exe43⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pvvjd.exec:\pvvjd.exe44⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rfrlfff.exec:\rfrlfff.exe45⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rrffffl.exec:\rrffffl.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nbbnhh.exec:\nbbnhh.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tnnhbb.exec:\tnnhbb.exe48⤵
- Executes dropped EXE
PID:1152 -
\??\c:\7dddv.exec:\7dddv.exe49⤵
- Executes dropped EXE
PID:3288 -
\??\c:\ddddd.exec:\ddddd.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ffrllrr.exec:\ffrllrr.exe51⤵
- Executes dropped EXE
PID:384 -
\??\c:\7xxxrrl.exec:\7xxxrrl.exe52⤵
- Executes dropped EXE
PID:4072 -
\??\c:\flfrrxl.exec:\flfrrxl.exe53⤵
- Executes dropped EXE
PID:3376 -
\??\c:\bhntth.exec:\bhntth.exe54⤵
- Executes dropped EXE
PID:408 -
\??\c:\htnnbh.exec:\htnnbh.exe55⤵
- Executes dropped EXE
PID:5072 -
\??\c:\vvjdv.exec:\vvjdv.exe56⤵
- Executes dropped EXE
PID:460 -
\??\c:\jjjjj.exec:\jjjjj.exe57⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe58⤵
- Executes dropped EXE
PID:3548 -
\??\c:\rlfxrfx.exec:\rlfxrfx.exe59⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhhbtt.exec:\nhhbtt.exe60⤵
- Executes dropped EXE
PID:3180 -
\??\c:\nthnhn.exec:\nthnhn.exe61⤵
- Executes dropped EXE
PID:920 -
\??\c:\jjjdv.exec:\jjjdv.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\jpdpp.exec:\jpdpp.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rllrlxx.exec:\rllrlxx.exe64⤵
- Executes dropped EXE
PID:4184 -
\??\c:\rlffxff.exec:\rlffxff.exe65⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ffflfxr.exec:\ffflfxr.exe66⤵PID:2576
-
\??\c:\3nbtnn.exec:\3nbtnn.exe67⤵PID:3540
-
\??\c:\bbbbth.exec:\bbbbth.exe68⤵PID:4904
-
\??\c:\pjjdp.exec:\pjjdp.exe69⤵PID:4480
-
\??\c:\9ddvp.exec:\9ddvp.exe70⤵PID:1320
-
\??\c:\5vvpv.exec:\5vvpv.exe71⤵PID:4148
-
\??\c:\xrxxlll.exec:\xrxxlll.exe72⤵PID:2580
-
\??\c:\lfxxrxl.exec:\lfxxrxl.exe73⤵PID:3356
-
\??\c:\nhbbbb.exec:\nhbbbb.exe74⤵PID:4028
-
\??\c:\ttbhnb.exec:\ttbhnb.exe75⤵PID:3980
-
\??\c:\3jppj.exec:\3jppj.exe76⤵PID:4388
-
\??\c:\jpdvp.exec:\jpdvp.exe77⤵PID:2140
-
\??\c:\5jjdv.exec:\5jjdv.exe78⤵PID:1496
-
\??\c:\xffxrxr.exec:\xffxrxr.exe79⤵PID:4064
-
\??\c:\1flfxxr.exec:\1flfxxr.exe80⤵PID:4428
-
\??\c:\rrrllrr.exec:\rrrllrr.exe81⤵PID:3704
-
\??\c:\nhtbhh.exec:\nhtbhh.exe82⤵PID:4680
-
\??\c:\hbhbhh.exec:\hbhbhh.exe83⤵PID:4160
-
\??\c:\dpddv.exec:\dpddv.exe84⤵PID:4460
-
\??\c:\1dvpv.exec:\1dvpv.exe85⤵PID:1960
-
\??\c:\frxlfff.exec:\frxlfff.exe86⤵PID:5016
-
\??\c:\llrrxfl.exec:\llrrxfl.exe87⤵PID:3608
-
\??\c:\5frlrlx.exec:\5frlrlx.exe88⤵PID:4792
-
\??\c:\hntbht.exec:\hntbht.exe89⤵PID:1372
-
\??\c:\bbtttt.exec:\bbtttt.exe90⤵PID:5100
-
\??\c:\jpvpp.exec:\jpvpp.exe91⤵PID:5048
-
\??\c:\djjdv.exec:\djjdv.exe92⤵PID:3036
-
\??\c:\pjpvj.exec:\pjpvj.exe93⤵PID:2996
-
\??\c:\5lrlxfx.exec:\5lrlxfx.exe94⤵PID:5044
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe95⤵PID:1384
-
\??\c:\bnnnhh.exec:\bnnnhh.exe96⤵PID:3716
-
\??\c:\hbtnbh.exec:\hbtnbh.exe97⤵PID:576
-
\??\c:\5tbbhn.exec:\5tbbhn.exe98⤵PID:5088
-
\??\c:\1dppj.exec:\1dppj.exe99⤵PID:3800
-
\??\c:\ddvvv.exec:\ddvvv.exe100⤵PID:2040
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe101⤵PID:460
-
\??\c:\rrfffff.exec:\rrfffff.exe102⤵PID:2056
-
\??\c:\btbtnn.exec:\btbtnn.exe103⤵PID:4920
-
\??\c:\tttnhh.exec:\tttnhh.exe104⤵PID:3180
-
\??\c:\dppjd.exec:\dppjd.exe105⤵PID:4124
-
\??\c:\vjpdv.exec:\vjpdv.exe106⤵PID:4732
-
\??\c:\3nhhhh.exec:\3nhhhh.exe107⤵PID:1164
-
\??\c:\7tbthh.exec:\7tbthh.exe108⤵PID:4328
-
\??\c:\1ppjv.exec:\1ppjv.exe109⤵PID:4640
-
\??\c:\9ddvd.exec:\9ddvd.exe110⤵PID:3976
-
\??\c:\xrxrllf.exec:\xrxrllf.exe111⤵PID:1312
-
\??\c:\fllfxxx.exec:\fllfxxx.exe112⤵PID:2524
-
\??\c:\thhhhh.exec:\thhhhh.exe113⤵PID:912
-
\??\c:\3hhbtt.exec:\3hhbtt.exe114⤵PID:1356
-
\??\c:\bthnhb.exec:\bthnhb.exe115⤵PID:4704
-
\??\c:\jdpdv.exec:\jdpdv.exe116⤵PID:1404
-
\??\c:\3pvdv.exec:\3pvdv.exe117⤵PID:3636
-
\??\c:\3xxxlrl.exec:\3xxxlrl.exe118⤵PID:1528
-
\??\c:\3rrrlrr.exec:\3rrrlrr.exe119⤵PID:1496
-
\??\c:\tttttt.exec:\tttttt.exe120⤵PID:2236
-
\??\c:\hhtttt.exec:\hhtttt.exe121⤵PID:2212
-
\??\c:\nbbtnn.exec:\nbbtnn.exe122⤵PID:4412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-