Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exe
-
Size
65KB
-
MD5
7804890590d429bbabbf2215439a9bb2
-
SHA1
6dab948dbf084bcd2675a1a27bcf452b7f6747ea
-
SHA256
40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f
-
SHA512
383ac7349d940e48f3b2f634ca42ea1f1dcde2fcac66786cce391b2ade6a3d14e66643bb0a25b9005af8581bcb27175b1da618820ec5c67986223519dd8d80db
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdT:ymb3NkkiQ3mdBjF0yMlM
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/348-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral2/memory/348-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2464-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2548-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3952-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2648-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2340-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2648-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2648-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2648-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2524-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3876-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4500-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5092-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/840-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2360-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3940-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1780-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2560-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4720-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/456-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1868-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3352-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/740-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4308-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2920-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4972-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bhttht.exenbttbb.exepddpv.exefxlfxff.exe5tbhtb.exejdpjp.exefxfllxl.exelffxfxr.exebbbbbb.exejvvvv.exedvvpv.exe5ntnhn.exejdjjd.exexlrlffx.exebnnhnb.exe3pvvp.exexxxrllf.exe1lfxrrr.exe3nnnhn.exejvddv.exe5jpjd.exerlllllr.exerflrfll.exehhnbtb.exe7pppp.exe7djjd.exelfrllxf.exenhhbtt.exexlrxlfr.exetntnnn.exedpvvv.exelxxflrf.exethtttt.exeddjjd.exexlfxrrr.exebbbtnn.exetttttb.exevvvvv.exerrffffx.exe3hnnnb.exehtbnnt.exejvdvd.exevjjvj.exelffxrff.exe7htthn.exebtbbtb.exevvppp.exefffxxxf.exenntttb.exetnnbbb.exevjjjd.exe7frrrxx.exenbbnhb.exetbbbhn.exejdjdd.exepjvdd.exelfllxfx.exexrrrrrr.exetttbhh.exepvvdv.exerlfrflx.exerlrlrrx.exehbtttt.exejjvvv.exepid process 2464 bhttht.exe 348 nbttbb.exe 3772 pddpv.exe 2548 fxlfxff.exe 3952 5tbhtb.exe 2524 jdpjp.exe 2648 fxfllxl.exe 2340 lffxfxr.exe 1832 bbbbbb.exe 3876 jvvvv.exe 4500 dvvpv.exe 5092 5ntnhn.exe 840 jdjjd.exe 2360 xlrlffx.exe 1096 bnnhnb.exe 3940 3pvvp.exe 3388 xxxrllf.exe 1780 1lfxrrr.exe 4356 3nnnhn.exe 2560 jvddv.exe 4720 5jpjd.exe 2448 rlllllr.exe 456 rflrfll.exe 3588 hhnbtb.exe 1868 7pppp.exe 4996 7djjd.exe 3352 lfrllxf.exe 740 nhhbtt.exe 4308 xlrxlfr.exe 2920 tntnnn.exe 4972 dpvvv.exe 2900 lxxflrf.exe 4452 thtttt.exe 4008 ddjjd.exe 2596 xlfxrrr.exe 1224 bbbtnn.exe 388 tttttb.exe 4280 vvvvv.exe 1164 rrffffx.exe 3712 3hnnnb.exe 2928 htbnnt.exe 4784 jvdvd.exe 4372 vjjvj.exe 2720 lffxrff.exe 2364 7htthn.exe 1584 btbbtb.exe 3028 vvppp.exe 1960 fffxxxf.exe 1268 nntttb.exe 1716 tnnbbb.exe 3388 vjjjd.exe 3076 7frrrxx.exe 3092 nbbnhb.exe 3508 tbbbhn.exe 1608 jdjdd.exe 3164 pjvdd.exe 3108 lfllxfx.exe 1560 xrrrrrr.exe 2452 tttbhh.exe 5072 pvvdv.exe 3304 rlfrflx.exe 2676 rlrlrrx.exe 5028 hbtttt.exe 2348 jjvvv.exe -
Processes:
resource yara_rule behavioral2/memory/348-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exebhttht.exenbttbb.exepddpv.exefxlfxff.exe5tbhtb.exejdpjp.exefxfllxl.exelffxfxr.exebbbbbb.exejvvvv.exedvvpv.exe5ntnhn.exejdjjd.exexlrlffx.exebnnhnb.exe3pvvp.exexxxrllf.exe1lfxrrr.exe3nnnhn.exejvddv.exe5jpjd.exedescription pid process target process PID 2108 wrote to memory of 2464 2108 40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exe bhttht.exe PID 2108 wrote to memory of 2464 2108 40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exe bhttht.exe PID 2108 wrote to memory of 2464 2108 40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exe bhttht.exe PID 2464 wrote to memory of 348 2464 bhttht.exe nbttbb.exe PID 2464 wrote to memory of 348 2464 bhttht.exe nbttbb.exe PID 2464 wrote to memory of 348 2464 bhttht.exe nbttbb.exe PID 348 wrote to memory of 3772 348 nbttbb.exe pddpv.exe PID 348 wrote to memory of 3772 348 nbttbb.exe pddpv.exe PID 348 wrote to memory of 3772 348 nbttbb.exe pddpv.exe PID 3772 wrote to memory of 2548 3772 pddpv.exe fxlfxff.exe PID 3772 wrote to memory of 2548 3772 pddpv.exe fxlfxff.exe PID 3772 wrote to memory of 2548 3772 pddpv.exe fxlfxff.exe PID 2548 wrote to memory of 3952 2548 fxlfxff.exe 5tbhtb.exe PID 2548 wrote to memory of 3952 2548 fxlfxff.exe 5tbhtb.exe PID 2548 wrote to memory of 3952 2548 fxlfxff.exe 5tbhtb.exe PID 3952 wrote to memory of 2524 3952 5tbhtb.exe jdpjp.exe PID 3952 wrote to memory of 2524 3952 5tbhtb.exe jdpjp.exe PID 3952 wrote to memory of 2524 3952 5tbhtb.exe jdpjp.exe PID 2524 wrote to memory of 2648 2524 jdpjp.exe fxfllxl.exe PID 2524 wrote to memory of 2648 2524 jdpjp.exe fxfllxl.exe PID 2524 wrote to memory of 2648 2524 jdpjp.exe fxfllxl.exe PID 2648 wrote to memory of 2340 2648 fxfllxl.exe lffxfxr.exe PID 2648 wrote to memory of 2340 2648 fxfllxl.exe lffxfxr.exe PID 2648 wrote to memory of 2340 2648 fxfllxl.exe lffxfxr.exe PID 2340 wrote to memory of 1832 2340 lffxfxr.exe bbbbbb.exe PID 2340 wrote to memory of 1832 2340 lffxfxr.exe bbbbbb.exe PID 2340 wrote to memory of 1832 2340 lffxfxr.exe bbbbbb.exe PID 1832 wrote to memory of 3876 1832 bbbbbb.exe jvvvv.exe PID 1832 wrote to memory of 3876 1832 bbbbbb.exe jvvvv.exe PID 1832 wrote to memory of 3876 1832 bbbbbb.exe jvvvv.exe PID 3876 wrote to memory of 4500 3876 jvvvv.exe dvvpv.exe PID 3876 wrote to memory of 4500 3876 jvvvv.exe dvvpv.exe PID 3876 wrote to memory of 4500 3876 jvvvv.exe dvvpv.exe PID 4500 wrote to memory of 5092 4500 dvvpv.exe 5ntnhn.exe PID 4500 wrote to memory of 5092 4500 dvvpv.exe 5ntnhn.exe PID 4500 wrote to memory of 5092 4500 dvvpv.exe 5ntnhn.exe PID 5092 wrote to memory of 840 5092 5ntnhn.exe jdjjd.exe PID 5092 wrote to memory of 840 5092 5ntnhn.exe jdjjd.exe PID 5092 wrote to memory of 840 5092 5ntnhn.exe jdjjd.exe PID 840 wrote to memory of 2360 840 jdjjd.exe xlrlffx.exe PID 840 wrote to memory of 2360 840 jdjjd.exe xlrlffx.exe PID 840 wrote to memory of 2360 840 jdjjd.exe xlrlffx.exe PID 2360 wrote to memory of 1096 2360 xlrlffx.exe bnnhnb.exe PID 2360 wrote to memory of 1096 2360 xlrlffx.exe bnnhnb.exe PID 2360 wrote to memory of 1096 2360 xlrlffx.exe bnnhnb.exe PID 1096 wrote to memory of 3940 1096 bnnhnb.exe 3pvvp.exe PID 1096 wrote to memory of 3940 1096 bnnhnb.exe 3pvvp.exe PID 1096 wrote to memory of 3940 1096 bnnhnb.exe 3pvvp.exe PID 3940 wrote to memory of 3388 3940 3pvvp.exe xxxrllf.exe PID 3940 wrote to memory of 3388 3940 3pvvp.exe xxxrllf.exe PID 3940 wrote to memory of 3388 3940 3pvvp.exe xxxrllf.exe PID 3388 wrote to memory of 1780 3388 xxxrllf.exe 1lfxrrr.exe PID 3388 wrote to memory of 1780 3388 xxxrllf.exe 1lfxrrr.exe PID 3388 wrote to memory of 1780 3388 xxxrllf.exe 1lfxrrr.exe PID 1780 wrote to memory of 4356 1780 1lfxrrr.exe 3nnnhn.exe PID 1780 wrote to memory of 4356 1780 1lfxrrr.exe 3nnnhn.exe PID 1780 wrote to memory of 4356 1780 1lfxrrr.exe 3nnnhn.exe PID 4356 wrote to memory of 2560 4356 3nnnhn.exe jvddv.exe PID 4356 wrote to memory of 2560 4356 3nnnhn.exe jvddv.exe PID 4356 wrote to memory of 2560 4356 3nnnhn.exe jvddv.exe PID 2560 wrote to memory of 4720 2560 jvddv.exe 5jpjd.exe PID 2560 wrote to memory of 4720 2560 jvddv.exe 5jpjd.exe PID 2560 wrote to memory of 4720 2560 jvddv.exe 5jpjd.exe PID 4720 wrote to memory of 2448 4720 5jpjd.exe rlllllr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exe"C:\Users\Admin\AppData\Local\Temp\40f732aa8af3055823efe43e5f7c6e2458dbb2f73942fab5982e4a994fff3c2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\bhttht.exec:\bhttht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\nbttbb.exec:\nbttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\pddpv.exec:\pddpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\fxlfxff.exec:\fxlfxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5tbhtb.exec:\5tbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\jdpjp.exec:\jdpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\fxfllxl.exec:\fxfllxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lffxfxr.exec:\lffxfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\bbbbbb.exec:\bbbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\jvvvv.exec:\jvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\dvvpv.exec:\dvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\5ntnhn.exec:\5ntnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\jdjjd.exec:\jdjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\xlrlffx.exec:\xlrlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bnnhnb.exec:\bnnhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\3pvvp.exec:\3pvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\xxxrllf.exec:\xxxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\1lfxrrr.exec:\1lfxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\3nnnhn.exec:\3nnnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\jvddv.exec:\jvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5jpjd.exec:\5jpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\rlllllr.exec:\rlllllr.exe23⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rflrfll.exec:\rflrfll.exe24⤵
- Executes dropped EXE
PID:456 -
\??\c:\hhnbtb.exec:\hhnbtb.exe25⤵
- Executes dropped EXE
PID:3588 -
\??\c:\7pppp.exec:\7pppp.exe26⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7djjd.exec:\7djjd.exe27⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lfrllxf.exec:\lfrllxf.exe28⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nhhbtt.exec:\nhhbtt.exe29⤵
- Executes dropped EXE
PID:740 -
\??\c:\xlrxlfr.exec:\xlrxlfr.exe30⤵
- Executes dropped EXE
PID:4308 -
\??\c:\tntnnn.exec:\tntnnn.exe31⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dpvvv.exec:\dpvvv.exe32⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lxxflrf.exec:\lxxflrf.exe33⤵
- Executes dropped EXE
PID:2900 -
\??\c:\thtttt.exec:\thtttt.exe34⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ddjjd.exec:\ddjjd.exe35⤵
- Executes dropped EXE
PID:4008 -
\??\c:\xlfxrrr.exec:\xlfxrrr.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bbbtnn.exec:\bbbtnn.exe37⤵
- Executes dropped EXE
PID:1224 -
\??\c:\tttttb.exec:\tttttb.exe38⤵
- Executes dropped EXE
PID:388 -
\??\c:\vvvvv.exec:\vvvvv.exe39⤵
- Executes dropped EXE
PID:4280 -
\??\c:\rrffffx.exec:\rrffffx.exe40⤵
- Executes dropped EXE
PID:1164 -
\??\c:\3hnnnb.exec:\3hnnnb.exe41⤵
- Executes dropped EXE
PID:3712 -
\??\c:\htbnnt.exec:\htbnnt.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jvdvd.exec:\jvdvd.exe43⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vjjvj.exec:\vjjvj.exe44⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lffxrff.exec:\lffxrff.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7htthn.exec:\7htthn.exe46⤵
- Executes dropped EXE
PID:2364 -
\??\c:\btbbtb.exec:\btbbtb.exe47⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vvppp.exec:\vvppp.exe48⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fffxxxf.exec:\fffxxxf.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nntttb.exec:\nntttb.exe50⤵
- Executes dropped EXE
PID:1268 -
\??\c:\tnnbbb.exec:\tnnbbb.exe51⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vjjjd.exec:\vjjjd.exe52⤵
- Executes dropped EXE
PID:3388 -
\??\c:\7frrrxx.exec:\7frrrxx.exe53⤵
- Executes dropped EXE
PID:3076 -
\??\c:\nbbnhb.exec:\nbbnhb.exe54⤵
- Executes dropped EXE
PID:3092 -
\??\c:\tbbbhn.exec:\tbbbhn.exe55⤵
- Executes dropped EXE
PID:3508 -
\??\c:\jdjdd.exec:\jdjdd.exe56⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pjvdd.exec:\pjvdd.exe57⤵
- Executes dropped EXE
PID:3164 -
\??\c:\lfllxfx.exec:\lfllxfx.exe58⤵
- Executes dropped EXE
PID:3108 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe59⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tttbhh.exec:\tttbhh.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pvvdv.exec:\pvvdv.exe61⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rlfrflx.exec:\rlfrflx.exe62⤵
- Executes dropped EXE
PID:3304 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe63⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hbtttt.exec:\hbtttt.exe64⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jjvvv.exec:\jjvvv.exe65⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xxlllll.exec:\xxlllll.exe66⤵PID:2372
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe67⤵PID:2500
-
\??\c:\btttnt.exec:\btttnt.exe68⤵PID:1220
-
\??\c:\jjddv.exec:\jjddv.exe69⤵PID:2548
-
\??\c:\jjvvv.exec:\jjvvv.exe70⤵PID:908
-
\??\c:\5xxrlrr.exec:\5xxrlrr.exe71⤵PID:4548
-
\??\c:\btbbtt.exec:\btbbtt.exe72⤵PID:4448
-
\??\c:\7tbttt.exec:\7tbttt.exe73⤵PID:4204
-
\??\c:\7jvpd.exec:\7jvpd.exe74⤵PID:3704
-
\??\c:\3pvjv.exec:\3pvjv.exe75⤵PID:1832
-
\??\c:\rllxfff.exec:\rllxfff.exe76⤵PID:4660
-
\??\c:\bhbbnh.exec:\bhbbnh.exe77⤵PID:3156
-
\??\c:\3hhbnn.exec:\3hhbnn.exe78⤵PID:4372
-
\??\c:\jjddv.exec:\jjddv.exe79⤵PID:3656
-
\??\c:\pvddv.exec:\pvddv.exe80⤵PID:2360
-
\??\c:\rfflfrx.exec:\rfflfrx.exe81⤵PID:1840
-
\??\c:\bhnbhh.exec:\bhnbhh.exe82⤵PID:1096
-
\??\c:\dvvvp.exec:\dvvvp.exe83⤵PID:2272
-
\??\c:\pdddd.exec:\pdddd.exe84⤵PID:1880
-
\??\c:\flllfff.exec:\flllfff.exe85⤵PID:4828
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe86⤵PID:960
-
\??\c:\bbhntb.exec:\bbhntb.exe87⤵PID:3608
-
\??\c:\pddpp.exec:\pddpp.exe88⤵PID:4388
-
\??\c:\vpdjj.exec:\vpdjj.exe89⤵PID:4916
-
\??\c:\1flrfff.exec:\1flrfff.exe90⤵PID:3532
-
\??\c:\btnhhh.exec:\btnhhh.exe91⤵PID:2888
-
\??\c:\jpddv.exec:\jpddv.exe92⤵PID:3020
-
\??\c:\rlllfff.exec:\rlllfff.exe93⤵PID:3424
-
\??\c:\nthnhn.exec:\nthnhn.exe94⤵PID:2784
-
\??\c:\nbhntn.exec:\nbhntn.exe95⤵PID:3352
-
\??\c:\jpppd.exec:\jpppd.exe96⤵PID:4328
-
\??\c:\ddddd.exec:\ddddd.exe97⤵PID:3332
-
\??\c:\llllfff.exec:\llllfff.exe98⤵PID:3556
-
\??\c:\rfffllf.exec:\rfffllf.exe99⤵PID:2916
-
\??\c:\tthnnt.exec:\tthnnt.exe100⤵PID:2372
-
\??\c:\dvdjj.exec:\dvdjj.exe101⤵PID:4844
-
\??\c:\xxllxxl.exec:\xxllxxl.exe102⤵PID:4948
-
\??\c:\nnttnt.exec:\nnttnt.exe103⤵PID:4848
-
\??\c:\bnbttt.exec:\bnbttt.exe104⤵PID:744
-
\??\c:\jjvjp.exec:\jjvjp.exe105⤵PID:3464
-
\??\c:\rxflrlf.exec:\rxflrlf.exe106⤵PID:1776
-
\??\c:\xxlrrrf.exec:\xxlrrrf.exe107⤵PID:3480
-
\??\c:\9hbbbt.exec:\9hbbbt.exe108⤵PID:4032
-
\??\c:\hthnth.exec:\hthnth.exe109⤵PID:2800
-
\??\c:\pdjvv.exec:\pdjvv.exe110⤵PID:2924
-
\??\c:\xfffxfl.exec:\xfffxfl.exe111⤵PID:1524
-
\??\c:\bnbnth.exec:\bnbnth.exe112⤵PID:4264
-
\??\c:\pdpvp.exec:\pdpvp.exe113⤵PID:3656
-
\??\c:\xlrlxfx.exec:\xlrlxfx.exe114⤵PID:2360
-
\??\c:\5jjdv.exec:\5jjdv.exe115⤵PID:1956
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe116⤵PID:4380
-
\??\c:\7hhthh.exec:\7hhthh.exe117⤵PID:1276
-
\??\c:\tnhbtn.exec:\tnhbtn.exe118⤵PID:4676
-
\??\c:\1pvdv.exec:\1pvdv.exe119⤵PID:4580
-
\??\c:\3pddj.exec:\3pddj.exe120⤵PID:3560
-
\??\c:\rxffflf.exec:\rxffflf.exe121⤵PID:3536
-
\??\c:\3bnntb.exec:\3bnntb.exe122⤵PID:3164
-
\??\c:\5thtnn.exec:\5thtnn.exe123⤵PID:3532
-
\??\c:\jdddd.exec:\jdddd.exe124⤵PID:2652
-
\??\c:\fflfrrf.exec:\fflfrrf.exe125⤵PID:2204
-
\??\c:\nthnnb.exec:\nthnnb.exe126⤵PID:2812
-
\??\c:\5vdvp.exec:\5vdvp.exe127⤵PID:5032
-
\??\c:\5rxrlfx.exec:\5rxrlfx.exe128⤵PID:3304
-
\??\c:\btnnhh.exec:\btnnhh.exe129⤵PID:2676
-
\??\c:\1hhbbh.exec:\1hhbbh.exe130⤵PID:244
-
\??\c:\jpddd.exec:\jpddd.exe131⤵PID:1272
-
\??\c:\lxlxxfr.exec:\lxlxxfr.exe132⤵PID:2872
-
\??\c:\9xrxlxf.exec:\9xrxlxf.exe133⤵PID:1852
-
\??\c:\1tbnht.exec:\1tbnht.exe134⤵PID:1592
-
\??\c:\bnthtn.exec:\bnthtn.exe135⤵PID:2596
-
\??\c:\dpjjv.exec:\dpjjv.exe136⤵PID:3948
-
\??\c:\jvpdj.exec:\jvpdj.exe137⤵PID:3720
-
\??\c:\lxfllrl.exec:\lxfllrl.exe138⤵PID:4528
-
\??\c:\nhnbnn.exec:\nhnbnn.exe139⤵PID:3712
-
\??\c:\nhbttb.exec:\nhbttb.exe140⤵PID:1832
-
\??\c:\dvjvp.exec:\dvjvp.exe141⤵PID:5048
-
\??\c:\dpvvd.exec:\dpvvd.exe142⤵PID:2720
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe143⤵PID:3600
-
\??\c:\1rrllxx.exec:\1rrllxx.exe144⤵PID:4264
-
\??\c:\7bhhbh.exec:\7bhhbh.exe145⤵PID:3384
-
\??\c:\ppvvv.exec:\ppvvv.exe146⤵PID:1960
-
\??\c:\vpdvv.exec:\vpdvv.exe147⤵PID:1880
-
\??\c:\fllxrxr.exec:\fllxrxr.exe148⤵PID:1648
-
\??\c:\rrlfxff.exec:\rrlfxff.exe149⤵PID:4732
-
\??\c:\5hhbbb.exec:\5hhbbb.exe150⤵PID:960
-
\??\c:\tttttn.exec:\tttttn.exe151⤵PID:1808
-
\??\c:\jdpjv.exec:\jdpjv.exe152⤵PID:4944
-
\??\c:\rlrfxlr.exec:\rlrfxlr.exe153⤵PID:2756
-
\??\c:\xfxrlrl.exec:\xfxrlrl.exe154⤵PID:5088
-
\??\c:\9bhhhh.exec:\9bhhhh.exe155⤵PID:3892
-
\??\c:\pvvpj.exec:\pvvpj.exe156⤵PID:3484
-
\??\c:\3dddv.exec:\3dddv.exe157⤵PID:2640
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe158⤵PID:3696
-
\??\c:\bnhbth.exec:\bnhbth.exe159⤵PID:3332
-
\??\c:\ntthtn.exec:\ntthtn.exe160⤵PID:244
-
\??\c:\pvpjv.exec:\pvpjv.exe161⤵PID:1272
-
\??\c:\vdjvp.exec:\vdjvp.exe162⤵PID:4844
-
\??\c:\5llfffx.exec:\5llfffx.exe163⤵PID:908
-
\??\c:\9lrrlxx.exec:\9lrrlxx.exe164⤵PID:388
-
\??\c:\7ttnht.exec:\7ttnht.exe165⤵PID:4448
-
\??\c:\dpvdv.exec:\dpvdv.exe166⤵PID:2732
-
\??\c:\jvpjd.exec:\jvpjd.exe167⤵PID:3480
-
\??\c:\xlxxrfr.exec:\xlxxrfr.exe168⤵PID:4500
-
\??\c:\rxrfrlr.exec:\rxrfrlr.exe169⤵PID:4032
-
\??\c:\bbhhhh.exec:\bbhhhh.exe170⤵PID:384
-
\??\c:\bttttt.exec:\bttttt.exe171⤵PID:2720
-
\??\c:\dvdvp.exec:\dvdvp.exe172⤵PID:3132
-
\??\c:\vdvjd.exec:\vdvjd.exe173⤵PID:4264
-
\??\c:\rllllrr.exec:\rllllrr.exe174⤵PID:5056
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe175⤵PID:1960
-
\??\c:\1hnbnb.exec:\1hnbnb.exe176⤵PID:3092
-
\??\c:\btbbtt.exec:\btbbtt.exe177⤵PID:4732
-
\??\c:\7vvvp.exec:\7vvvp.exe178⤵PID:4492
-
\??\c:\3fllxxf.exec:\3fllxxf.exe179⤵PID:4152
-
\??\c:\fffxxxx.exec:\fffxxxx.exe180⤵PID:2756
-
\??\c:\httttb.exec:\httttb.exe181⤵PID:4460
-
\??\c:\tthnth.exec:\tthnth.exe182⤵PID:2640
-
\??\c:\3rffffr.exec:\3rffffr.exe183⤵PID:3556
-
\??\c:\xxrxrxf.exec:\xxrxrxf.exe184⤵PID:1380
-
\??\c:\hntnbh.exec:\hntnbh.exe185⤵PID:4008
-
\??\c:\bnbbtn.exec:\bnbbtn.exe186⤵PID:2548
-
\??\c:\7ppjj.exec:\7ppjj.exe187⤵PID:1852
-
\??\c:\3fflrff.exec:\3fflrff.exe188⤵PID:4848
-
\??\c:\hthnhh.exec:\hthnhh.exe189⤵PID:1924
-
\??\c:\bthhhn.exec:\bthhhn.exe190⤵PID:2732
-
\??\c:\jdjdv.exec:\jdjdv.exe191⤵PID:4528
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe192⤵PID:464
-
\??\c:\5rxrrrl.exec:\5rxrrrl.exe193⤵PID:2924
-
\??\c:\btbbbb.exec:\btbbbb.exe194⤵PID:1768
-
\??\c:\9vpjd.exec:\9vpjd.exe195⤵PID:2760
-
\??\c:\3lxrfff.exec:\3lxrfff.exe196⤵PID:4220
-
\??\c:\xlffrlx.exec:\xlffrlx.exe197⤵PID:4264
-
\??\c:\hbnnbb.exec:\hbnnbb.exe198⤵PID:1716
-
\??\c:\vpjdd.exec:\vpjdd.exe199⤵PID:1696
-
\??\c:\xxxrlll.exec:\xxxrlll.exe200⤵PID:3796
-
\??\c:\bbnbnb.exec:\bbnbnb.exe201⤵PID:4732
-
\??\c:\5jpjj.exec:\5jpjj.exe202⤵PID:2124
-
\??\c:\lrrfllf.exec:\lrrfllf.exe203⤵PID:4152
-
\??\c:\bhhbbn.exec:\bhhbbn.exe204⤵PID:2756
-
\??\c:\bhhnnh.exec:\bhhnnh.exe205⤵PID:4460
-
\??\c:\ffrlxlx.exec:\ffrlxlx.exe206⤵PID:2640
-
\??\c:\htntnn.exec:\htntnn.exe207⤵PID:3556
-
\??\c:\vvjdp.exec:\vvjdp.exe208⤵PID:1380
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe209⤵PID:4008
-
\??\c:\jdpjp.exec:\jdpjp.exe210⤵PID:2548
-
\??\c:\hnhbth.exec:\hnhbth.exe211⤵PID:388
-
\??\c:\vvjjj.exec:\vvjjj.exe212⤵PID:4848
-
\??\c:\ttnbnb.exec:\ttnbnb.exe213⤵PID:5004
-
\??\c:\9tnntb.exec:\9tnntb.exe214⤵PID:5036
-
\??\c:\dppvv.exec:\dppvv.exe215⤵PID:4528
-
\??\c:\frffrrr.exec:\frffrrr.exe216⤵PID:436
-
\??\c:\lffffff.exec:\lffffff.exe217⤵PID:3756
-
\??\c:\bnnhhb.exec:\bnnhhb.exe218⤵PID:4584
-
\??\c:\1nttnh.exec:\1nttnh.exe219⤵PID:2760
-
\??\c:\jjppp.exec:\jjppp.exe220⤵PID:4364
-
\??\c:\lrrlrff.exec:\lrrlrff.exe221⤵PID:1960
-
\??\c:\xfrfrfx.exec:\xfrfrfx.exe222⤵PID:348
-
\??\c:\bbnbnt.exec:\bbnbnt.exe223⤵PID:4576
-
\??\c:\9ddpj.exec:\9ddpj.exe224⤵PID:4492
-
\??\c:\vppjv.exec:\vppjv.exe225⤵PID:968
-
\??\c:\xffxlfx.exec:\xffxlfx.exe226⤵PID:3424
-
\??\c:\thhbnh.exec:\thhbnh.exe227⤵PID:3484
-
\??\c:\hbhhtn.exec:\hbhhtn.exe228⤵PID:3304
-
\??\c:\jdvdj.exec:\jdvdj.exe229⤵PID:3808
-
\??\c:\7lrfxxf.exec:\7lrfxxf.exe230⤵PID:2500
-
\??\c:\1rxlfff.exec:\1rxlfff.exe231⤵PID:4252
-
\??\c:\htnbbh.exec:\htnbbh.exe232⤵PID:3340
-
\??\c:\hhnnbb.exec:\hhnnbb.exe233⤵PID:4008
-
\??\c:\jjpjd.exec:\jjpjd.exe234⤵PID:4204
-
\??\c:\djddp.exec:\djddp.exe235⤵PID:1924
-
\??\c:\fxfrrrr.exec:\fxfrrrr.exe236⤵PID:1348
-
\??\c:\1llffxf.exec:\1llffxf.exe237⤵PID:2188
-
\??\c:\tthtbn.exec:\tthtbn.exe238⤵PID:5036
-
\??\c:\tntnhh.exec:\tntnhh.exe239⤵PID:4372
-
\??\c:\vjppp.exec:\vjppp.exe240⤵PID:840
-
\??\c:\lfllxlx.exec:\lfllxlx.exe241⤵PID:3028
-
\??\c:\llxlffl.exec:\llxlffl.exe242⤵PID:5056