Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exe
-
Size
57KB
-
MD5
5e6a553cb762812d652d294b14a9e32f
-
SHA1
82c897c36e86b806471036dcadb0900641432161
-
SHA256
42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2
-
SHA512
4bea111a342fbd7ee78dc72806e8b3399918c67df56f9cc4ef17445f7f65edb83a43abd745f0bae72d1e17d458d5b63ac123b25580210fd00dd98ff2b5853181
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFNI:ymb3NkkiQ3mdBjFIvIFNI
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4252-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4252-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4252-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3184-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3176-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1716-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1216-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3484-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1672-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1672-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3560-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3056-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3944-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4848-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3224-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3472-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3280-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2600-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4636-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4092-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2952-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4908-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1436-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3348-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3036-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3556-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xxxrlll.exeppddp.exelrxrlll.exexrrlxxx.exenhbbbh.exedppjj.exelxxxxlf.exetnhbbb.exenhhbbb.exejjdpp.exeffxxffr.exehnhntn.exedvjpd.exevjdjp.exeffrlffr.exetnthhh.exe3ppjj.exepdjdd.exelfllrrl.exeffffxff.exenbtbhn.exejjvpj.exefflllll.exebhbbtn.exebththt.exe7djjj.exelflfffl.exerrxrrff.exebbnhnn.exeppdpv.exepvpjv.exellrxrff.exehbhhtb.exepjpjj.exerrrlfff.exelfllfff.exehbbhht.exeddvpd.exelxrfrrr.exe5rfxrxx.exehbhbbb.exentbtnn.exedjpdj.exelfrrrxl.exe1nnhhh.exedpvvv.exelffxxxr.exehhhhbh.exe5pvpp.exejjjdj.exerlfxffx.exexxrrffr.exe9bttnn.exenhhhnt.exevdvpj.exerrlllrx.exelfllllf.exenthnnt.exenhhnnn.exejjddd.exe1lrrllf.exelllrrrl.exeffrrrrr.exetntttn.exepid process 4592 xxxrlll.exe 3184 ppddp.exe 3176 lrxrlll.exe 1716 xrrlxxx.exe 3484 nhbbbh.exe 1216 dppjj.exe 3560 lxxxxlf.exe 1672 tnhbbb.exe 3056 nhhbbb.exe 3944 jjdpp.exe 4848 ffxxffr.exe 3224 hnhntn.exe 3688 dvjpd.exe 3472 vjdjp.exe 3280 ffrlffr.exe 2600 tnthhh.exe 4636 3ppjj.exe 4092 pdjdd.exe 2952 lfllrrl.exe 3768 ffffxff.exe 4908 nbtbhn.exe 1436 jjvpj.exe 3348 fflllll.exe 1480 bhbbtn.exe 3036 bththt.exe 4372 7djjj.exe 4368 lflfffl.exe 3232 rrxrrff.exe 3892 bbnhnn.exe 3556 ppdpv.exe 4328 pvpjv.exe 2248 llrxrff.exe 2384 hbhhtb.exe 3172 pjpjj.exe 4788 rrrlfff.exe 2308 lfllfff.exe 4056 hbbhht.exe 4484 ddvpd.exe 2344 lxrfrrr.exe 4384 5rfxrxx.exe 1952 hbhbbb.exe 1852 ntbtnn.exe 2720 djpdj.exe 1552 lfrrrxl.exe 3176 1nnhhh.exe 380 dpvvv.exe 1728 lffxxxr.exe 2536 hhhhbh.exe 3816 5pvpp.exe 1528 jjjdj.exe 2976 rlfxffx.exe 2044 xxrrffr.exe 1736 9bttnn.exe 1300 nhhhnt.exe 4536 vdvpj.exe 4928 rrlllrx.exe 2492 lfllllf.exe 3552 nthnnt.exe 1592 nhhnnn.exe 3244 jjddd.exe 4636 1lrrllf.exe 1232 lllrrrl.exe 1068 ffrrrrr.exe 5092 tntttn.exe -
Processes:
resource yara_rule behavioral2/memory/4252-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exexxxrlll.exeppddp.exelrxrlll.exexrrlxxx.exenhbbbh.exedppjj.exelxxxxlf.exetnhbbb.exenhhbbb.exejjdpp.exeffxxffr.exehnhntn.exedvjpd.exevjdjp.exeffrlffr.exetnthhh.exe3ppjj.exepdjdd.exelfllrrl.exeffffxff.exenbtbhn.exedescription pid process target process PID 4252 wrote to memory of 4592 4252 42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exe xxxrlll.exe PID 4252 wrote to memory of 4592 4252 42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exe xxxrlll.exe PID 4252 wrote to memory of 4592 4252 42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exe xxxrlll.exe PID 4592 wrote to memory of 3184 4592 xxxrlll.exe ppddp.exe PID 4592 wrote to memory of 3184 4592 xxxrlll.exe ppddp.exe PID 4592 wrote to memory of 3184 4592 xxxrlll.exe ppddp.exe PID 3184 wrote to memory of 3176 3184 ppddp.exe lrxrlll.exe PID 3184 wrote to memory of 3176 3184 ppddp.exe lrxrlll.exe PID 3184 wrote to memory of 3176 3184 ppddp.exe lrxrlll.exe PID 3176 wrote to memory of 1716 3176 lrxrlll.exe xrrlxxx.exe PID 3176 wrote to memory of 1716 3176 lrxrlll.exe xrrlxxx.exe PID 3176 wrote to memory of 1716 3176 lrxrlll.exe xrrlxxx.exe PID 1716 wrote to memory of 3484 1716 xrrlxxx.exe nhbbbh.exe PID 1716 wrote to memory of 3484 1716 xrrlxxx.exe nhbbbh.exe PID 1716 wrote to memory of 3484 1716 xrrlxxx.exe nhbbbh.exe PID 3484 wrote to memory of 1216 3484 nhbbbh.exe dppjj.exe PID 3484 wrote to memory of 1216 3484 nhbbbh.exe dppjj.exe PID 3484 wrote to memory of 1216 3484 nhbbbh.exe dppjj.exe PID 1216 wrote to memory of 3560 1216 dppjj.exe lxxxxlf.exe PID 1216 wrote to memory of 3560 1216 dppjj.exe lxxxxlf.exe PID 1216 wrote to memory of 3560 1216 dppjj.exe lxxxxlf.exe PID 3560 wrote to memory of 1672 3560 lxxxxlf.exe tnhbbb.exe PID 3560 wrote to memory of 1672 3560 lxxxxlf.exe tnhbbb.exe PID 3560 wrote to memory of 1672 3560 lxxxxlf.exe tnhbbb.exe PID 1672 wrote to memory of 3056 1672 tnhbbb.exe nhhbbb.exe PID 1672 wrote to memory of 3056 1672 tnhbbb.exe nhhbbb.exe PID 1672 wrote to memory of 3056 1672 tnhbbb.exe nhhbbb.exe PID 3056 wrote to memory of 3944 3056 nhhbbb.exe jjdpp.exe PID 3056 wrote to memory of 3944 3056 nhhbbb.exe jjdpp.exe PID 3056 wrote to memory of 3944 3056 nhhbbb.exe jjdpp.exe PID 3944 wrote to memory of 4848 3944 jjdpp.exe ffxxffr.exe PID 3944 wrote to memory of 4848 3944 jjdpp.exe ffxxffr.exe PID 3944 wrote to memory of 4848 3944 jjdpp.exe ffxxffr.exe PID 4848 wrote to memory of 3224 4848 ffxxffr.exe hnhntn.exe PID 4848 wrote to memory of 3224 4848 ffxxffr.exe hnhntn.exe PID 4848 wrote to memory of 3224 4848 ffxxffr.exe hnhntn.exe PID 3224 wrote to memory of 3688 3224 hnhntn.exe dvjpd.exe PID 3224 wrote to memory of 3688 3224 hnhntn.exe dvjpd.exe PID 3224 wrote to memory of 3688 3224 hnhntn.exe dvjpd.exe PID 3688 wrote to memory of 3472 3688 dvjpd.exe vjdjp.exe PID 3688 wrote to memory of 3472 3688 dvjpd.exe vjdjp.exe PID 3688 wrote to memory of 3472 3688 dvjpd.exe vjdjp.exe PID 3472 wrote to memory of 3280 3472 vjdjp.exe ffrlffr.exe PID 3472 wrote to memory of 3280 3472 vjdjp.exe ffrlffr.exe PID 3472 wrote to memory of 3280 3472 vjdjp.exe ffrlffr.exe PID 3280 wrote to memory of 2600 3280 ffrlffr.exe tnthhh.exe PID 3280 wrote to memory of 2600 3280 ffrlffr.exe tnthhh.exe PID 3280 wrote to memory of 2600 3280 ffrlffr.exe tnthhh.exe PID 2600 wrote to memory of 4636 2600 tnthhh.exe 3ppjj.exe PID 2600 wrote to memory of 4636 2600 tnthhh.exe 3ppjj.exe PID 2600 wrote to memory of 4636 2600 tnthhh.exe 3ppjj.exe PID 4636 wrote to memory of 4092 4636 3ppjj.exe pdjdd.exe PID 4636 wrote to memory of 4092 4636 3ppjj.exe pdjdd.exe PID 4636 wrote to memory of 4092 4636 3ppjj.exe pdjdd.exe PID 4092 wrote to memory of 2952 4092 pdjdd.exe lfllrrl.exe PID 4092 wrote to memory of 2952 4092 pdjdd.exe lfllrrl.exe PID 4092 wrote to memory of 2952 4092 pdjdd.exe lfllrrl.exe PID 2952 wrote to memory of 3768 2952 lfllrrl.exe ffffxff.exe PID 2952 wrote to memory of 3768 2952 lfllrrl.exe ffffxff.exe PID 2952 wrote to memory of 3768 2952 lfllrrl.exe ffffxff.exe PID 3768 wrote to memory of 4908 3768 ffffxff.exe nbtbhn.exe PID 3768 wrote to memory of 4908 3768 ffffxff.exe nbtbhn.exe PID 3768 wrote to memory of 4908 3768 ffffxff.exe nbtbhn.exe PID 4908 wrote to memory of 1436 4908 nbtbhn.exe jjvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exe"C:\Users\Admin\AppData\Local\Temp\42f8e4e562786271d1ba42191a8ccd6bfcdf403692e8eaab16b254a4b5ebb3b2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\xxxrlll.exec:\xxxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\ppddp.exec:\ppddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\lrxrlll.exec:\lrxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nhbbbh.exec:\nhbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\dppjj.exec:\dppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\lxxxxlf.exec:\lxxxxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\tnhbbb.exec:\tnhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\nhhbbb.exec:\nhhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\jjdpp.exec:\jjdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\ffxxffr.exec:\ffxxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\hnhntn.exec:\hnhntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\dvjpd.exec:\dvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\vjdjp.exec:\vjdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\ffrlffr.exec:\ffrlffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\tnthhh.exec:\tnthhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\3ppjj.exec:\3ppjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\pdjdd.exec:\pdjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\lfllrrl.exec:\lfllrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ffffxff.exec:\ffffxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\nbtbhn.exec:\nbtbhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\jjvpj.exec:\jjvpj.exe23⤵
- Executes dropped EXE
PID:1436 -
\??\c:\fflllll.exec:\fflllll.exe24⤵
- Executes dropped EXE
PID:3348 -
\??\c:\bhbbtn.exec:\bhbbtn.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bththt.exec:\bththt.exe26⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7djjj.exec:\7djjj.exe27⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lflfffl.exec:\lflfffl.exe28⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rrxrrff.exec:\rrxrrff.exe29⤵
- Executes dropped EXE
PID:3232 -
\??\c:\bbnhnn.exec:\bbnhnn.exe30⤵
- Executes dropped EXE
PID:3892 -
\??\c:\ppdpv.exec:\ppdpv.exe31⤵
- Executes dropped EXE
PID:3556 -
\??\c:\pvpjv.exec:\pvpjv.exe32⤵
- Executes dropped EXE
PID:4328 -
\??\c:\llrxrff.exec:\llrxrff.exe33⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hbhhtb.exec:\hbhhtb.exe34⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pjpjj.exec:\pjpjj.exe35⤵
- Executes dropped EXE
PID:3172 -
\??\c:\rrrlfff.exec:\rrrlfff.exe36⤵
- Executes dropped EXE
PID:4788 -
\??\c:\lfllfff.exec:\lfllfff.exe37⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hbbhht.exec:\hbbhht.exe38⤵
- Executes dropped EXE
PID:4056 -
\??\c:\ddvpd.exec:\ddvpd.exe39⤵
- Executes dropped EXE
PID:4484 -
\??\c:\lxrfrrr.exec:\lxrfrrr.exe40⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5rfxrxx.exec:\5rfxrxx.exe41⤵
- Executes dropped EXE
PID:4384 -
\??\c:\hbhbbb.exec:\hbhbbb.exe42⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ntbtnn.exec:\ntbtnn.exe43⤵
- Executes dropped EXE
PID:1852 -
\??\c:\djpdj.exec:\djpdj.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe45⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1nnhhh.exec:\1nnhhh.exe46⤵
- Executes dropped EXE
PID:3176 -
\??\c:\dpvvv.exec:\dpvvv.exe47⤵
- Executes dropped EXE
PID:380 -
\??\c:\lffxxxr.exec:\lffxxxr.exe48⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hhhhbh.exec:\hhhhbh.exe49⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5pvpp.exec:\5pvpp.exe50⤵
- Executes dropped EXE
PID:3816 -
\??\c:\jjjdj.exec:\jjjdj.exe51⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlfxffx.exec:\rlfxffx.exe52⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xxrrffr.exec:\xxrrffr.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9bttnn.exec:\9bttnn.exe54⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nhhhnt.exec:\nhhhnt.exe55⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vdvpj.exec:\vdvpj.exe56⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rrlllrx.exec:\rrlllrx.exe57⤵
- Executes dropped EXE
PID:4928 -
\??\c:\lfllllf.exec:\lfllllf.exe58⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nthnnt.exec:\nthnnt.exe59⤵
- Executes dropped EXE
PID:3552 -
\??\c:\nhhnnn.exec:\nhhnnn.exe60⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jjddd.exec:\jjddd.exe61⤵
- Executes dropped EXE
PID:3244 -
\??\c:\1lrrllf.exec:\1lrrllf.exe62⤵
- Executes dropped EXE
PID:4636 -
\??\c:\lllrrrl.exec:\lllrrrl.exe63⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe64⤵
- Executes dropped EXE
PID:1068 -
\??\c:\tntttn.exec:\tntttn.exe65⤵
- Executes dropped EXE
PID:5092 -
\??\c:\vvdvp.exec:\vvdvp.exe66⤵PID:4712
-
\??\c:\vpjpv.exec:\vpjpv.exe67⤵PID:1820
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe68⤵PID:1648
-
\??\c:\3bnhbb.exec:\3bnhbb.exe69⤵PID:3348
-
\??\c:\5nnhbb.exec:\5nnhbb.exe70⤵PID:1796
-
\??\c:\vvddv.exec:\vvddv.exe71⤵PID:3524
-
\??\c:\jdppv.exec:\jdppv.exe72⤵PID:1712
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe73⤵PID:3672
-
\??\c:\hbbttt.exec:\hbbttt.exe74⤵PID:2192
-
\??\c:\dvpjj.exec:\dvpjj.exe75⤵PID:1540
-
\??\c:\5dpjj.exec:\5dpjj.exe76⤵PID:1128
-
\??\c:\lxflffx.exec:\lxflffx.exe77⤵PID:2136
-
\??\c:\tnnntb.exec:\tnnntb.exe78⤵PID:2872
-
\??\c:\jdjjj.exec:\jdjjj.exe79⤵PID:5032
-
\??\c:\xlrrxxr.exec:\xlrrxxr.exe80⤵PID:4916
-
\??\c:\htbbbb.exec:\htbbbb.exe81⤵PID:2916
-
\??\c:\bbtnnt.exec:\bbtnnt.exe82⤵PID:2856
-
\??\c:\djddd.exec:\djddd.exe83⤵PID:1580
-
\??\c:\rflfxxx.exec:\rflfxxx.exe84⤵PID:4860
-
\??\c:\rrllfff.exec:\rrllfff.exe85⤵PID:4064
-
\??\c:\5bbbbn.exec:\5bbbbn.exe86⤵PID:4280
-
\??\c:\xrffxxf.exec:\xrffxxf.exe87⤵PID:4292
-
\??\c:\rrflfxl.exec:\rrflfxl.exe88⤵PID:4312
-
\??\c:\1thbbb.exec:\1thbbb.exe89⤵PID:4592
-
\??\c:\bbtttt.exec:\bbtttt.exe90⤵PID:3168
-
\??\c:\7jdvp.exec:\7jdvp.exe91⤵PID:4456
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe92⤵PID:3176
-
\??\c:\xfxrlrr.exec:\xfxrlrr.exe93⤵PID:5116
-
\??\c:\tthhnt.exec:\tthhnt.exe94⤵PID:1928
-
\??\c:\tthhhh.exec:\tthhhh.exe95⤵PID:3248
-
\??\c:\ppdvd.exec:\ppdvd.exe96⤵PID:704
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe97⤵PID:4228
-
\??\c:\tbtbbn.exec:\tbtbbn.exe98⤵PID:4476
-
\??\c:\jpdpp.exec:\jpdpp.exe99⤵PID:3064
-
\??\c:\pvpjd.exec:\pvpjd.exe100⤵PID:2900
-
\??\c:\ffflllf.exec:\ffflllf.exe101⤵PID:2572
-
\??\c:\nbbbnb.exec:\nbbbnb.exe102⤵PID:3216
-
\??\c:\jdppj.exec:\jdppj.exe103⤵PID:4504
-
\??\c:\ffflxrr.exec:\ffflxrr.exe104⤵PID:4928
-
\??\c:\5ntnnn.exec:\5ntnnn.exe105⤵PID:2492
-
\??\c:\dvvvd.exec:\dvvvd.exe106⤵PID:3552
-
\??\c:\1pvpd.exec:\1pvpd.exe107⤵PID:1592
-
\??\c:\rxffxxx.exec:\rxffxxx.exe108⤵PID:1628
-
\??\c:\ffllllr.exec:\ffllllr.exe109⤵PID:4636
-
\??\c:\tnttnn.exec:\tnttnn.exe110⤵PID:1232
-
\??\c:\bbbthn.exec:\bbbthn.exe111⤵PID:1068
-
\??\c:\pvvpj.exec:\pvvpj.exe112⤵PID:1180
-
\??\c:\hhbbtb.exec:\hhbbtb.exe113⤵PID:4712
-
\??\c:\5nnhbb.exec:\5nnhbb.exe114⤵PID:1820
-
\??\c:\pvvvd.exec:\pvvvd.exe115⤵PID:1648
-
\??\c:\rllxrrr.exec:\rllxrrr.exe116⤵PID:3348
-
\??\c:\lrxxxfl.exec:\lrxxxfl.exe117⤵PID:3524
-
\??\c:\httbtn.exec:\httbtn.exe118⤵PID:4512
-
\??\c:\vvppv.exec:\vvppv.exe119⤵PID:3580
-
\??\c:\pvppv.exec:\pvppv.exe120⤵PID:3200
-
\??\c:\xrffxxx.exec:\xrffxxx.exe121⤵PID:3408
-
\??\c:\lxllxxr.exec:\lxllxxr.exe122⤵PID:1892
-
\??\c:\5bbbbb.exec:\5bbbbb.exe123⤵PID:3372
-
\??\c:\5hnhbt.exec:\5hnhbt.exe124⤵PID:2512
-
\??\c:\1vjjj.exec:\1vjjj.exe125⤵PID:4140
-
\??\c:\xflrrxx.exec:\xflrrxx.exe126⤵PID:1556
-
\??\c:\hhnhbn.exec:\hhnhbn.exe127⤵PID:3612
-
\??\c:\bnbnnt.exec:\bnbnnt.exe128⤵PID:4532
-
\??\c:\jdvvj.exec:\jdvvj.exe129⤵PID:4156
-
\??\c:\xxffllr.exec:\xxffllr.exe130⤵PID:1800
-
\??\c:\tnhbth.exec:\tnhbth.exe131⤵PID:3360
-
\??\c:\ppvvp.exec:\ppvvp.exe132⤵PID:1284
-
\??\c:\rrlflxx.exec:\rrlflxx.exe133⤵PID:3192
-
\??\c:\hbnhbt.exec:\hbnhbt.exe134⤵PID:1924
-
\??\c:\bbtnhh.exec:\bbtnhh.exe135⤵PID:4940
-
\??\c:\ddpvj.exec:\ddpvj.exe136⤵PID:1772
-
\??\c:\vvvjj.exec:\vvvjj.exe137⤵PID:4224
-
\??\c:\frlxlfr.exec:\frlxlfr.exe138⤵PID:4968
-
\??\c:\rxxrrff.exec:\rxxrrff.exe139⤵PID:544
-
\??\c:\bttbbh.exec:\bttbbh.exe140⤵PID:4848
-
\??\c:\vpppj.exec:\vpppj.exe141⤵PID:2908
-
\??\c:\xfxxxll.exec:\xfxxxll.exe142⤵PID:2572
-
\??\c:\lrxrllf.exec:\lrxrllf.exe143⤵PID:3256
-
\??\c:\vpppj.exec:\vpppj.exe144⤵PID:3472
-
\??\c:\ddddv.exec:\ddddv.exe145⤵PID:4748
-
\??\c:\lxlffff.exec:\lxlffff.exe146⤵PID:3552
-
\??\c:\hhtbbh.exec:\hhtbbh.exe147⤵PID:3848
-
\??\c:\dvjjj.exec:\dvjjj.exe148⤵PID:2952
-
\??\c:\5jddj.exec:\5jddj.exe149⤵PID:5108
-
\??\c:\xrxrlll.exec:\xrxrlll.exe150⤵PID:3464
-
\??\c:\tttttb.exec:\tttttb.exe151⤵PID:1352
-
\??\c:\djvvp.exec:\djvvp.exe152⤵PID:3708
-
\??\c:\1xxrrrr.exec:\1xxrrrr.exe153⤵PID:4256
-
\??\c:\5nbtbt.exec:\5nbtbt.exe154⤵PID:4684
-
\??\c:\djvdv.exec:\djvdv.exe155⤵PID:1220
-
\??\c:\rlrxrxl.exec:\rlrxrxl.exe156⤵PID:2240
-
\??\c:\hhnhhb.exec:\hhnhhb.exe157⤵PID:3832
-
\??\c:\pjvdp.exec:\pjvdp.exe158⤵PID:3312
-
\??\c:\nhhhhh.exec:\nhhhhh.exe159⤵PID:1488
-
\??\c:\xfrlrrr.exec:\xfrlrrr.exe160⤵PID:2624
-
\??\c:\djpvv.exec:\djpvv.exe161⤵PID:3356
-
\??\c:\lffxrrl.exec:\lffxrrl.exe162⤵PID:4348
-
\??\c:\9bbhbb.exec:\9bbhbb.exe163⤵PID:3044
-
\??\c:\tnbbtt.exec:\tnbbtt.exe164⤵PID:2384
-
\??\c:\vdvpp.exec:\vdvpp.exe165⤵PID:2688
-
\??\c:\lxlxxff.exec:\lxlxxff.exe166⤵PID:2856
-
\??\c:\lfrxxll.exec:\lfrxxll.exe167⤵PID:3992
-
\??\c:\bthhtt.exec:\bthhtt.exe168⤵PID:556
-
\??\c:\httbtt.exec:\httbtt.exe169⤵PID:1448
-
\??\c:\vjdvp.exec:\vjdvp.exe170⤵PID:4540
-
\??\c:\vdpjd.exec:\vdpjd.exe171⤵PID:2680
-
\??\c:\rlxllrl.exec:\rlxllrl.exe172⤵PID:1716
-
\??\c:\nbntbt.exec:\nbntbt.exe173⤵PID:1624
-
\??\c:\pjjjd.exec:\pjjjd.exe174⤵PID:3800
-
\??\c:\flxxrxr.exec:\flxxrxr.exe175⤵PID:5048
-
\??\c:\frrlfrl.exec:\frrlfrl.exe176⤵PID:812
-
\??\c:\bbbnnh.exec:\bbbnnh.exe177⤵PID:4228
-
\??\c:\jdjvv.exec:\jdjvv.exe178⤵PID:3656
-
\??\c:\llxrxxr.exec:\llxrxxr.exe179⤵PID:1688
-
\??\c:\bhthbb.exec:\bhthbb.exe180⤵PID:2116
-
\??\c:\tnbbhh.exec:\tnbbhh.exe181⤵PID:1300
-
\??\c:\pdpvv.exec:\pdpvv.exe182⤵PID:2252
-
\??\c:\flxlffx.exec:\flxlffx.exe183⤵PID:4464
-
\??\c:\lfxrxlx.exec:\lfxrxlx.exe184⤵PID:4628
-
\??\c:\bnnttb.exec:\bnnttb.exe185⤵PID:1608
-
\??\c:\jdddv.exec:\jdddv.exe186⤵PID:4548
-
\??\c:\jdvjd.exec:\jdvjd.exe187⤵PID:5084
-
\??\c:\rxxxlxx.exec:\rxxxlxx.exe188⤵PID:4020
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe189⤵PID:4524
-
\??\c:\thtbtt.exec:\thtbtt.exe190⤵PID:1180
-
\??\c:\ddjdd.exec:\ddjdd.exe191⤵PID:652
-
\??\c:\vdpjv.exec:\vdpjv.exe192⤵PID:1820
-
\??\c:\ffrfllf.exec:\ffrfllf.exe193⤵PID:1508
-
\??\c:\9nttbn.exec:\9nttbn.exe194⤵PID:2592
-
\??\c:\bbnthb.exec:\bbnthb.exe195⤵PID:2168
-
\??\c:\dvvpj.exec:\dvvpj.exe196⤵PID:3024
-
\??\c:\lxxrllf.exec:\lxxrllf.exe197⤵PID:4024
-
\??\c:\lxxrlll.exec:\lxxrlll.exe198⤵PID:912
-
\??\c:\nhhhhh.exec:\nhhhhh.exe199⤵PID:3408
-
\??\c:\hntbbt.exec:\hntbbt.exe200⤵PID:1824
-
\??\c:\ppddp.exec:\ppddp.exe201⤵PID:2320
-
\??\c:\rflffrx.exec:\rflffrx.exe202⤵PID:2512
-
\??\c:\lllxllx.exec:\lllxllx.exe203⤵PID:3044
-
\??\c:\thnnhn.exec:\thnnhn.exe204⤵PID:3856
-
\??\c:\jdvjp.exec:\jdvjp.exe205⤵PID:4568
-
\??\c:\ppvpp.exec:\ppvpp.exe206⤵PID:4064
-
\??\c:\xllllrr.exec:\xllllrr.exe207⤵PID:4840
-
\??\c:\rxrfrrl.exec:\rxrfrrl.exe208⤵PID:4516
-
\??\c:\hhhbbn.exec:\hhhbbn.exe209⤵PID:3168
-
\??\c:\vdjpp.exec:\vdjpp.exe210⤵PID:1284
-
\??\c:\jjjvv.exec:\jjjvv.exe211⤵PID:1716
-
\??\c:\lfffxrl.exec:\lfffxrl.exe212⤵PID:3616
-
\??\c:\1xxxxxx.exec:\1xxxxxx.exe213⤵PID:2732
-
\??\c:\btbnnn.exec:\btbnnn.exe214⤵PID:2464
-
\??\c:\vpvdp.exec:\vpvdp.exe215⤵PID:4412
-
\??\c:\jpppp.exec:\jpppp.exe216⤵PID:4992
-
\??\c:\rxllfrr.exec:\rxllfrr.exe217⤵PID:3064
-
\??\c:\fffxrrr.exec:\fffxrrr.exe218⤵PID:2908
-
\??\c:\tntttt.exec:\tntttt.exe219⤵PID:4188
-
\??\c:\hbnbht.exec:\hbnbht.exe220⤵PID:1452
-
\??\c:\djjvj.exec:\djjvj.exe221⤵PID:848
-
\??\c:\djppd.exec:\djppd.exe222⤵PID:4776
-
\??\c:\lrxxrrx.exec:\lrxxrrx.exe223⤵PID:3552
-
\??\c:\tnhhhh.exec:\tnhhhh.exe224⤵PID:4636
-
\??\c:\dvvdv.exec:\dvvdv.exe225⤵PID:3768
-
\??\c:\ddddv.exec:\ddddv.exe226⤵PID:440
-
\??\c:\7dppj.exec:\7dppj.exe227⤵PID:4632
-
\??\c:\fxrrfll.exec:\fxrrfll.exe228⤵PID:2792
-
\??\c:\fffffff.exec:\fffffff.exe229⤵PID:2260
-
\??\c:\7bhhbb.exec:\7bhhbb.exe230⤵PID:4372
-
\??\c:\hbnnnh.exec:\hbnnnh.exe231⤵PID:5012
-
\??\c:\ddvjj.exec:\ddvjj.exe232⤵PID:3760
-
\??\c:\jddvj.exec:\jddvj.exe233⤵PID:1940
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe234⤵PID:768
-
\??\c:\7tthtb.exec:\7tthtb.exe235⤵PID:2192
-
\??\c:\thnnbn.exec:\thnnbn.exe236⤵PID:2400
-
\??\c:\vjjjd.exec:\vjjjd.exe237⤵PID:3620
-
\??\c:\3vvpj.exec:\3vvpj.exe238⤵PID:3408
-
\??\c:\9xrrxrf.exec:\9xrrxrf.exe239⤵PID:1824
-
\??\c:\ffrxxxl.exec:\ffrxxxl.exe240⤵PID:2320
-
\??\c:\thtnhh.exec:\thtnhh.exe241⤵PID:412
-
\??\c:\1tbtnn.exec:\1tbtnn.exe242⤵PID:2772