Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe
-
Size
75KB
-
MD5
af3f9fe73ffde1c212d3b9e97d9dfca0
-
SHA1
f8d889d826850105eab691d9f1b56fd614dec0e9
-
SHA256
4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772
-
SHA512
2b450eaf012dbb9570cede1d1303d8e361b6fec365ebdbfd004ed52b7681b57a1e3f4593fdf71d74abaa4714627a05b5b9d61fed3aab212d23ee45602e777500
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1AL:ymb3NkkiQ3mdBjFIsIVbpUa
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
Processes:
resource yara_rule behavioral2/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1892-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3036-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4588-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4380-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4380-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1064-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/696-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2084-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4760-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2296-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3624-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4604-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1408-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4116-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3104-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4028-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2364-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/528-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1464-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4548-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3304-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1060-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3224-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
3pjdv.exexrlxlfx.exebthnnn.exepjddp.exelxrfrrf.exenhbthh.exejppjv.exelrxlfrl.exellrllfr.exe5hhbnh.exedjdvd.exerllxlfr.exebnhthb.exetbbnhb.exedjdpj.exe7rfxrlf.exe9ththb.exe9hnnbt.exepvvpd.exefxfrrrx.exe7bbhbt.exettnnhn.exepjvpv.exe9fxrffx.exennnhbb.exepdvvv.exexlfrfxr.exehnnhhb.exejvvpd.exellrfrlf.exefllxrfx.exebnbtnn.exebnhbtn.exe5pvpv.exeppjvj.exe7lrlxrl.exetnhbnh.exedpjjj.exedvvjd.exexxrlxrl.exexxlfxxr.exebttnnt.exehnhthb.exe1dpdp.exe1fxlxrf.exelxrrflf.exe9btnnt.exe9dvpj.exe9xrrxll.exerflxflx.exehtnttt.exevvppj.exevpdvj.exerrrflrf.exefxlfllf.exetnnbbt.exehtbtnn.exeddppv.exexrlfxxr.exerllfffx.exehbnntt.exe7ntbtt.exennnhbn.exeppvpd.exepid process 3036 3pjdv.exe 1892 xrlxlfx.exe 4036 bthnnn.exe 3076 pjddp.exe 4588 lxrfrrf.exe 4380 nhbthh.exe 1064 jppjv.exe 696 lrxlfrl.exe 2084 llrllfr.exe 4760 5hhbnh.exe 32 djdvd.exe 2296 rllxlfr.exe 3624 bnhthb.exe 1884 tbbnhb.exe 4604 djdpj.exe 1408 7rfxrlf.exe 4116 9ththb.exe 3104 9hnnbt.exe 4028 pvvpd.exe 4456 fxfrrrx.exe 2364 7bbhbt.exe 1828 ttnnhn.exe 528 pjvpv.exe 744 9fxrffx.exe 3244 nnnhbb.exe 1464 pdvvv.exe 4548 xlfrfxr.exe 3304 hnnhhb.exe 1060 jvvpd.exe 4984 llrfrlf.exe 3224 fllxrfx.exe 5040 bnbtnn.exe 1260 bnhbtn.exe 2560 5pvpv.exe 4008 ppjvj.exe 4316 7lrlxrl.exe 4544 tnhbnh.exe 4644 dpjjj.exe 4968 dvvjd.exe 2400 xxrlxrl.exe 2036 xxlfxxr.exe 4216 bttnnt.exe 3576 hnhthb.exe 3288 1dpdp.exe 2248 1fxlxrf.exe 612 lxrrflf.exe 4852 9btnnt.exe 1192 9dvpj.exe 2268 9xrrxll.exe 2964 rflxflx.exe 5076 htnttt.exe 4112 vvppj.exe 3744 vpdvj.exe 224 rrrflrf.exe 4980 fxlfllf.exe 456 tnnbbt.exe 2428 htbtnn.exe 2396 ddppv.exe 1220 xrlfxxr.exe 860 rllfffx.exe 3504 hbnntt.exe 960 7ntbtt.exe 4880 nnnhbn.exe 3308 ppvpd.exe -
Processes:
resource yara_rule behavioral2/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe3pjdv.exexrlxlfx.exebthnnn.exepjddp.exelxrfrrf.exenhbthh.exejppjv.exelrxlfrl.exellrllfr.exe5hhbnh.exedjdvd.exerllxlfr.exebnhthb.exetbbnhb.exedjdpj.exe7rfxrlf.exe9ththb.exe9hnnbt.exepvvpd.exefxfrrrx.exe7bbhbt.exedescription pid process target process PID 1448 wrote to memory of 3036 1448 4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe 3pjdv.exe PID 1448 wrote to memory of 3036 1448 4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe 3pjdv.exe PID 1448 wrote to memory of 3036 1448 4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe 3pjdv.exe PID 3036 wrote to memory of 1892 3036 3pjdv.exe xrlxlfx.exe PID 3036 wrote to memory of 1892 3036 3pjdv.exe xrlxlfx.exe PID 3036 wrote to memory of 1892 3036 3pjdv.exe xrlxlfx.exe PID 1892 wrote to memory of 4036 1892 xrlxlfx.exe bthnnn.exe PID 1892 wrote to memory of 4036 1892 xrlxlfx.exe bthnnn.exe PID 1892 wrote to memory of 4036 1892 xrlxlfx.exe bthnnn.exe PID 4036 wrote to memory of 3076 4036 bthnnn.exe pjddp.exe PID 4036 wrote to memory of 3076 4036 bthnnn.exe pjddp.exe PID 4036 wrote to memory of 3076 4036 bthnnn.exe pjddp.exe PID 3076 wrote to memory of 4588 3076 pjddp.exe lxrfrrf.exe PID 3076 wrote to memory of 4588 3076 pjddp.exe lxrfrrf.exe PID 3076 wrote to memory of 4588 3076 pjddp.exe lxrfrrf.exe PID 4588 wrote to memory of 4380 4588 lxrfrrf.exe nhbthh.exe PID 4588 wrote to memory of 4380 4588 lxrfrrf.exe nhbthh.exe PID 4588 wrote to memory of 4380 4588 lxrfrrf.exe nhbthh.exe PID 4380 wrote to memory of 1064 4380 nhbthh.exe jppjv.exe PID 4380 wrote to memory of 1064 4380 nhbthh.exe jppjv.exe PID 4380 wrote to memory of 1064 4380 nhbthh.exe jppjv.exe PID 1064 wrote to memory of 696 1064 jppjv.exe lrxlfrl.exe PID 1064 wrote to memory of 696 1064 jppjv.exe lrxlfrl.exe PID 1064 wrote to memory of 696 1064 jppjv.exe lrxlfrl.exe PID 696 wrote to memory of 2084 696 lrxlfrl.exe llrllfr.exe PID 696 wrote to memory of 2084 696 lrxlfrl.exe llrllfr.exe PID 696 wrote to memory of 2084 696 lrxlfrl.exe llrllfr.exe PID 2084 wrote to memory of 4760 2084 llrllfr.exe 5hhbnh.exe PID 2084 wrote to memory of 4760 2084 llrllfr.exe 5hhbnh.exe PID 2084 wrote to memory of 4760 2084 llrllfr.exe 5hhbnh.exe PID 4760 wrote to memory of 32 4760 5hhbnh.exe djdvd.exe PID 4760 wrote to memory of 32 4760 5hhbnh.exe djdvd.exe PID 4760 wrote to memory of 32 4760 5hhbnh.exe djdvd.exe PID 32 wrote to memory of 2296 32 djdvd.exe rllxlfr.exe PID 32 wrote to memory of 2296 32 djdvd.exe rllxlfr.exe PID 32 wrote to memory of 2296 32 djdvd.exe rllxlfr.exe PID 2296 wrote to memory of 3624 2296 rllxlfr.exe bnhthb.exe PID 2296 wrote to memory of 3624 2296 rllxlfr.exe bnhthb.exe PID 2296 wrote to memory of 3624 2296 rllxlfr.exe bnhthb.exe PID 3624 wrote to memory of 1884 3624 bnhthb.exe tbbnhb.exe PID 3624 wrote to memory of 1884 3624 bnhthb.exe tbbnhb.exe PID 3624 wrote to memory of 1884 3624 bnhthb.exe tbbnhb.exe PID 1884 wrote to memory of 4604 1884 tbbnhb.exe djdpj.exe PID 1884 wrote to memory of 4604 1884 tbbnhb.exe djdpj.exe PID 1884 wrote to memory of 4604 1884 tbbnhb.exe djdpj.exe PID 4604 wrote to memory of 1408 4604 djdpj.exe 7rfxrlf.exe PID 4604 wrote to memory of 1408 4604 djdpj.exe 7rfxrlf.exe PID 4604 wrote to memory of 1408 4604 djdpj.exe 7rfxrlf.exe PID 1408 wrote to memory of 4116 1408 7rfxrlf.exe 9ththb.exe PID 1408 wrote to memory of 4116 1408 7rfxrlf.exe 9ththb.exe PID 1408 wrote to memory of 4116 1408 7rfxrlf.exe 9ththb.exe PID 4116 wrote to memory of 3104 4116 9ththb.exe 9hnnbt.exe PID 4116 wrote to memory of 3104 4116 9ththb.exe 9hnnbt.exe PID 4116 wrote to memory of 3104 4116 9ththb.exe 9hnnbt.exe PID 3104 wrote to memory of 4028 3104 9hnnbt.exe pvvpd.exe PID 3104 wrote to memory of 4028 3104 9hnnbt.exe pvvpd.exe PID 3104 wrote to memory of 4028 3104 9hnnbt.exe pvvpd.exe PID 4028 wrote to memory of 4456 4028 pvvpd.exe fxfrrrx.exe PID 4028 wrote to memory of 4456 4028 pvvpd.exe fxfrrrx.exe PID 4028 wrote to memory of 4456 4028 pvvpd.exe fxfrrrx.exe PID 4456 wrote to memory of 2364 4456 fxfrrrx.exe 7bbhbt.exe PID 4456 wrote to memory of 2364 4456 fxfrrrx.exe 7bbhbt.exe PID 4456 wrote to memory of 2364 4456 fxfrrrx.exe 7bbhbt.exe PID 2364 wrote to memory of 1828 2364 7bbhbt.exe ttnnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe"C:\Users\Admin\AppData\Local\Temp\4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\3pjdv.exec:\3pjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xrlxlfx.exec:\xrlxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\bthnnn.exec:\bthnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\pjddp.exec:\pjddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\lxrfrrf.exec:\lxrfrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\nhbthh.exec:\nhbthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\jppjv.exec:\jppjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\lrxlfrl.exec:\lrxlfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\llrllfr.exec:\llrllfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\5hhbnh.exec:\5hhbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\djdvd.exec:\djdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\rllxlfr.exec:\rllxlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\bnhthb.exec:\bnhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\tbbnhb.exec:\tbbnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\djdpj.exec:\djdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\7rfxrlf.exec:\7rfxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\9ththb.exec:\9ththb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\9hnnbt.exec:\9hnnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\pvvpd.exec:\pvvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\fxfrrrx.exec:\fxfrrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\7bbhbt.exec:\7bbhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\ttnnhn.exec:\ttnnhn.exe23⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pjvpv.exec:\pjvpv.exe24⤵
- Executes dropped EXE
PID:528 -
\??\c:\9fxrffx.exec:\9fxrffx.exe25⤵
- Executes dropped EXE
PID:744 -
\??\c:\nnnhbb.exec:\nnnhbb.exe26⤵
- Executes dropped EXE
PID:3244 -
\??\c:\pdvvv.exec:\pdvvv.exe27⤵
- Executes dropped EXE
PID:1464 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe28⤵
- Executes dropped EXE
PID:4548 -
\??\c:\hnnhhb.exec:\hnnhhb.exe29⤵
- Executes dropped EXE
PID:3304 -
\??\c:\jvvpd.exec:\jvvpd.exe30⤵
- Executes dropped EXE
PID:1060 -
\??\c:\llrfrlf.exec:\llrfrlf.exe31⤵
- Executes dropped EXE
PID:4984 -
\??\c:\fllxrfx.exec:\fllxrfx.exe32⤵
- Executes dropped EXE
PID:3224 -
\??\c:\bnbtnn.exec:\bnbtnn.exe33⤵
- Executes dropped EXE
PID:5040 -
\??\c:\bnhbtn.exec:\bnhbtn.exe34⤵
- Executes dropped EXE
PID:1260 -
\??\c:\5pvpv.exec:\5pvpv.exe35⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ppjvj.exec:\ppjvj.exe36⤵
- Executes dropped EXE
PID:4008 -
\??\c:\7lrlxrl.exec:\7lrlxrl.exe37⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tnhbnh.exec:\tnhbnh.exe38⤵
- Executes dropped EXE
PID:4544 -
\??\c:\dpjjj.exec:\dpjjj.exe39⤵
- Executes dropped EXE
PID:4644 -
\??\c:\dvvjd.exec:\dvvjd.exe40⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe41⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe42⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bttnnt.exec:\bttnnt.exe43⤵
- Executes dropped EXE
PID:4216 -
\??\c:\hnhthb.exec:\hnhthb.exe44⤵
- Executes dropped EXE
PID:3576 -
\??\c:\1dpdp.exec:\1dpdp.exe45⤵
- Executes dropped EXE
PID:3288 -
\??\c:\1fxlxrf.exec:\1fxlxrf.exe46⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lxrrflf.exec:\lxrrflf.exe47⤵
- Executes dropped EXE
PID:612 -
\??\c:\9btnnt.exec:\9btnnt.exe48⤵
- Executes dropped EXE
PID:4852 -
\??\c:\9dvpj.exec:\9dvpj.exe49⤵
- Executes dropped EXE
PID:1192 -
\??\c:\9xrrxll.exec:\9xrrxll.exe50⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rflxflx.exec:\rflxflx.exe51⤵
- Executes dropped EXE
PID:2964 -
\??\c:\htnttt.exec:\htnttt.exe52⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vvppj.exec:\vvppj.exe53⤵
- Executes dropped EXE
PID:4112 -
\??\c:\vpdvj.exec:\vpdvj.exe54⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rrrflrf.exec:\rrrflrf.exe55⤵
- Executes dropped EXE
PID:224 -
\??\c:\fxlfllf.exec:\fxlfllf.exe56⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tnnbbt.exec:\tnnbbt.exe57⤵
- Executes dropped EXE
PID:456 -
\??\c:\htbtnn.exec:\htbtnn.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ddppv.exec:\ddppv.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe60⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rllfffx.exec:\rllfffx.exe61⤵
- Executes dropped EXE
PID:860 -
\??\c:\hbnntt.exec:\hbnntt.exe62⤵
- Executes dropped EXE
PID:3504 -
\??\c:\7ntbtt.exec:\7ntbtt.exe63⤵
- Executes dropped EXE
PID:960 -
\??\c:\nnnhbn.exec:\nnnhbn.exe64⤵
- Executes dropped EXE
PID:4880 -
\??\c:\ppvpd.exec:\ppvpd.exe65⤵
- Executes dropped EXE
PID:3308 -
\??\c:\9rflfff.exec:\9rflfff.exe66⤵PID:4412
-
\??\c:\xfrffll.exec:\xfrffll.exe67⤵PID:4060
-
\??\c:\hhhtnn.exec:\hhhtnn.exe68⤵PID:2696
-
\??\c:\7bbthh.exec:\7bbthh.exe69⤵PID:1540
-
\??\c:\vjpjj.exec:\vjpjj.exe70⤵PID:4160
-
\??\c:\pvpjv.exec:\pvpjv.exe71⤵PID:4476
-
\??\c:\5rlrrxf.exec:\5rlrrxf.exe72⤵PID:1944
-
\??\c:\5xllllf.exec:\5xllllf.exe73⤵PID:1188
-
\??\c:\tbbtnh.exec:\tbbtnh.exe74⤵PID:4780
-
\??\c:\bnhhbb.exec:\bnhhbb.exe75⤵PID:3584
-
\??\c:\jddpp.exec:\jddpp.exe76⤵PID:2592
-
\??\c:\vjdvp.exec:\vjdvp.exe77⤵PID:1616
-
\??\c:\lflffff.exec:\lflffff.exe78⤵PID:1992
-
\??\c:\flrlffr.exec:\flrlffr.exe79⤵PID:3084
-
\??\c:\tnnbbt.exec:\tnnbbt.exe80⤵PID:540
-
\??\c:\ddppp.exec:\ddppp.exe81⤵PID:1512
-
\??\c:\xrrlxfx.exec:\xrrlxfx.exe82⤵PID:836
-
\??\c:\lrlrxlr.exec:\lrlrxlr.exe83⤵PID:4424
-
\??\c:\9bbttt.exec:\9bbttt.exe84⤵PID:4428
-
\??\c:\jvvvv.exec:\jvvvv.exe85⤵PID:3528
-
\??\c:\djpvj.exec:\djpvj.exe86⤵PID:3780
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe87⤵PID:1856
-
\??\c:\bttbtb.exec:\bttbtb.exe88⤵PID:1444
-
\??\c:\7djjd.exec:\7djjd.exe89⤵PID:4908
-
\??\c:\ppvpv.exec:\ppvpv.exe90⤵PID:3076
-
\??\c:\frxlxrf.exec:\frxlxrf.exe91⤵PID:4772
-
\??\c:\tbnnnb.exec:\tbnnnb.exe92⤵PID:4380
-
\??\c:\bthbbt.exec:\bthbbt.exe93⤵PID:1712
-
\??\c:\jjvpj.exec:\jjvpj.exe94⤵PID:2728
-
\??\c:\rrrxflr.exec:\rrrxflr.exe95⤵PID:4888
-
\??\c:\7xfxrll.exec:\7xfxrll.exe96⤵PID:1192
-
\??\c:\btnbtt.exec:\btnbtt.exe97⤵PID:2068
-
\??\c:\vjjdp.exec:\vjjdp.exe98⤵PID:2964
-
\??\c:\jdjdv.exec:\jdjdv.exe99⤵PID:2484
-
\??\c:\lfxfxff.exec:\lfxfxff.exe100⤵PID:4112
-
\??\c:\lrxxffx.exec:\lrxxffx.exe101⤵PID:4312
-
\??\c:\htbtnh.exec:\htbtnh.exe102⤵PID:224
-
\??\c:\1vpdp.exec:\1vpdp.exe103⤵PID:2524
-
\??\c:\fxfffrr.exec:\fxfffrr.exe104⤵PID:1032
-
\??\c:\hbnttb.exec:\hbnttb.exe105⤵PID:2272
-
\??\c:\jpvpj.exec:\jpvpj.exe106⤵PID:3164
-
\??\c:\dvvjp.exec:\dvvjp.exe107⤵PID:628
-
\??\c:\rfxxxfx.exec:\rfxxxfx.exe108⤵PID:2492
-
\??\c:\hhnnbh.exec:\hhnnbh.exe109⤵PID:3332
-
\??\c:\nhtttb.exec:\nhtttb.exe110⤵PID:960
-
\??\c:\djvvp.exec:\djvvp.exe111⤵PID:2420
-
\??\c:\lffxxxr.exec:\lffxxxr.exe112⤵PID:3416
-
\??\c:\5hnhht.exec:\5hnhht.exe113⤵PID:4592
-
\??\c:\hthntn.exec:\hthntn.exe114⤵PID:808
-
\??\c:\5pjdd.exec:\5pjdd.exe115⤵PID:3856
-
\??\c:\pjpdv.exec:\pjpdv.exe116⤵PID:2052
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe117⤵PID:3748
-
\??\c:\nthhnn.exec:\nthhnn.exe118⤵PID:3628
-
\??\c:\hbbtbb.exec:\hbbtbb.exe119⤵PID:4532
-
\??\c:\5pvvv.exec:\5pvvv.exe120⤵PID:2456
-
\??\c:\rfllffx.exec:\rfllffx.exe121⤵PID:3788
-
\??\c:\frxrxxf.exec:\frxrxxf.exe122⤵PID:3604
-
\??\c:\7bbtnn.exec:\7bbtnn.exe123⤵PID:4340
-
\??\c:\tbhbbb.exec:\tbhbbb.exe124⤵PID:1768
-
\??\c:\3lrrffr.exec:\3lrrffr.exe125⤵PID:4868
-
\??\c:\tbbnhn.exec:\tbbnhn.exe126⤵PID:4104
-
\??\c:\tntnbt.exec:\tntnbt.exe127⤵PID:4480
-
\??\c:\jpvpp.exec:\jpvpp.exe128⤵PID:4064
-
\??\c:\xlrxfxl.exec:\xlrxfxl.exe129⤵PID:4428
-
\??\c:\lllxrlf.exec:\lllxrlf.exe130⤵PID:3620
-
\??\c:\hbbnnt.exec:\hbbnnt.exe131⤵PID:4968
-
\??\c:\hbbthh.exec:\hbbthh.exe132⤵PID:1856
-
\??\c:\pjjdp.exec:\pjjdp.exe133⤵PID:2400
-
\??\c:\1jdvp.exec:\1jdvp.exe134⤵PID:4216
-
\??\c:\rllfrrr.exec:\rllfrrr.exe135⤵PID:4080
-
\??\c:\bntnnh.exec:\bntnnh.exe136⤵PID:3288
-
\??\c:\7bbnnn.exec:\7bbnnn.exe137⤵PID:2248
-
\??\c:\vjjdd.exec:\vjjdd.exe138⤵PID:1712
-
\??\c:\vpppp.exec:\vpppp.exe139⤵PID:1956
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe140⤵PID:1924
-
\??\c:\frrrlfx.exec:\frrrlfx.exe141⤵PID:3956
-
\??\c:\7tbbtt.exec:\7tbbtt.exe142⤵PID:1172
-
\??\c:\hnnhbb.exec:\hnnhbb.exe143⤵PID:2964
-
\??\c:\7jjdp.exec:\7jjdp.exe144⤵PID:4356
-
\??\c:\vdjdv.exec:\vdjdv.exe145⤵PID:3448
-
\??\c:\9jpjd.exec:\9jpjd.exe146⤵PID:4664
-
\??\c:\flrfxrf.exec:\flrfxrf.exe147⤵PID:544
-
\??\c:\5thbnb.exec:\5thbnb.exe148⤵PID:3196
-
\??\c:\9djjd.exec:\9djjd.exe149⤵PID:1344
-
\??\c:\dppjd.exec:\dppjd.exe150⤵PID:1220
-
\??\c:\xflfxxf.exec:\xflfxxf.exe151⤵PID:1916
-
\??\c:\xrrlffx.exec:\xrrlffx.exe152⤵PID:3504
-
\??\c:\hbtthh.exec:\hbtthh.exe153⤵PID:4836
-
\??\c:\bhtbnb.exec:\bhtbnb.exe154⤵PID:3608
-
\??\c:\vppjv.exec:\vppjv.exe155⤵PID:3308
-
\??\c:\3jdvv.exec:\3jdvv.exe156⤵PID:2300
-
\??\c:\xflfxxr.exec:\xflfxxr.exe157⤵PID:2932
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe158⤵PID:3752
-
\??\c:\nttthn.exec:\nttthn.exe159⤵PID:1580
-
\??\c:\ttnhbb.exec:\ttnhbb.exe160⤵PID:1464
-
\??\c:\dpdvv.exec:\dpdvv.exe161⤵PID:556
-
\??\c:\ppvpd.exec:\ppvpd.exe162⤵PID:3544
-
\??\c:\9flfllf.exec:\9flfllf.exe163⤵PID:1188
-
\??\c:\xrrrllf.exec:\xrrrllf.exe164⤵PID:4708
-
\??\c:\hnnhbn.exec:\hnnhbn.exe165⤵PID:2592
-
\??\c:\httnhh.exec:\httnhh.exe166⤵PID:1616
-
\??\c:\9hnhtt.exec:\9hnhtt.exe167⤵PID:2004
-
\??\c:\9vjdv.exec:\9vjdv.exe168⤵PID:3924
-
\??\c:\djjdp.exec:\djjdp.exe169⤵PID:4408
-
\??\c:\ppppp.exec:\ppppp.exe170⤵PID:2452
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe171⤵PID:3376
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe172⤵PID:4544
-
\??\c:\hbtnhh.exec:\hbtnhh.exe173⤵PID:3944
-
\??\c:\5bnnhb.exec:\5bnnhb.exe174⤵PID:3620
-
\??\c:\3jpjd.exec:\3jpjd.exe175⤵PID:3372
-
\??\c:\3frrlrl.exec:\3frrlrl.exe176⤵PID:1284
-
\??\c:\thnhbt.exec:\thnhbt.exe177⤵PID:2400
-
\??\c:\pddvd.exec:\pddvd.exe178⤵PID:4772
-
\??\c:\vppdv.exec:\vppdv.exe179⤵PID:4080
-
\??\c:\lfrlxlf.exec:\lfrlxlf.exe180⤵PID:1864
-
\??\c:\nhbbtt.exec:\nhbbtt.exe181⤵PID:2728
-
\??\c:\hbbnhh.exec:\hbbnhh.exe182⤵PID:1596
-
\??\c:\pdvpj.exec:\pdvpj.exe183⤵PID:4552
-
\??\c:\1jppd.exec:\1jppd.exe184⤵PID:4912
-
\??\c:\9fxrfff.exec:\9fxrfff.exe185⤵PID:2296
-
\??\c:\nhtntt.exec:\nhtntt.exe186⤵PID:440
-
\??\c:\5bbhtt.exec:\5bbhtt.exe187⤵PID:3108
-
\??\c:\pdddd.exec:\pdddd.exe188⤵PID:804
-
\??\c:\jdpjj.exec:\jdpjj.exe189⤵PID:224
-
\??\c:\rxrxxxx.exec:\rxrxxxx.exe190⤵PID:2524
-
\??\c:\rrxrlll.exec:\rrxrlll.exe191⤵PID:1032
-
\??\c:\9nttbb.exec:\9nttbb.exe192⤵PID:4472
-
\??\c:\bhhbth.exec:\bhhbth.exe193⤵PID:860
-
\??\c:\ddjdp.exec:\ddjdp.exe194⤵PID:1220
-
\??\c:\3vvvp.exec:\3vvvp.exe195⤵PID:372
-
\??\c:\rflffff.exec:\rflffff.exe196⤵PID:1232
-
\??\c:\lflfxxr.exec:\lflfxxr.exe197⤵PID:1828
-
\??\c:\5hnhhh.exec:\5hnhhh.exe198⤵PID:3608
-
\??\c:\hbhnbh.exec:\hbhnbh.exe199⤵PID:3308
-
\??\c:\3jjvp.exec:\3jjvp.exe200⤵PID:3516
-
\??\c:\9ppjd.exec:\9ppjd.exe201⤵PID:4792
-
\??\c:\rlrlllr.exec:\rlrlllr.exe202⤵PID:3856
-
\??\c:\1bbttt.exec:\1bbttt.exe203⤵PID:3340
-
\??\c:\bttnbb.exec:\bttnbb.exe204⤵PID:3748
-
\??\c:\3jddv.exec:\3jddv.exe205⤵PID:556
-
\??\c:\1pjdp.exec:\1pjdp.exe206⤵PID:3544
-
\??\c:\frrllll.exec:\frrllll.exe207⤵PID:2212
-
\??\c:\rrrrlll.exec:\rrrrlll.exe208⤵PID:1080
-
\??\c:\btbbhh.exec:\btbbhh.exe209⤵PID:2560
-
\??\c:\vvpjj.exec:\vvpjj.exe210⤵PID:1260
-
\??\c:\jjvjv.exec:\jjvjv.exe211⤵PID:2004
-
\??\c:\djddv.exec:\djddv.exe212⤵PID:4008
-
\??\c:\lffxxrr.exec:\lffxxrr.exe213⤵PID:3540
-
\??\c:\tntnnn.exec:\tntnnn.exe214⤵PID:4488
-
\??\c:\3tbtth.exec:\3tbtth.exe215⤵PID:1448
-
\??\c:\jppvd.exec:\jppvd.exe216⤵PID:4544
-
\??\c:\dppjd.exec:\dppjd.exe217⤵PID:4968
-
\??\c:\rllfrfx.exec:\rllfrfx.exe218⤵PID:4756
-
\??\c:\rrrlflf.exec:\rrrlflf.exe219⤵PID:4908
-
\??\c:\llxrlxx.exec:\llxrlxx.exe220⤵PID:1284
-
\??\c:\5nnhnn.exec:\5nnhnn.exe221⤵PID:2400
-
\??\c:\hbhthb.exec:\hbhthb.exe222⤵PID:1064
-
\??\c:\dvvpj.exec:\dvvpj.exe223⤵PID:4080
-
\??\c:\pvvpj.exec:\pvvpj.exe224⤵PID:1864
-
\??\c:\xflfrrl.exec:\xflfrrl.exe225⤵PID:1192
-
\??\c:\5xlfxxr.exec:\5xlfxxr.exe226⤵PID:1596
-
\??\c:\7bttnn.exec:\7bttnn.exe227⤵PID:4872
-
\??\c:\bntttt.exec:\bntttt.exe228⤵PID:3696
-
\??\c:\9bhbtb.exec:\9bhbtb.exe229⤵PID:4112
-
\??\c:\pjppp.exec:\pjppp.exe230⤵PID:4312
-
\??\c:\rlrrlfx.exec:\rlrrlfx.exe231⤵PID:4736
-
\??\c:\1lllffl.exec:\1lllffl.exe232⤵PID:2448
-
\??\c:\1llfrfx.exec:\1llfrfx.exe233⤵PID:544
-
\??\c:\7bnthh.exec:\7bnthh.exe234⤵PID:64
-
\??\c:\7htnbb.exec:\7htnbb.exe235⤵PID:3212
-
\??\c:\ddpjv.exec:\ddpjv.exe236⤵PID:628
-
\??\c:\vdjdp.exec:\vdjdp.exe237⤵PID:1916
-
\??\c:\ffrxllr.exec:\ffrxllr.exe238⤵PID:1220
-
\??\c:\rrffrff.exec:\rrffrff.exe239⤵PID:4836
-
\??\c:\fxrrlll.exec:\fxrrlll.exe240⤵PID:3392
-
\??\c:\5nnnhh.exec:\5nnnhh.exe241⤵PID:1960
-
\??\c:\htbtnn.exec:\htbtnn.exe242⤵PID:4948