Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e.exe
-
Size
63KB
-
MD5
a94a65d6fd20b4f3f43f3d3e2c34dd8c
-
SHA1
84eb73eef1f3dcf289adf8212e5c6db8e3fa6e3c
-
SHA256
22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e
-
SHA512
991f552a226be9c2bef9681104483c744f2036a52c4023eb061f3dbf2cfea044a410b637bfe2fc585366a6d2177022af9f619f5458d3aff32cee1851145be802
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDw5:ymb3NkkiQ3mdBjFIkU
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-51-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/220-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4788-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3240-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/768-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3092-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2160-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/216-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4396-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/428-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4316-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/744-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2324-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1916-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2472-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/928-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4328-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3780-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3820-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3620-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 220 pjvpd.exe 2148 5ffrlfx.exe 2204 hntnbb.exe 3240 bttnnn.exe 4788 pdppj.exe 2572 ppdvp.exe 5060 frfxrrr.exe 768 5hthhh.exe 3092 bhbttn.exe 1512 ppjvj.exe 4508 pjpdv.exe 2240 7lrxlrl.exe 2160 xrfxrrx.exe 216 nbbnhb.exe 4396 pdjvj.exe 2044 1jpjp.exe 428 llxrffl.exe 4316 9nnbth.exe 744 1pdpv.exe 2324 jjvpp.exe 1916 lxxrrll.exe 4016 ttnhbh.exe 4692 hthbtn.exe 4052 9ppjv.exe 2472 vdvpd.exe 928 rflxfxf.exe 4328 thtbtt.exe 5036 dvvpj.exe 3780 jddvj.exe 3820 frxrlff.exe 3620 thhbbt.exe 4028 hbhtbt.exe 2164 vpdvj.exe 1348 1pjdp.exe 4196 lxlfrrl.exe 4180 9ffrlll.exe 768 7lffxrl.exe 3424 7bbttn.exe 4108 nhtnbb.exe 2784 pddvp.exe 5044 dpvjp.exe 2240 1xlxfxx.exe 4624 rrllrrx.exe 1220 bnnhbb.exe 4608 5hhbbb.exe 4716 dpdvp.exe 4520 jpvjp.exe 804 xrrlfxx.exe 3144 9lrlrlr.exe 4928 3flxrrf.exe 2156 thbbtn.exe 1896 btbhnn.exe 2004 vjvvj.exe 5116 jddvv.exe 4016 dvjdj.exe 1016 fxxrrrl.exe 2264 1rxxxrf.exe 2684 hnhbtn.exe 1108 hbbthh.exe 232 jvdvj.exe 4200 jjdvj.exe 2824 xrlfxfx.exe 4552 9fxrffx.exe 1592 5rxxrrf.exe -
resource yara_rule behavioral2/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 220 3036 22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e.exe 89 PID 3036 wrote to memory of 220 3036 22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e.exe 89 PID 3036 wrote to memory of 220 3036 22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e.exe 89 PID 220 wrote to memory of 2148 220 pjvpd.exe 90 PID 220 wrote to memory of 2148 220 pjvpd.exe 90 PID 220 wrote to memory of 2148 220 pjvpd.exe 90 PID 2148 wrote to memory of 2204 2148 5ffrlfx.exe 91 PID 2148 wrote to memory of 2204 2148 5ffrlfx.exe 91 PID 2148 wrote to memory of 2204 2148 5ffrlfx.exe 91 PID 2204 wrote to memory of 3240 2204 hntnbb.exe 92 PID 2204 wrote to memory of 3240 2204 hntnbb.exe 92 PID 2204 wrote to memory of 3240 2204 hntnbb.exe 92 PID 3240 wrote to memory of 4788 3240 bttnnn.exe 93 PID 3240 wrote to memory of 4788 3240 bttnnn.exe 93 PID 3240 wrote to memory of 4788 3240 bttnnn.exe 93 PID 4788 wrote to memory of 2572 4788 pdppj.exe 94 PID 4788 wrote to memory of 2572 4788 pdppj.exe 94 PID 4788 wrote to memory of 2572 4788 pdppj.exe 94 PID 2572 wrote to memory of 5060 2572 ppdvp.exe 95 PID 2572 wrote to memory of 5060 2572 ppdvp.exe 95 PID 2572 wrote to memory of 5060 2572 ppdvp.exe 95 PID 5060 wrote to memory of 768 5060 frfxrrr.exe 96 PID 5060 wrote to memory of 768 5060 frfxrrr.exe 96 PID 5060 wrote to memory of 768 5060 frfxrrr.exe 96 PID 768 wrote to memory of 3092 768 5hthhh.exe 97 PID 768 wrote to memory of 3092 768 5hthhh.exe 97 PID 768 wrote to memory of 3092 768 5hthhh.exe 97 PID 3092 wrote to memory of 1512 3092 bhbttn.exe 98 PID 3092 wrote to memory of 1512 3092 bhbttn.exe 98 PID 3092 wrote to memory of 1512 3092 bhbttn.exe 98 PID 1512 wrote to memory of 4508 1512 ppjvj.exe 99 PID 1512 wrote to memory of 4508 1512 ppjvj.exe 99 PID 1512 wrote to memory of 4508 1512 ppjvj.exe 99 PID 4508 wrote to memory of 2240 4508 pjpdv.exe 101 PID 4508 wrote to memory of 2240 4508 pjpdv.exe 101 PID 4508 wrote to memory of 2240 4508 pjpdv.exe 101 PID 2240 wrote to memory of 2160 2240 7lrxlrl.exe 102 PID 2240 wrote to memory of 2160 2240 7lrxlrl.exe 102 PID 2240 wrote to memory of 2160 2240 7lrxlrl.exe 102 PID 2160 wrote to memory of 216 2160 xrfxrrx.exe 103 PID 2160 wrote to memory of 216 2160 xrfxrrx.exe 103 PID 2160 wrote to memory of 216 2160 xrfxrrx.exe 103 PID 216 wrote to memory of 4396 216 nbbnhb.exe 104 PID 216 wrote to memory of 4396 216 nbbnhb.exe 104 PID 216 wrote to memory of 4396 216 nbbnhb.exe 104 PID 4396 wrote to memory of 2044 4396 pdjvj.exe 105 PID 4396 wrote to memory of 2044 4396 pdjvj.exe 105 PID 4396 wrote to memory of 2044 4396 pdjvj.exe 105 PID 2044 wrote to memory of 428 2044 1jpjp.exe 106 PID 2044 wrote to memory of 428 2044 1jpjp.exe 106 PID 2044 wrote to memory of 428 2044 1jpjp.exe 106 PID 428 wrote to memory of 4316 428 llxrffl.exe 107 PID 428 wrote to memory of 4316 428 llxrffl.exe 107 PID 428 wrote to memory of 4316 428 llxrffl.exe 107 PID 4316 wrote to memory of 744 4316 9nnbth.exe 108 PID 4316 wrote to memory of 744 4316 9nnbth.exe 108 PID 4316 wrote to memory of 744 4316 9nnbth.exe 108 PID 744 wrote to memory of 2324 744 1pdpv.exe 110 PID 744 wrote to memory of 2324 744 1pdpv.exe 110 PID 744 wrote to memory of 2324 744 1pdpv.exe 110 PID 2324 wrote to memory of 1916 2324 jjvpp.exe 111 PID 2324 wrote to memory of 1916 2324 jjvpp.exe 111 PID 2324 wrote to memory of 1916 2324 jjvpp.exe 111 PID 1916 wrote to memory of 4016 1916 lxxrrll.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e.exe"C:\Users\Admin\AppData\Local\Temp\22c7d6a1bdb7926b7f84db21df8b8386faa52eb8126ac9d7a00945fe5e61079e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\pjvpd.exec:\pjvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\5ffrlfx.exec:\5ffrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hntnbb.exec:\hntnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\bttnnn.exec:\bttnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\pdppj.exec:\pdppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\ppdvp.exec:\ppdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\frfxrrr.exec:\frfxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\5hthhh.exec:\5hthhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\bhbttn.exec:\bhbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\ppjvj.exec:\ppjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\pjpdv.exec:\pjpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\7lrxlrl.exec:\7lrxlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\xrfxrrx.exec:\xrfxrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\nbbnhb.exec:\nbbnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\pdjvj.exec:\pdjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\1jpjp.exec:\1jpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\llxrffl.exec:\llxrffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\9nnbth.exec:\9nnbth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\1pdpv.exec:\1pdpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\jjvpp.exec:\jjvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lxxrrll.exec:\lxxrrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\ttnhbh.exec:\ttnhbh.exe23⤵
- Executes dropped EXE
PID:4016 -
\??\c:\hthbtn.exec:\hthbtn.exe24⤵
- Executes dropped EXE
PID:4692 -
\??\c:\9ppjv.exec:\9ppjv.exe25⤵
- Executes dropped EXE
PID:4052 -
\??\c:\vdvpd.exec:\vdvpd.exe26⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rflxfxf.exec:\rflxfxf.exe27⤵
- Executes dropped EXE
PID:928 -
\??\c:\thtbtt.exec:\thtbtt.exe28⤵
- Executes dropped EXE
PID:4328 -
\??\c:\dvvpj.exec:\dvvpj.exe29⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jddvj.exec:\jddvj.exe30⤵
- Executes dropped EXE
PID:3780 -
\??\c:\frxrlff.exec:\frxrlff.exe31⤵
- Executes dropped EXE
PID:3820 -
\??\c:\thhbbt.exec:\thhbbt.exe32⤵
- Executes dropped EXE
PID:3620 -
\??\c:\hbhtbt.exec:\hbhtbt.exe33⤵
- Executes dropped EXE
PID:4028 -
\??\c:\vpdvj.exec:\vpdvj.exe34⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1pjdp.exec:\1pjdp.exe35⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe36⤵
- Executes dropped EXE
PID:4196 -
\??\c:\9ffrlll.exec:\9ffrlll.exe37⤵
- Executes dropped EXE
PID:4180 -
\??\c:\7lffxrl.exec:\7lffxrl.exe38⤵
- Executes dropped EXE
PID:768 -
\??\c:\7bbttn.exec:\7bbttn.exe39⤵
- Executes dropped EXE
PID:3424 -
\??\c:\nhtnbb.exec:\nhtnbb.exe40⤵
- Executes dropped EXE
PID:4108 -
\??\c:\pddvp.exec:\pddvp.exe41⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dpvjp.exec:\dpvjp.exe42⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1xlxfxx.exec:\1xlxfxx.exe43⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rrllrrx.exec:\rrllrrx.exe44⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bnnhbb.exec:\bnnhbb.exe45⤵
- Executes dropped EXE
PID:1220 -
\??\c:\5hhbbb.exec:\5hhbbb.exe46⤵
- Executes dropped EXE
PID:4608 -
\??\c:\dpdvp.exec:\dpdvp.exe47⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jpvjp.exec:\jpvjp.exe48⤵
- Executes dropped EXE
PID:4520 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe49⤵
- Executes dropped EXE
PID:804 -
\??\c:\9lrlrlr.exec:\9lrlrlr.exe50⤵
- Executes dropped EXE
PID:3144 -
\??\c:\3flxrrf.exec:\3flxrrf.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\thbbtn.exec:\thbbtn.exe52⤵
- Executes dropped EXE
PID:2156 -
\??\c:\btbhnn.exec:\btbhnn.exe53⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vjvvj.exec:\vjvvj.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jddvv.exec:\jddvv.exe55⤵
- Executes dropped EXE
PID:5116 -
\??\c:\dvjdj.exec:\dvjdj.exe56⤵
- Executes dropped EXE
PID:4016 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe57⤵
- Executes dropped EXE
PID:1016 -
\??\c:\1rxxxrf.exec:\1rxxxrf.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hnhbtn.exec:\hnhbtn.exe59⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hbbthh.exec:\hbbthh.exe60⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jvdvj.exec:\jvdvj.exe61⤵
- Executes dropped EXE
PID:232 -
\??\c:\jjdvj.exec:\jjdvj.exe62⤵
- Executes dropped EXE
PID:4200 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe63⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9fxrffx.exec:\9fxrffx.exe64⤵
- Executes dropped EXE
PID:4552 -
\??\c:\5rxxrrf.exec:\5rxxrrf.exe65⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nbtnbn.exec:\nbtnbn.exe66⤵PID:4988
-
\??\c:\bbnhth.exec:\bbnhth.exe67⤵PID:2996
-
\??\c:\jpvpj.exec:\jpvpj.exe68⤵PID:4452
-
\??\c:\djpjv.exec:\djpjv.exe69⤵PID:2544
-
\??\c:\flfxrlf.exec:\flfxrlf.exe70⤵PID:936
-
\??\c:\3ttnhn.exec:\3ttnhn.exe71⤵PID:212
-
\??\c:\hhbbhh.exec:\hhbbhh.exe72⤵PID:4924
-
\??\c:\vppvp.exec:\vppvp.exe73⤵PID:2552
-
\??\c:\vvdjd.exec:\vvdjd.exe74⤵PID:1104
-
\??\c:\llllfff.exec:\llllfff.exe75⤵PID:4228
-
\??\c:\fxflfrr.exec:\fxflfrr.exe76⤵PID:4068
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe77⤵PID:4140
-
\??\c:\hnnbbt.exec:\hnnbbt.exe78⤵PID:1196
-
\??\c:\djvpj.exec:\djvpj.exe79⤵PID:2540
-
\??\c:\5jddp.exec:\5jddp.exe80⤵PID:3536
-
\??\c:\rrllffx.exec:\rrllffx.exe81⤵PID:3708
-
\??\c:\ntbtnn.exec:\ntbtnn.exe82⤵PID:4728
-
\??\c:\nhttnn.exec:\nhttnn.exe83⤵PID:1124
-
\??\c:\jdvvv.exec:\jdvvv.exe84⤵PID:3564
-
\??\c:\vjvpd.exec:\vjvpd.exe85⤵PID:3348
-
\??\c:\jdddv.exec:\jdddv.exe86⤵PID:2852
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe87⤵PID:2376
-
\??\c:\7xffxxx.exec:\7xffxxx.exe88⤵PID:1568
-
\??\c:\nbbbtn.exec:\nbbbtn.exe89⤵PID:1736
-
\??\c:\hhhhhn.exec:\hhhhhn.exe90⤵PID:4240
-
\??\c:\dpvjd.exec:\dpvjd.exe91⤵PID:1444
-
\??\c:\fffxrll.exec:\fffxrll.exe92⤵PID:5052
-
\??\c:\7llllll.exec:\7llllll.exe93⤵PID:3264
-
\??\c:\nbhhbb.exec:\nbhhbb.exe94⤵PID:3928
-
\??\c:\tntnnn.exec:\tntnnn.exe95⤵PID:2284
-
\??\c:\dpvpj.exec:\dpvpj.exe96⤵PID:860
-
\??\c:\vdpjd.exec:\vdpjd.exe97⤵PID:3140
-
\??\c:\ffffrrr.exec:\ffffrrr.exe98⤵PID:2396
-
\??\c:\9xxxxxx.exec:\9xxxxxx.exe99⤵PID:4144
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe100⤵PID:4404
-
\??\c:\hhntbb.exec:\hhntbb.exe101⤵PID:1724
-
\??\c:\3ttttt.exec:\3ttttt.exe102⤵PID:4456
-
\??\c:\pjvpp.exec:\pjvpp.exe103⤵PID:2588
-
\??\c:\pjjjd.exec:\pjjjd.exe104⤵PID:3816
-
\??\c:\rlxxllr.exec:\rlxxllr.exe105⤵PID:3228
-
\??\c:\1xfrlxr.exec:\1xfrlxr.exe106⤵PID:5048
-
\??\c:\btnnhh.exec:\btnnhh.exe107⤵PID:2164
-
\??\c:\nnbbnn.exec:\nnbbnn.exe108⤵PID:2320
-
\??\c:\1vdvj.exec:\1vdvj.exe109⤵PID:5060
-
\??\c:\dvpjd.exec:\dvpjd.exe110⤵PID:2408
-
\??\c:\rfffxxr.exec:\rfffxxr.exe111⤵PID:4956
-
\??\c:\3xfxrxr.exec:\3xfxrxr.exe112⤵PID:3972
-
\??\c:\bttttt.exec:\bttttt.exe113⤵PID:3424
-
\??\c:\tnnbtn.exec:\tnnbtn.exe114⤵PID:2952
-
\??\c:\vjppj.exec:\vjppj.exe115⤵PID:444
-
\??\c:\dvdvd.exec:\dvdvd.exe116⤵PID:3860
-
\??\c:\xfffxxx.exec:\xfffxxx.exe117⤵PID:4624
-
\??\c:\xxrrlll.exec:\xxrrlll.exe118⤵PID:1220
-
\??\c:\bttttt.exec:\bttttt.exe119⤵PID:2832
-
\??\c:\9tnnhh.exec:\9tnnhh.exe120⤵PID:3268
-
\??\c:\jddvp.exec:\jddvp.exe121⤵PID:2172
-
\??\c:\jddvp.exec:\jddvp.exe122⤵PID:380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-