Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe
-
Size
75KB
-
MD5
4a1f040e92c885521bfeebbc6fd6f3df
-
SHA1
c89f5f10b72fed135e14f9155323320d0fb4d549
-
SHA256
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556
-
SHA512
20dd59551c915333abf88e30d1cf47a929eaa90b996e10340903f310e850f641777e12503967382512c81b9ba254fc2ee367f1442f37535f469e759e1b276fed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5K:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCM
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/416-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-15-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral2/memory/416-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1280-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4100-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3520-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3520-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3520-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1320-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1320-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3400-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3400-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3400-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3400-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3076-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/560-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4536-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1944-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4412-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1900-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4876-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2220-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4120-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4944-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5008-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2460-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4644-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2700-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1480-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1768-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jvdvp.exe7nbttt.exeddjdp.exe9lrllrr.exettbtbt.exetbhnbt.exerlfxxrl.exehbttnn.exenhnhbn.exe7jddv.exelrlfrrr.exe1hbttt.exevpjjp.exepjpjd.exerxlxfxr.exennbtnt.exe7dpjd.exejppjd.exe7rrrlrl.exe1bhhhh.exe5vpjd.exevdjdd.exe1ffxxxx.exe9nbbth.exevvpjd.exedpvpd.exerfxlxrl.exehbnbbh.exebtthbt.exe3tnhbb.exe7pvpd.exefxrxrrx.exexrlrllf.exenhhbtn.exe3nnhnn.exevdjdv.exepjjdv.exexllfxxx.exerllfffx.exehntnhh.exehbtnnh.exevvdvv.exefxxffxx.exefrffxxr.exebbnnbb.exeddvvd.exevppvj.exefxffrrf.exe1frrllf.exe5htnnn.exe3dvpd.exepppvv.exefrxrrrl.exexlxrllf.exenhhbtt.exevpvvj.exevjjjd.exelrlfxrr.exe7hnhnn.exeddppj.exepdjdp.exelrfxlxx.exehnttnb.exepjjvp.exepid process 1280 jvdvp.exe 4100 7nbttt.exe 3520 ddjdp.exe 1320 9lrllrr.exe 3400 ttbtbt.exe 4448 tbhnbt.exe 560 rlfxxrl.exe 2124 hbttnn.exe 3076 nhnhbn.exe 4536 7jddv.exe 1944 lrlfrrr.exe 4412 1hbttt.exe 1900 vpjjp.exe 1384 pjpjd.exe 4876 rxlxfxr.exe 2220 nnbtnt.exe 4120 7dpjd.exe 4944 jppjd.exe 5008 7rrrlrl.exe 4968 1bhhhh.exe 2460 5vpjd.exe 4644 vdjdd.exe 4868 1ffxxxx.exe 2700 9nbbth.exe 4716 vvpjd.exe 4076 dpvpd.exe 2376 rfxlxrl.exe 1480 hbnbbh.exe 4844 btthbt.exe 3220 3tnhbb.exe 1768 7pvpd.exe 2664 fxrxrrx.exe 3644 xrlrllf.exe 4964 nhhbtn.exe 3248 3nnhnn.exe 1876 vdjdv.exe 3504 pjjdv.exe 4360 xllfxxx.exe 4524 rllfffx.exe 4340 hntnhh.exe 4804 hbtnnh.exe 1852 vvdvv.exe 3232 fxxffxx.exe 3416 frffxxr.exe 992 bbnnbb.exe 4180 ddvvd.exe 1680 vppvj.exe 804 fxffrrf.exe 560 1frrllf.exe 1284 5htnnn.exe 2464 3dvpd.exe 4396 pppvv.exe 4536 frxrrrl.exe 4932 xlxrllf.exe 1232 nhhbtt.exe 3596 vpvvj.exe 3408 vjjjd.exe 456 lrlfxrr.exe 3904 7hnhnn.exe 2800 ddppj.exe 4120 pdjdp.exe 2064 lrfxlxx.exe 2604 hnttnb.exe 4492 pjjvp.exe -
Processes:
resource yara_rule behavioral2/memory/416-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exejvdvp.exe7nbttt.exeddjdp.exe9lrllrr.exettbtbt.exetbhnbt.exerlfxxrl.exehbttnn.exenhnhbn.exe7jddv.exelrlfrrr.exe1hbttt.exevpjjp.exepjpjd.exerxlxfxr.exennbtnt.exe7dpjd.exejppjd.exe7rrrlrl.exe1bhhhh.exe5vpjd.exedescription pid process target process PID 416 wrote to memory of 1280 416 856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe jvdvp.exe PID 416 wrote to memory of 1280 416 856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe jvdvp.exe PID 416 wrote to memory of 1280 416 856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe jvdvp.exe PID 1280 wrote to memory of 4100 1280 jvdvp.exe 7nbttt.exe PID 1280 wrote to memory of 4100 1280 jvdvp.exe 7nbttt.exe PID 1280 wrote to memory of 4100 1280 jvdvp.exe 7nbttt.exe PID 4100 wrote to memory of 3520 4100 7nbttt.exe ddjdp.exe PID 4100 wrote to memory of 3520 4100 7nbttt.exe ddjdp.exe PID 4100 wrote to memory of 3520 4100 7nbttt.exe ddjdp.exe PID 3520 wrote to memory of 1320 3520 ddjdp.exe 9lrllrr.exe PID 3520 wrote to memory of 1320 3520 ddjdp.exe 9lrllrr.exe PID 3520 wrote to memory of 1320 3520 ddjdp.exe 9lrllrr.exe PID 1320 wrote to memory of 3400 1320 9lrllrr.exe ttbtbt.exe PID 1320 wrote to memory of 3400 1320 9lrllrr.exe ttbtbt.exe PID 1320 wrote to memory of 3400 1320 9lrllrr.exe ttbtbt.exe PID 3400 wrote to memory of 4448 3400 ttbtbt.exe tbhnbt.exe PID 3400 wrote to memory of 4448 3400 ttbtbt.exe tbhnbt.exe PID 3400 wrote to memory of 4448 3400 ttbtbt.exe tbhnbt.exe PID 4448 wrote to memory of 560 4448 tbhnbt.exe rlfxxrl.exe PID 4448 wrote to memory of 560 4448 tbhnbt.exe rlfxxrl.exe PID 4448 wrote to memory of 560 4448 tbhnbt.exe rlfxxrl.exe PID 560 wrote to memory of 2124 560 rlfxxrl.exe hbttnn.exe PID 560 wrote to memory of 2124 560 rlfxxrl.exe hbttnn.exe PID 560 wrote to memory of 2124 560 rlfxxrl.exe hbttnn.exe PID 2124 wrote to memory of 3076 2124 hbttnn.exe nhnhbn.exe PID 2124 wrote to memory of 3076 2124 hbttnn.exe nhnhbn.exe PID 2124 wrote to memory of 3076 2124 hbttnn.exe nhnhbn.exe PID 3076 wrote to memory of 4536 3076 nhnhbn.exe 7jddv.exe PID 3076 wrote to memory of 4536 3076 nhnhbn.exe 7jddv.exe PID 3076 wrote to memory of 4536 3076 nhnhbn.exe 7jddv.exe PID 4536 wrote to memory of 1944 4536 7jddv.exe lrlfrrr.exe PID 4536 wrote to memory of 1944 4536 7jddv.exe lrlfrrr.exe PID 4536 wrote to memory of 1944 4536 7jddv.exe lrlfrrr.exe PID 1944 wrote to memory of 4412 1944 lrlfrrr.exe 1hbttt.exe PID 1944 wrote to memory of 4412 1944 lrlfrrr.exe 1hbttt.exe PID 1944 wrote to memory of 4412 1944 lrlfrrr.exe 1hbttt.exe PID 4412 wrote to memory of 1900 4412 1hbttt.exe vpjjp.exe PID 4412 wrote to memory of 1900 4412 1hbttt.exe vpjjp.exe PID 4412 wrote to memory of 1900 4412 1hbttt.exe vpjjp.exe PID 1900 wrote to memory of 1384 1900 vpjjp.exe pjpjd.exe PID 1900 wrote to memory of 1384 1900 vpjjp.exe pjpjd.exe PID 1900 wrote to memory of 1384 1900 vpjjp.exe pjpjd.exe PID 1384 wrote to memory of 4876 1384 pjpjd.exe rxlxfxr.exe PID 1384 wrote to memory of 4876 1384 pjpjd.exe rxlxfxr.exe PID 1384 wrote to memory of 4876 1384 pjpjd.exe rxlxfxr.exe PID 4876 wrote to memory of 2220 4876 rxlxfxr.exe nnbtnt.exe PID 4876 wrote to memory of 2220 4876 rxlxfxr.exe nnbtnt.exe PID 4876 wrote to memory of 2220 4876 rxlxfxr.exe nnbtnt.exe PID 2220 wrote to memory of 4120 2220 nnbtnt.exe 7dpjd.exe PID 2220 wrote to memory of 4120 2220 nnbtnt.exe 7dpjd.exe PID 2220 wrote to memory of 4120 2220 nnbtnt.exe 7dpjd.exe PID 4120 wrote to memory of 4944 4120 7dpjd.exe jppjd.exe PID 4120 wrote to memory of 4944 4120 7dpjd.exe jppjd.exe PID 4120 wrote to memory of 4944 4120 7dpjd.exe jppjd.exe PID 4944 wrote to memory of 5008 4944 jppjd.exe 7rrrlrl.exe PID 4944 wrote to memory of 5008 4944 jppjd.exe 7rrrlrl.exe PID 4944 wrote to memory of 5008 4944 jppjd.exe 7rrrlrl.exe PID 5008 wrote to memory of 4968 5008 7rrrlrl.exe 1bhhhh.exe PID 5008 wrote to memory of 4968 5008 7rrrlrl.exe 1bhhhh.exe PID 5008 wrote to memory of 4968 5008 7rrrlrl.exe 1bhhhh.exe PID 4968 wrote to memory of 2460 4968 1bhhhh.exe 5vpjd.exe PID 4968 wrote to memory of 2460 4968 1bhhhh.exe 5vpjd.exe PID 4968 wrote to memory of 2460 4968 1bhhhh.exe 5vpjd.exe PID 2460 wrote to memory of 4644 2460 5vpjd.exe vdjdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe"C:\Users\Admin\AppData\Local\Temp\856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\jvdvp.exec:\jvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\7nbttt.exec:\7nbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\ddjdp.exec:\ddjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\9lrllrr.exec:\9lrllrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\ttbtbt.exec:\ttbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\tbhnbt.exec:\tbhnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\rlfxxrl.exec:\rlfxxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\hbttnn.exec:\hbttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\nhnhbn.exec:\nhnhbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\7jddv.exec:\7jddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\lrlfrrr.exec:\lrlfrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\1hbttt.exec:\1hbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\vpjjp.exec:\vpjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\pjpjd.exec:\pjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\rxlxfxr.exec:\rxlxfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\nnbtnt.exec:\nnbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\7dpjd.exec:\7dpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\jppjd.exec:\jppjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\7rrrlrl.exec:\7rrrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\1bhhhh.exec:\1bhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\5vpjd.exec:\5vpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vdjdd.exec:\vdjdd.exe23⤵
- Executes dropped EXE
PID:4644 -
\??\c:\1ffxxxx.exec:\1ffxxxx.exe24⤵
- Executes dropped EXE
PID:4868 -
\??\c:\9nbbth.exec:\9nbbth.exe25⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vvpjd.exec:\vvpjd.exe26⤵
- Executes dropped EXE
PID:4716 -
\??\c:\dpvpd.exec:\dpvpd.exe27⤵
- Executes dropped EXE
PID:4076 -
\??\c:\rfxlxrl.exec:\rfxlxrl.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hbnbbh.exec:\hbnbbh.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\btthbt.exec:\btthbt.exe30⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3tnhbb.exec:\3tnhbb.exe31⤵
- Executes dropped EXE
PID:3220 -
\??\c:\7pvpd.exec:\7pvpd.exe32⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xrlrllf.exec:\xrlrllf.exe34⤵
- Executes dropped EXE
PID:3644 -
\??\c:\nhhbtn.exec:\nhhbtn.exe35⤵
- Executes dropped EXE
PID:4964 -
\??\c:\3nnhnn.exec:\3nnhnn.exe36⤵
- Executes dropped EXE
PID:3248 -
\??\c:\vdjdv.exec:\vdjdv.exe37⤵
- Executes dropped EXE
PID:1876 -
\??\c:\pjjdv.exec:\pjjdv.exe38⤵
- Executes dropped EXE
PID:3504 -
\??\c:\xllfxxx.exec:\xllfxxx.exe39⤵
- Executes dropped EXE
PID:4360 -
\??\c:\rllfffx.exec:\rllfffx.exe40⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hntnhh.exec:\hntnhh.exe41⤵
- Executes dropped EXE
PID:4340 -
\??\c:\hbtnnh.exec:\hbtnnh.exe42⤵
- Executes dropped EXE
PID:4804 -
\??\c:\vvdvv.exec:\vvdvv.exe43⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fxxffxx.exec:\fxxffxx.exe44⤵
- Executes dropped EXE
PID:3232 -
\??\c:\frffxxr.exec:\frffxxr.exe45⤵
- Executes dropped EXE
PID:3416 -
\??\c:\bbnnbb.exec:\bbnnbb.exe46⤵
- Executes dropped EXE
PID:992 -
\??\c:\ddvvd.exec:\ddvvd.exe47⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vppvj.exec:\vppvj.exe48⤵
- Executes dropped EXE
PID:1680 -
\??\c:\fxffrrf.exec:\fxffrrf.exe49⤵
- Executes dropped EXE
PID:804 -
\??\c:\1frrllf.exec:\1frrllf.exe50⤵
- Executes dropped EXE
PID:560 -
\??\c:\5htnnn.exec:\5htnnn.exe51⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3dvpd.exec:\3dvpd.exe52⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pppvv.exec:\pppvv.exe53⤵
- Executes dropped EXE
PID:4396 -
\??\c:\frxrrrl.exec:\frxrrrl.exe54⤵
- Executes dropped EXE
PID:4536 -
\??\c:\xlxrllf.exec:\xlxrllf.exe55⤵
- Executes dropped EXE
PID:4932 -
\??\c:\nhhbtt.exec:\nhhbtt.exe56⤵
- Executes dropped EXE
PID:1232 -
\??\c:\vpvvj.exec:\vpvvj.exe57⤵
- Executes dropped EXE
PID:3596 -
\??\c:\vjjjd.exec:\vjjjd.exe58⤵
- Executes dropped EXE
PID:3408 -
\??\c:\lrlfxrr.exec:\lrlfxrr.exe59⤵
- Executes dropped EXE
PID:456 -
\??\c:\7hnhnn.exec:\7hnhnn.exe60⤵
- Executes dropped EXE
PID:3904 -
\??\c:\ddppj.exec:\ddppj.exe61⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pdjdp.exec:\pdjdp.exe62⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lrfxlxx.exec:\lrfxlxx.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hnttnb.exec:\hnttnb.exe64⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pjjvp.exec:\pjjvp.exe65⤵
- Executes dropped EXE
PID:4492 -
\??\c:\frrlffx.exec:\frrlffx.exe66⤵PID:3224
-
\??\c:\llxxffx.exec:\llxxffx.exe67⤵PID:1556
-
\??\c:\3thbtn.exec:\3thbtn.exe68⤵PID:4908
-
\??\c:\vpvvp.exec:\vpvvp.exe69⤵PID:4868
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe70⤵PID:460
-
\??\c:\fxxrlll.exec:\fxxrlll.exe71⤵PID:3700
-
\??\c:\bbbbtb.exec:\bbbbtb.exe72⤵PID:3092
-
\??\c:\jdvpj.exec:\jdvpj.exe73⤵PID:4368
-
\??\c:\vdpvp.exec:\vdpvp.exe74⤵PID:4048
-
\??\c:\pjjpp.exec:\pjjpp.exe75⤵PID:1916
-
\??\c:\lllfxrr.exec:\lllfxrr.exe76⤵PID:3220
-
\??\c:\btnnnn.exec:\btnnnn.exe77⤵PID:2740
-
\??\c:\nhbbtn.exec:\nhbbtn.exe78⤵PID:5088
-
\??\c:\7nhtnh.exec:\7nhtnh.exe79⤵PID:912
-
\??\c:\7jpjj.exec:\7jpjj.exe80⤵PID:4860
-
\??\c:\dppvd.exec:\dppvd.exe81⤵PID:348
-
\??\c:\5rffflx.exec:\5rffflx.exe82⤵PID:408
-
\??\c:\fllxxrr.exec:\fllxxrr.exe83⤵PID:940
-
\??\c:\nbhnhh.exec:\nbhnhh.exe84⤵PID:728
-
\??\c:\3thbth.exec:\3thbth.exe85⤵PID:1812
-
\??\c:\7vjvp.exec:\7vjvp.exe86⤵PID:2992
-
\??\c:\dvvpd.exec:\dvvpd.exe87⤵PID:1956
-
\??\c:\xxfrrrf.exec:\xxfrrrf.exe88⤵PID:4352
-
\??\c:\lffxrlf.exec:\lffxrlf.exe89⤵PID:2084
-
\??\c:\5hbtnn.exec:\5hbtnn.exe90⤵PID:3520
-
\??\c:\tbnhhh.exec:\tbnhhh.exe91⤵PID:1624
-
\??\c:\dvvpp.exec:\dvvpp.exe92⤵PID:3704
-
\??\c:\5pjjd.exec:\5pjjd.exe93⤵PID:4580
-
\??\c:\pjvpv.exec:\pjvpv.exe94⤵PID:4616
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe95⤵PID:2964
-
\??\c:\1bbtnn.exec:\1bbtnn.exe96⤵PID:2988
-
\??\c:\thhnnn.exec:\thhnnn.exe97⤵PID:2744
-
\??\c:\hthbtt.exec:\hthbtt.exe98⤵PID:3076
-
\??\c:\dpdpj.exec:\dpdpj.exe99⤵PID:924
-
\??\c:\vpvpj.exec:\vpvpj.exe100⤵PID:2452
-
\??\c:\lrrlrxr.exec:\lrrlrxr.exe101⤵PID:4536
-
\??\c:\bbbtnn.exec:\bbbtnn.exe102⤵PID:4932
-
\??\c:\ttbttb.exec:\ttbttb.exe103⤵PID:3660
-
\??\c:\djjjd.exec:\djjjd.exe104⤵PID:3484
-
\??\c:\pdpjv.exec:\pdpjv.exe105⤵PID:4544
-
\??\c:\frflfff.exec:\frflfff.exe106⤵PID:2356
-
\??\c:\frrllll.exec:\frrllll.exe107⤵PID:3880
-
\??\c:\hntthh.exec:\hntthh.exe108⤵PID:732
-
\??\c:\1nnhbh.exec:\1nnhbh.exe109⤵PID:3832
-
\??\c:\1jvvv.exec:\1jvvv.exe110⤵PID:4696
-
\??\c:\jjdvv.exec:\jjdvv.exe111⤵PID:2216
-
\??\c:\3ffxllf.exec:\3ffxllf.exe112⤵PID:4636
-
\??\c:\rlrrffl.exec:\rlrrffl.exe113⤵PID:4124
-
\??\c:\9bhbtt.exec:\9bhbtt.exe114⤵PID:3000
-
\??\c:\nbhbtn.exec:\nbhbtn.exe115⤵PID:1028
-
\??\c:\pvvjv.exec:\pvvjv.exe116⤵PID:1476
-
\??\c:\7jpjd.exec:\7jpjd.exe117⤵PID:3700
-
\??\c:\flrlxrr.exec:\flrlxrr.exe118⤵PID:1796
-
\??\c:\ntttbt.exec:\ntttbt.exe119⤵PID:612
-
\??\c:\hbhttb.exec:\hbhttb.exe120⤵PID:960
-
\??\c:\djpjd.exec:\djpjd.exe121⤵PID:656
-
\??\c:\9pjdv.exec:\9pjdv.exe122⤵PID:2016
-
\??\c:\xrllfff.exec:\xrllfff.exe123⤵PID:4956
-
\??\c:\llffxfx.exec:\llffxfx.exe124⤵PID:912
-
\??\c:\bbnntt.exec:\bbnntt.exe125⤵PID:1592
-
\??\c:\hthbtt.exec:\hthbtt.exe126⤵PID:400
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe127⤵PID:940
-
\??\c:\3hntnt.exec:\3hntnt.exe128⤵PID:4524
-
\??\c:\tnhbhb.exec:\tnhbhb.exe129⤵PID:3712
-
\??\c:\3vpjp.exec:\3vpjp.exe130⤵PID:2028
-
\??\c:\ffffxrr.exec:\ffffxrr.exe131⤵PID:4352
-
\??\c:\xrxrrxx.exec:\xrxrrxx.exe132⤵PID:4428
-
\??\c:\btbbhh.exec:\btbbhh.exe133⤵PID:4580
-
\??\c:\bnbnhh.exec:\bnbnhh.exe134⤵PID:4668
-
\??\c:\3jpjv.exec:\3jpjv.exe135⤵PID:2044
-
\??\c:\dvvvj.exec:\dvvvj.exe136⤵PID:1016
-
\??\c:\5pjdd.exec:\5pjdd.exe137⤵PID:3016
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe138⤵PID:1516
-
\??\c:\llflfrl.exec:\llflfrl.exe139⤵PID:784
-
\??\c:\htbbbb.exec:\htbbbb.exe140⤵PID:1992
-
\??\c:\hbtnbb.exec:\hbtnbb.exe141⤵PID:2940
-
\??\c:\5pjdp.exec:\5pjdp.exe142⤵PID:3696
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe143⤵PID:3328
-
\??\c:\nhhhbb.exec:\nhhhbb.exe144⤵PID:2800
-
\??\c:\pjdjd.exec:\pjdjd.exe145⤵PID:4960
-
\??\c:\lxrlrff.exec:\lxrlrff.exe146⤵PID:1688
-
\??\c:\nbhbbt.exec:\nbhbbt.exe147⤵PID:4652
-
\??\c:\5vjjd.exec:\5vjjd.exe148⤵PID:2468
-
\??\c:\dvppj.exec:\dvppj.exe149⤵PID:2460
-
\??\c:\3xrxlxr.exec:\3xrxlxr.exe150⤵PID:2504
-
\??\c:\5nnhbt.exec:\5nnhbt.exe151⤵PID:4656
-
\??\c:\pvddd.exec:\pvddd.exe152⤵PID:1044
-
\??\c:\ffffxlf.exec:\ffffxlf.exe153⤵PID:1968
-
\??\c:\hthtth.exec:\hthtth.exe154⤵PID:4384
-
\??\c:\jddvp.exec:\jddvp.exe155⤵PID:3092
-
\??\c:\7fxrlll.exec:\7fxrlll.exe156⤵PID:404
-
\??\c:\9bbbtt.exec:\9bbbtt.exe157⤵PID:1392
-
\??\c:\tnhhnh.exec:\tnhhnh.exe158⤵PID:3128
-
\??\c:\dpvpp.exec:\dpvpp.exe159⤵PID:1768
-
\??\c:\frxrlll.exec:\frxrlll.exe160⤵PID:3852
-
\??\c:\btbnhh.exec:\btbnhh.exe161⤵PID:1860
-
\??\c:\pjjdp.exec:\pjjdp.exe162⤵PID:4984
-
\??\c:\xrfxllx.exec:\xrfxllx.exe163⤵PID:1592
-
\??\c:\1bnhhh.exec:\1bnhhh.exe164⤵PID:4620
-
\??\c:\bththn.exec:\bththn.exe165⤵PID:3500
-
\??\c:\rrffrrx.exec:\rrffrrx.exe166⤵PID:1812
-
\??\c:\3hnhbb.exec:\3hnhbb.exe167⤵PID:5040
-
\??\c:\dvvpj.exec:\dvvpj.exe168⤵PID:1188
-
\??\c:\frrllrr.exec:\frrllrr.exe169⤵PID:2028
-
\??\c:\lfxrllf.exec:\lfxrllf.exe170⤵PID:3400
-
\??\c:\nnnbtb.exec:\nnnbtb.exe171⤵PID:4428
-
\??\c:\nhbtnn.exec:\nhbtnn.exe172⤵PID:1284
-
\??\c:\5vdvd.exec:\5vdvd.exe173⤵PID:4668
-
\??\c:\fxxrlll.exec:\fxxrlll.exe174⤵PID:2044
-
\??\c:\nhtbbb.exec:\nhtbbb.exe175⤵PID:1172
-
\??\c:\dpddv.exec:\dpddv.exe176⤵PID:1508
-
\??\c:\xlxrfff.exec:\xlxrfff.exe177⤵PID:4536
-
\??\c:\dvjpd.exec:\dvjpd.exe178⤵PID:1384
-
\??\c:\fffxrfl.exec:\fffxrfl.exe179⤵PID:4376
-
\??\c:\7rfxffr.exec:\7rfxffr.exe180⤵PID:2960
-
\??\c:\bnntnn.exec:\bnntnn.exe181⤵PID:2772
-
\??\c:\1hhbhh.exec:\1hhbhh.exe182⤵PID:3540
-
\??\c:\9vjdd.exec:\9vjdd.exe183⤵PID:680
-
\??\c:\rlrrrxr.exec:\rlrrrxr.exe184⤵PID:4944
-
\??\c:\hhbhht.exec:\hhbhht.exe185⤵PID:4760
-
\??\c:\bthhhh.exec:\bthhhh.exe186⤵PID:3624
-
\??\c:\1vjdd.exec:\1vjdd.exe187⤵PID:1332
-
\??\c:\ppjdv.exec:\ppjdv.exe188⤵PID:1144
-
\??\c:\7jdpp.exec:\7jdpp.exe189⤵PID:4900
-
\??\c:\dvjjj.exec:\dvjjj.exe190⤵PID:1336
-
\??\c:\ffflllf.exec:\ffflllf.exe191⤵PID:4716
-
\??\c:\tbhbtt.exec:\tbhbtt.exe192⤵PID:3952
-
\??\c:\1frlrrx.exec:\1frlrrx.exe193⤵PID:4676
-
\??\c:\1lrllrl.exec:\1lrllrl.exe194⤵PID:1488
-
\??\c:\hnthtn.exec:\hnthtn.exe195⤵PID:3572
-
\??\c:\9pvvj.exec:\9pvvj.exe196⤵PID:3104
-
\??\c:\jjjpp.exec:\jjjpp.exe197⤵PID:1892
-
\??\c:\lflffrr.exec:\lflffrr.exe198⤵PID:800
-
\??\c:\bbhbbb.exec:\bbhbbb.exe199⤵PID:3272
-
\??\c:\jjjjd.exec:\jjjjd.exe200⤵PID:2632
-
\??\c:\dpdvp.exec:\dpdvp.exe201⤵PID:2200
-
\??\c:\rxflrlr.exec:\rxflrlr.exe202⤵PID:1580
-
\??\c:\xflfrlx.exec:\xflfrlx.exe203⤵PID:5072
-
\??\c:\9nnnhh.exec:\9nnnhh.exe204⤵PID:4804
-
\??\c:\jpvjd.exec:\jpvjd.exe205⤵PID:1852
-
\??\c:\vppvp.exec:\vppvp.exe206⤵PID:4444
-
\??\c:\lxflfff.exec:\lxflfff.exe207⤵PID:2028
-
\??\c:\xflffff.exec:\xflffff.exe208⤵PID:1856
-
\??\c:\thntnn.exec:\thntnn.exe209⤵PID:4888
-
\??\c:\7vddj.exec:\7vddj.exe210⤵PID:1284
-
\??\c:\xrffflr.exec:\xrffflr.exe211⤵PID:2300
-
\??\c:\xllxrxf.exec:\xllxrxf.exe212⤵PID:4600
-
\??\c:\htbbtt.exec:\htbbtt.exe213⤵PID:5024
-
\??\c:\hnhhht.exec:\hnhhht.exe214⤵PID:2948
-
\??\c:\5vdvp.exec:\5vdvp.exe215⤵PID:628
-
\??\c:\flxflrx.exec:\flxflrx.exe216⤵PID:3628
-
\??\c:\xllfrxr.exec:\xllfrxr.exe217⤵PID:3484
-
\??\c:\nbhbtt.exec:\nbhbtt.exe218⤵PID:2960
-
\??\c:\5nnhbt.exec:\5nnhbt.exe219⤵PID:2036
-
\??\c:\dpvpv.exec:\dpvpv.exe220⤵PID:1288
-
\??\c:\xxlxlxf.exec:\xxlxlxf.exe221⤵PID:368
-
\??\c:\lflfxlf.exec:\lflfxlf.exe222⤵PID:808
-
\??\c:\hbhbbn.exec:\hbhbbn.exe223⤵PID:2328
-
\??\c:\vppjd.exec:\vppjd.exe224⤵PID:2504
-
\??\c:\jdjjd.exec:\jdjjd.exe225⤵PID:1044
-
\??\c:\vppjj.exec:\vppjj.exe226⤵PID:1748
-
\??\c:\7rxrfff.exec:\7rxrfff.exe227⤵PID:4384
-
\??\c:\9htntb.exec:\9htntb.exe228⤵PID:3152
-
\??\c:\hhhbtt.exec:\hhhbtt.exe229⤵PID:3840
-
\??\c:\nhnnnt.exec:\nhnnnt.exe230⤵PID:404
-
\??\c:\jjvpj.exec:\jjvpj.exe231⤵PID:3864
-
\??\c:\rfrfxrl.exec:\rfrfxrl.exe232⤵PID:3128
-
\??\c:\rrlxrrr.exec:\rrlxrrr.exe233⤵PID:1780
-
\??\c:\nhhhbt.exec:\nhhhbt.exe234⤵PID:412
-
\??\c:\jjjdp.exec:\jjjdp.exe235⤵PID:2040
-
\??\c:\jjvjd.exec:\jjvjd.exe236⤵PID:4844
-
\??\c:\dvdvj.exec:\dvdvj.exe237⤵PID:3640
-
\??\c:\xrfxfxr.exec:\xrfxfxr.exe238⤵PID:1580
-
\??\c:\hntnhh.exec:\hntnhh.exe239⤵PID:4524
-
\??\c:\1ntnhh.exec:\1ntnhh.exe240⤵PID:1692
-
\??\c:\vjvpj.exec:\vjvpj.exe241⤵PID:1320
-
\??\c:\jdvvp.exec:\jdvvp.exe242⤵PID:4444