Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025.exe
- Size 123KB
- Sample240615-ch2evawame
- SHA256 caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025
- MD5 4723505a75e2d33d8e8d4d53739fb4d5
- SHA1 1ba5163af3dfe6c8d41a1e74480fa06cf33c59b3
- SHA512 3010fbf7753769742c66710826bd9b3659368fb1ef4437afbbc0ab2a0a928e957317c51983e3e6d8aea0f74a8ff13e963c2a1d8678669bbaad907c485e6339c2
- SSDEEP 3072:ymb3NkkiQ3mdBjFo7LAIRUohDLSULrCimBaH8UH30w0I:n3C9BRo/AIuunSppaH8m3D/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2656-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-1432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/2656-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/756-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1324-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/756-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/756-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1556-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/436-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3232-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1756-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3300-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5112-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2104-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1628-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4000-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2516-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1316-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2640-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1752-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4500-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/428-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1540-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3752-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4848-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2224-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2828-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-1432-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3136 pdjpp.exe 1324 7rxrrxx.exe 756 hbbtnn.exe 1556 jpvvj.exe 436 ffffrxx.exe 1756 tnhbtt.exe 3068 nbtttt.exe 3232 3vpdp.exe 2468 lxfxrlf.exe 3300 ttbhtn.exe 5112 dvvvv.exe 4024 vvdvv.exe 2104 xlfxlxx.exe 1628 nhhhhb.exe 4000 pddvp.exe 2516 lxflfll.exe 1316 fxxfffx.exe 4772 btbtnn.exe 2820 xxxlffl.exe 4448 llrxxxf.exe 2640 nhhtnt.exe 1116 5jjvp.exe 1752 rrflxxl.exe 4500 nhnbtb.exe 428 thhtth.exe 1540 pjpvv.exe 3752 9rllxxf.exe 4848 tnnhhh.exe 4768 vjdjv.exe 2224 lxfflll.exe 2828 5lxrlll.exe 4980 nhhtnh.exe 3384 1dvpj.exe 4372 ffxrrrx.exe 2684 7pjdj.exe 3576 5rrlxrl.exe 3936 nhnnbh.exe 2340 nttnhb.exe 4432 dvdpp.exe 4564 frlxrrx.exe 5084 bnnhbb.exe 4464 pjvpv.exe 5024 fffffll.exe 1268 tthbtt.exe 756 btnhbt.exe 704 pjpjj.exe 4696 vvdvp.exe 4248 flrlllf.exe 3160 rlxrrrr.exe 3220 bhnhbb.exe 1552 7jppv.exe 4484 pjjdv.exe 1832 lfxxlxr.exe 2596 nhhtnn.exe 2108 vvjdp.exe 1620 jpvpd.exe 4784 rlxlxxl.exe 2744 5lrrrxl.exe 4908 tnhbtt.exe 5036 nhbtnh.exe 2172 vpjdp.exe 4760 pdvpd.exe 3464 fxfrxxr.exe 1764 frfrlxr.exe -
resource yara_rule behavioral2/memory/2656-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-1432-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 3136 2656 caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025.exe 82 PID 2656 wrote to memory of 3136 2656 caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025.exe 82 PID 2656 wrote to memory of 3136 2656 caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025.exe 82 PID 3136 wrote to memory of 1324 3136 pdjpp.exe 83 PID 3136 wrote to memory of 1324 3136 pdjpp.exe 83 PID 3136 wrote to memory of 1324 3136 pdjpp.exe 83 PID 1324 wrote to memory of 756 1324 7rxrrxx.exe 84 PID 1324 wrote to memory of 756 1324 7rxrrxx.exe 84 PID 1324 wrote to memory of 756 1324 7rxrrxx.exe 84 PID 756 wrote to memory of 1556 756 hbbtnn.exe 85 PID 756 wrote to memory of 1556 756 hbbtnn.exe 85 PID 756 wrote to memory of 1556 756 hbbtnn.exe 85 PID 1556 wrote to memory of 436 1556 jpvvj.exe 86 PID 1556 wrote to memory of 436 1556 jpvvj.exe 86 PID 1556 wrote to memory of 436 1556 jpvvj.exe 86 PID 436 wrote to memory of 1756 436 ffffrxx.exe 87 PID 436 wrote to memory of 1756 436 ffffrxx.exe 87 PID 436 wrote to memory of 1756 436 ffffrxx.exe 87 PID 1756 wrote to memory of 3068 1756 tnhbtt.exe 88 PID 1756 wrote to memory of 3068 1756 tnhbtt.exe 88 PID 1756 wrote to memory of 3068 1756 tnhbtt.exe 88 PID 3068 wrote to memory of 3232 3068 nbtttt.exe 89 PID 3068 wrote to memory of 3232 3068 nbtttt.exe 89 PID 3068 wrote to memory of 3232 3068 nbtttt.exe 89 PID 3232 wrote to memory of 2468 3232 3vpdp.exe 90 PID 3232 wrote to memory of 2468 3232 3vpdp.exe 90 PID 3232 wrote to memory of 2468 3232 3vpdp.exe 90 PID 2468 wrote to memory of 3300 2468 lxfxrlf.exe 91 PID 2468 wrote to memory of 3300 2468 lxfxrlf.exe 91 PID 2468 wrote to memory of 3300 2468 lxfxrlf.exe 91 PID 3300 wrote to memory of 5112 3300 ttbhtn.exe 92 PID 3300 wrote to memory of 5112 3300 ttbhtn.exe 92 PID 3300 wrote to memory of 5112 3300 ttbhtn.exe 92 PID 5112 wrote to memory of 4024 5112 dvvvv.exe 93 PID 5112 wrote to memory of 4024 5112 dvvvv.exe 93 PID 5112 wrote to memory of 4024 5112 dvvvv.exe 93 PID 4024 wrote to memory of 2104 4024 vvdvv.exe 94 PID 4024 wrote to memory of 2104 4024 vvdvv.exe 94 PID 4024 wrote to memory of 2104 4024 vvdvv.exe 94 PID 2104 wrote to memory of 1628 2104 xlfxlxx.exe 96 PID 2104 wrote to memory of 1628 2104 xlfxlxx.exe 96 PID 2104 wrote to memory of 1628 2104 xlfxlxx.exe 96 PID 1628 wrote to memory of 4000 1628 nhhhhb.exe 97 PID 1628 wrote to memory of 4000 1628 nhhhhb.exe 97 PID 1628 wrote to memory of 4000 1628 nhhhhb.exe 97 PID 4000 wrote to memory of 2516 4000 pddvp.exe 98 PID 4000 wrote to memory of 2516 4000 pddvp.exe 98 PID 4000 wrote to memory of 2516 4000 pddvp.exe 98 PID 2516 wrote to memory of 1316 2516 lxflfll.exe 99 PID 2516 wrote to memory of 1316 2516 lxflfll.exe 99 PID 2516 wrote to memory of 1316 2516 lxflfll.exe 99 PID 1316 wrote to memory of 4772 1316 fxxfffx.exe 100 PID 1316 wrote to memory of 4772 1316 fxxfffx.exe 100 PID 1316 wrote to memory of 4772 1316 fxxfffx.exe 100 PID 4772 wrote to memory of 2820 4772 btbtnn.exe 101 PID 4772 wrote to memory of 2820 4772 btbtnn.exe 101 PID 4772 wrote to memory of 2820 4772 btbtnn.exe 101 PID 2820 wrote to memory of 4448 2820 xxxlffl.exe 103 PID 2820 wrote to memory of 4448 2820 xxxlffl.exe 103 PID 2820 wrote to memory of 4448 2820 xxxlffl.exe 103 PID 4448 wrote to memory of 2640 4448 llrxxxf.exe 104 PID 4448 wrote to memory of 2640 4448 llrxxxf.exe 104 PID 4448 wrote to memory of 2640 4448 llrxxxf.exe 104 PID 2640 wrote to memory of 1116 2640 nhhtnt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025.exe"C:\Users\Admin\AppData\Local\Temp\caadea97c6ad4fd86b3aa201fcaea30b1b9128f8b697b221aee10a7894489025.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pdjpp.exec:\pdjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\7rxrrxx.exec:\7rxrrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\hbbtnn.exec:\hbbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jpvvj.exec:\jpvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\ffffrxx.exec:\ffffrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\tnhbtt.exec:\tnhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\nbtttt.exec:\nbtttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\3vpdp.exec:\3vpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\ttbhtn.exec:\ttbhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\dvvvv.exec:\dvvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\vvdvv.exec:\vvdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\xlfxlxx.exec:\xlfxlxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\nhhhhb.exec:\nhhhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\pddvp.exec:\pddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\lxflfll.exec:\lxflfll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\fxxfffx.exec:\fxxfffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\btbtnn.exec:\btbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\xxxlffl.exec:\xxxlffl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\llrxxxf.exec:\llrxxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\nhhtnt.exec:\nhhtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5jjvp.exec:\5jjvp.exe23⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rrflxxl.exec:\rrflxxl.exe24⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nhnbtb.exec:\nhnbtb.exe25⤵
- Executes dropped EXE
PID:4500 -
\??\c:\thhtth.exec:\thhtth.exe26⤵
- Executes dropped EXE
PID:428 -
\??\c:\pjpvv.exec:\pjpvv.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9rllxxf.exec:\9rllxxf.exe28⤵
- Executes dropped EXE
PID:3752 -
\??\c:\tnnhhh.exec:\tnnhhh.exe29⤵
- Executes dropped EXE
PID:4848 -
\??\c:\vjdjv.exec:\vjdjv.exe30⤵
- Executes dropped EXE
PID:4768 -
\??\c:\lxfflll.exec:\lxfflll.exe31⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5lxrlll.exec:\5lxrlll.exe32⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nhhtnh.exec:\nhhtnh.exe33⤵
- Executes dropped EXE
PID:4980 -
\??\c:\1dvpj.exec:\1dvpj.exe34⤵
- Executes dropped EXE
PID:3384 -
\??\c:\ffxrrrx.exec:\ffxrrrx.exe35⤵
- Executes dropped EXE
PID:4372 -
\??\c:\7pjdj.exec:\7pjdj.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5rrlxrl.exec:\5rrlxrl.exe37⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nhnnbh.exec:\nhnnbh.exe38⤵
- Executes dropped EXE
PID:3936 -
\??\c:\nttnhb.exec:\nttnhb.exe39⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dvdpp.exec:\dvdpp.exe40⤵
- Executes dropped EXE
PID:4432 -
\??\c:\frlxrrx.exec:\frlxrrx.exe41⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bnnhbb.exec:\bnnhbb.exe42⤵
- Executes dropped EXE
PID:5084 -
\??\c:\pjvpv.exec:\pjvpv.exe43⤵
- Executes dropped EXE
PID:4464 -
\??\c:\fffffll.exec:\fffffll.exe44⤵
- Executes dropped EXE
PID:5024 -
\??\c:\tthbtt.exec:\tthbtt.exe45⤵
- Executes dropped EXE
PID:1268 -
\??\c:\btnhbt.exec:\btnhbt.exe46⤵
- Executes dropped EXE
PID:756 -
\??\c:\pjpjj.exec:\pjpjj.exe47⤵
- Executes dropped EXE
PID:704 -
\??\c:\vvdvp.exec:\vvdvp.exe48⤵
- Executes dropped EXE
PID:4696 -
\??\c:\flrlllf.exec:\flrlllf.exe49⤵
- Executes dropped EXE
PID:4248 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe50⤵
- Executes dropped EXE
PID:3160 -
\??\c:\bhnhbb.exec:\bhnhbb.exe51⤵
- Executes dropped EXE
PID:3220 -
\??\c:\7jppv.exec:\7jppv.exe52⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pjjdv.exec:\pjjdv.exe53⤵
- Executes dropped EXE
PID:4484 -
\??\c:\lfxxlxr.exec:\lfxxlxr.exe54⤵
- Executes dropped EXE
PID:1832 -
\??\c:\nhhtnn.exec:\nhhtnn.exe55⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vvjdp.exec:\vvjdp.exe56⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jpvpd.exec:\jpvpd.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe58⤵
- Executes dropped EXE
PID:4784 -
\??\c:\5lrrrxl.exec:\5lrrrxl.exe59⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tnhbtt.exec:\tnhbtt.exe60⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nhbtnh.exec:\nhbtnh.exe61⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vpjdp.exec:\vpjdp.exe62⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pdvpd.exec:\pdvpd.exe63⤵
- Executes dropped EXE
PID:4760 -
\??\c:\fxfrxxr.exec:\fxfrxxr.exe64⤵
- Executes dropped EXE
PID:3464 -
\??\c:\frfrlxr.exec:\frfrlxr.exe65⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hhnnth.exec:\hhnnth.exe66⤵PID:632
-
\??\c:\pddpd.exec:\pddpd.exe67⤵PID:1396
-
\??\c:\dvvjd.exec:\dvvjd.exe68⤵PID:1416
-
\??\c:\rffxllr.exec:\rffxllr.exe69⤵PID:2056
-
\??\c:\xlfrlfr.exec:\xlfrlfr.exe70⤵PID:1116
-
\??\c:\bnhnbh.exec:\bnhnbh.exe71⤵PID:4524
-
\??\c:\nbthtn.exec:\nbthtn.exe72⤵PID:728
-
\??\c:\7pddp.exec:\7pddp.exe73⤵PID:1720
-
\??\c:\jdpjj.exec:\jdpjj.exe74⤵PID:4620
-
\??\c:\9rrlffx.exec:\9rrlffx.exe75⤵PID:3512
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe76⤵PID:5108
-
\??\c:\hhbbbb.exec:\hhbbbb.exe77⤵PID:4452
-
\??\c:\nbhtbh.exec:\nbhtbh.exe78⤵PID:2932
-
\??\c:\lflffxl.exec:\lflffxl.exe79⤵PID:2892
-
\??\c:\fxllxlf.exec:\fxllxlf.exe80⤵PID:780
-
\??\c:\bthbhh.exec:\bthbhh.exe81⤵PID:4868
-
\??\c:\tnbnbt.exec:\tnbnbt.exe82⤵PID:556
-
\??\c:\3jpjd.exec:\3jpjd.exe83⤵PID:448
-
\??\c:\pvvpj.exec:\pvvpj.exe84⤵PID:3492
-
\??\c:\1lrxllf.exec:\1lrxllf.exe85⤵PID:2684
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe86⤵PID:3576
-
\??\c:\bbnttb.exec:\bbnttb.exe87⤵PID:3936
-
\??\c:\pvvpd.exec:\pvvpd.exe88⤵PID:876
-
\??\c:\xrfrlfx.exec:\xrfrlfx.exe89⤵PID:2432
-
\??\c:\7tbthb.exec:\7tbthb.exe90⤵PID:3320
-
\??\c:\7hnhhh.exec:\7hnhhh.exe91⤵PID:1100
-
\??\c:\dpjdp.exec:\dpjdp.exe92⤵PID:5104
-
\??\c:\lfrlfxx.exec:\lfrlfxx.exe93⤵PID:2364
-
\??\c:\btnbtn.exec:\btnbtn.exe94⤵PID:3028
-
\??\c:\tbthth.exec:\tbthth.exe95⤵PID:3480
-
\??\c:\vddvj.exec:\vddvj.exe96⤵PID:1052
-
\??\c:\lxrxrfx.exec:\lxrxrfx.exe97⤵PID:4380
-
\??\c:\tbhhhh.exec:\tbhhhh.exe98⤵PID:2688
-
\??\c:\tttntt.exec:\tttntt.exe99⤵PID:3996
-
\??\c:\dvjdv.exec:\dvjdv.exe100⤵PID:1256
-
\??\c:\dvvpd.exec:\dvvpd.exe101⤵PID:3016
-
\??\c:\rlllrrl.exec:\rlllrrl.exe102⤵PID:3932
-
\??\c:\tthbbt.exec:\tthbbt.exe103⤵PID:1700
-
\??\c:\thnhbt.exec:\thnhbt.exe104⤵PID:372
-
\??\c:\ddjdv.exec:\ddjdv.exe105⤵PID:2108
-
\??\c:\fflxllx.exec:\fflxllx.exe106⤵PID:1620
-
\??\c:\fffrfxl.exec:\fffrfxl.exe107⤵PID:4060
-
\??\c:\btbbtt.exec:\btbbtt.exe108⤵PID:2744
-
\??\c:\bbbtbb.exec:\bbbtbb.exe109⤵PID:2164
-
\??\c:\jddvp.exec:\jddvp.exe110⤵PID:3688
-
\??\c:\xrlfllx.exec:\xrlfllx.exe111⤵PID:3120
-
\??\c:\hnnthh.exec:\hnnthh.exe112⤵PID:2380
-
\??\c:\nbbtnh.exec:\nbbtnh.exe113⤵PID:2052
-
\??\c:\vvddp.exec:\vvddp.exe114⤵PID:316
-
\??\c:\jdppd.exec:\jdppd.exe115⤵PID:632
-
\??\c:\lxfxfxl.exec:\lxfxfxl.exe116⤵PID:1396
-
\??\c:\lxlxxxf.exec:\lxlxxxf.exe117⤵PID:1416
-
\??\c:\hthbnh.exec:\hthbnh.exe118⤵PID:2056
-
\??\c:\nhhbnh.exec:\nhhbnh.exe119⤵PID:60
-
\??\c:\dpjdd.exec:\dpjdd.exe120⤵PID:4524
-
\??\c:\bhttnn.exec:\bhttnn.exe121⤵PID:728
-
\??\c:\bhnhnh.exec:\bhnhnh.exe122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-