Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe
-
Size
345KB
-
MD5
190831908333df1dbde6f87601ea90b6
-
SHA1
7ce05d6cc63a19b512521e1515417ff3e7c4d214
-
SHA256
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82
-
SHA512
8d1887df78b9c083d13403fee900ae0f118f5067fc7902bd92c2a860917d0d261724a4e34b81cb225296cc80db6b6cd17d5fa3d51130c862c802ac78fcb04e0a
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyIl:n3C9uDnUXoSWlnwJv90aKToFqwfIBL
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/876-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
Processes:
resource yara_rule behavioral2/memory/876-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4872-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1712-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1672-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4832-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2060-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2324-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1300-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2320-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3712-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1748-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2468-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3044-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
pdppd.exerxrllff.exe9hnbht.exe5pddv.exe9rlxrrl.exefrrxrlf.exevvdpd.exexlfffxx.exevjjjj.exexrxrrxx.exe3jjvp.exetnbtbb.exelfxrrrr.exebntnnn.exerflfffx.exe1tntth.exexrlxllx.exevvdpd.exe1xllrxr.exefxlflll.exejdvpv.exexlxxfrl.exehhnhnt.exejpvvv.exelfrfrrx.exehttnhn.exerrlfxxf.exellllfff.exefxxxrrr.exevjjdv.exedjjpp.exexrxrlxr.exebthbtb.exe1vdpj.exexffxrff.exefxxrlll.exebtthnb.exepdjdv.exefrflfxr.exelfrlffx.exebhhhbt.exejvvdv.exe9fffxxr.exetbnnht.exevpvvv.exepjvpd.exe5lfxlrf.exe5bbbtt.exebtnbnh.exe3pvpp.exelrfrffx.exerfxrlfx.exebnnhhh.exevjvjj.exejvdpj.exexrlrlrr.exe7ntnhh.exejppjd.exe7lrlfll.exelfllrxx.exebhnnnt.exejdjdv.exerlrlffx.exehtbbtt.exepid process 5112 pdppd.exe 4872 rxrllff.exe 4896 9hnbht.exe 1672 5pddv.exe 516 9rlxrrl.exe 5060 frrxrlf.exe 1712 vvdpd.exe 4112 xlfffxx.exe 4832 vjjjj.exe 3268 xrxrrxx.exe 3292 3jjvp.exe 2060 tnbtbb.exe 2324 lfxrrrr.exe 1300 bntnnn.exe 2320 rflfffx.exe 3712 1tntth.exe 1748 xrlxllx.exe 3752 vvdpd.exe 4288 1xllrxr.exe 3272 fxlflll.exe 1504 jdvpv.exe 380 xlxxfrl.exe 4368 hhnhnt.exe 2468 jpvvv.exe 3044 lfrfrrx.exe 4872 httnhn.exe 3452 rrlfxxf.exe 4836 llllfff.exe 2996 fxxxrrr.exe 2600 vjjdv.exe 704 djjpp.exe 60 xrxrlxr.exe 3796 bthbtb.exe 4832 1vdpj.exe 2028 xffxrff.exe 4028 fxxrlll.exe 2708 btthnb.exe 2204 pdjdv.exe 556 frflfxr.exe 3160 lfrlffx.exe 4136 bhhhbt.exe 3708 jvvdv.exe 1832 9fffxxr.exe 1196 tbnnht.exe 2596 vpvvv.exe 2416 pjvpd.exe 5096 5lfxlrf.exe 460 5bbbtt.exe 4828 btnbnh.exe 4772 3pvpp.exe 2668 lrfrffx.exe 4564 rfxrlfx.exe 380 bnnhhh.exe 4352 vjvjj.exe 3276 jvdpj.exe 4336 xrlrlrr.exe 4896 7ntnhh.exe 2124 jppjd.exe 1672 7lrlfll.exe 4836 lfllrxx.exe 1008 bhnnnt.exe 2308 jdjdv.exe 400 rlrlffx.exe 4572 htbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/876-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-186-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exepdppd.exerxrllff.exe9hnbht.exe5pddv.exe9rlxrrl.exefrrxrlf.exevvdpd.exexlfffxx.exevjjjj.exexrxrrxx.exe3jjvp.exetnbtbb.exelfxrrrr.exebntnnn.exerflfffx.exe1tntth.exexrlxllx.exevvdpd.exe1xllrxr.exefxlflll.exejdvpv.exedescription pid process target process PID 876 wrote to memory of 5112 876 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe pdppd.exe PID 876 wrote to memory of 5112 876 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe pdppd.exe PID 876 wrote to memory of 5112 876 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe pdppd.exe PID 5112 wrote to memory of 4872 5112 pdppd.exe rxrllff.exe PID 5112 wrote to memory of 4872 5112 pdppd.exe rxrllff.exe PID 5112 wrote to memory of 4872 5112 pdppd.exe rxrllff.exe PID 4872 wrote to memory of 4896 4872 rxrllff.exe 9hnbht.exe PID 4872 wrote to memory of 4896 4872 rxrllff.exe 9hnbht.exe PID 4872 wrote to memory of 4896 4872 rxrllff.exe 9hnbht.exe PID 4896 wrote to memory of 1672 4896 9hnbht.exe 5pddv.exe PID 4896 wrote to memory of 1672 4896 9hnbht.exe 5pddv.exe PID 4896 wrote to memory of 1672 4896 9hnbht.exe 5pddv.exe PID 1672 wrote to memory of 516 1672 5pddv.exe 9rlxrrl.exe PID 1672 wrote to memory of 516 1672 5pddv.exe 9rlxrrl.exe PID 1672 wrote to memory of 516 1672 5pddv.exe 9rlxrrl.exe PID 516 wrote to memory of 5060 516 9rlxrrl.exe frrxrlf.exe PID 516 wrote to memory of 5060 516 9rlxrrl.exe frrxrlf.exe PID 516 wrote to memory of 5060 516 9rlxrrl.exe frrxrlf.exe PID 5060 wrote to memory of 1712 5060 frrxrlf.exe vvdpd.exe PID 5060 wrote to memory of 1712 5060 frrxrlf.exe vvdpd.exe PID 5060 wrote to memory of 1712 5060 frrxrlf.exe vvdpd.exe PID 1712 wrote to memory of 4112 1712 vvdpd.exe xlfffxx.exe PID 1712 wrote to memory of 4112 1712 vvdpd.exe xlfffxx.exe PID 1712 wrote to memory of 4112 1712 vvdpd.exe xlfffxx.exe PID 4112 wrote to memory of 4832 4112 xlfffxx.exe vjjjj.exe PID 4112 wrote to memory of 4832 4112 xlfffxx.exe vjjjj.exe PID 4112 wrote to memory of 4832 4112 xlfffxx.exe vjjjj.exe PID 4832 wrote to memory of 3268 4832 vjjjj.exe xrxrrxx.exe PID 4832 wrote to memory of 3268 4832 vjjjj.exe xrxrrxx.exe PID 4832 wrote to memory of 3268 4832 vjjjj.exe xrxrrxx.exe PID 3268 wrote to memory of 3292 3268 xrxrrxx.exe 3jjvp.exe PID 3268 wrote to memory of 3292 3268 xrxrrxx.exe 3jjvp.exe PID 3268 wrote to memory of 3292 3268 xrxrrxx.exe 3jjvp.exe PID 3292 wrote to memory of 2060 3292 3jjvp.exe tnbtbb.exe PID 3292 wrote to memory of 2060 3292 3jjvp.exe tnbtbb.exe PID 3292 wrote to memory of 2060 3292 3jjvp.exe tnbtbb.exe PID 2060 wrote to memory of 2324 2060 tnbtbb.exe lfxrrrr.exe PID 2060 wrote to memory of 2324 2060 tnbtbb.exe lfxrrrr.exe PID 2060 wrote to memory of 2324 2060 tnbtbb.exe lfxrrrr.exe PID 2324 wrote to memory of 1300 2324 lfxrrrr.exe bntnnn.exe PID 2324 wrote to memory of 1300 2324 lfxrrrr.exe bntnnn.exe PID 2324 wrote to memory of 1300 2324 lfxrrrr.exe bntnnn.exe PID 1300 wrote to memory of 2320 1300 bntnnn.exe rflfffx.exe PID 1300 wrote to memory of 2320 1300 bntnnn.exe rflfffx.exe PID 1300 wrote to memory of 2320 1300 bntnnn.exe rflfffx.exe PID 2320 wrote to memory of 3712 2320 rflfffx.exe 1tntth.exe PID 2320 wrote to memory of 3712 2320 rflfffx.exe 1tntth.exe PID 2320 wrote to memory of 3712 2320 rflfffx.exe 1tntth.exe PID 3712 wrote to memory of 1748 3712 1tntth.exe xrlxllx.exe PID 3712 wrote to memory of 1748 3712 1tntth.exe xrlxllx.exe PID 3712 wrote to memory of 1748 3712 1tntth.exe xrlxllx.exe PID 1748 wrote to memory of 3752 1748 xrlxllx.exe vvdpd.exe PID 1748 wrote to memory of 3752 1748 xrlxllx.exe vvdpd.exe PID 1748 wrote to memory of 3752 1748 xrlxllx.exe vvdpd.exe PID 3752 wrote to memory of 4288 3752 vvdpd.exe 1xllrxr.exe PID 3752 wrote to memory of 4288 3752 vvdpd.exe 1xllrxr.exe PID 3752 wrote to memory of 4288 3752 vvdpd.exe 1xllrxr.exe PID 4288 wrote to memory of 3272 4288 1xllrxr.exe fxlflll.exe PID 4288 wrote to memory of 3272 4288 1xllrxr.exe fxlflll.exe PID 4288 wrote to memory of 3272 4288 1xllrxr.exe fxlflll.exe PID 3272 wrote to memory of 1504 3272 fxlflll.exe jdvpv.exe PID 3272 wrote to memory of 1504 3272 fxlflll.exe jdvpv.exe PID 3272 wrote to memory of 1504 3272 fxlflll.exe jdvpv.exe PID 1504 wrote to memory of 380 1504 jdvpv.exe xlxxfrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe"C:\Users\Admin\AppData\Local\Temp\dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\pdppd.exec:\pdppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\rxrllff.exec:\rxrllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\9hnbht.exec:\9hnbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\5pddv.exec:\5pddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\9rlxrrl.exec:\9rlxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\frrxrlf.exec:\frrxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vvdpd.exec:\vvdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xlfffxx.exec:\xlfffxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vjjjj.exec:\vjjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\3jjvp.exec:\3jjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\tnbtbb.exec:\tnbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\bntnnn.exec:\bntnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\rflfffx.exec:\rflfffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\1tntth.exec:\1tntth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\xrlxllx.exec:\xrlxllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vvdpd.exec:\vvdpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\1xllrxr.exec:\1xllrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\fxlflll.exec:\fxlflll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\jdvpv.exec:\jdvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\xlxxfrl.exec:\xlxxfrl.exe23⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhnhnt.exec:\hhnhnt.exe24⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jpvvv.exec:\jpvvv.exe25⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lfrfrrx.exec:\lfrfrrx.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\httnhn.exec:\httnhn.exe27⤵
- Executes dropped EXE
PID:4872 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe28⤵
- Executes dropped EXE
PID:3452 -
\??\c:\llllfff.exec:\llllfff.exe29⤵
- Executes dropped EXE
PID:4836 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe30⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vjjdv.exec:\vjjdv.exe31⤵
- Executes dropped EXE
PID:2600 -
\??\c:\djjpp.exec:\djjpp.exe32⤵
- Executes dropped EXE
PID:704 -
\??\c:\xrxrlxr.exec:\xrxrlxr.exe33⤵
- Executes dropped EXE
PID:60 -
\??\c:\bthbtb.exec:\bthbtb.exe34⤵
- Executes dropped EXE
PID:3796 -
\??\c:\1vdpj.exec:\1vdpj.exe35⤵
- Executes dropped EXE
PID:4832 -
\??\c:\xffxrff.exec:\xffxrff.exe36⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxxrlll.exec:\fxxrlll.exe37⤵
- Executes dropped EXE
PID:4028 -
\??\c:\btthnb.exec:\btthnb.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdjdv.exec:\pdjdv.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\frflfxr.exec:\frflfxr.exe40⤵
- Executes dropped EXE
PID:556 -
\??\c:\lfrlffx.exec:\lfrlffx.exe41⤵
- Executes dropped EXE
PID:3160 -
\??\c:\bhhhbt.exec:\bhhhbt.exe42⤵
- Executes dropped EXE
PID:4136 -
\??\c:\jvvdv.exec:\jvvdv.exe43⤵
- Executes dropped EXE
PID:3708 -
\??\c:\9fffxxr.exec:\9fffxxr.exe44⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tbnnht.exec:\tbnnht.exe45⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vpvvv.exec:\vpvvv.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjvpd.exec:\pjvpd.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5lfxlrf.exec:\5lfxlrf.exe48⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5bbbtt.exec:\5bbbtt.exe49⤵
- Executes dropped EXE
PID:460 -
\??\c:\btnbnh.exec:\btnbnh.exe50⤵
- Executes dropped EXE
PID:4828 -
\??\c:\3pvpp.exec:\3pvpp.exe51⤵
- Executes dropped EXE
PID:4772 -
\??\c:\lrfrffx.exec:\lrfrffx.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe53⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bnnhhh.exec:\bnnhhh.exe54⤵
- Executes dropped EXE
PID:380 -
\??\c:\vjvjj.exec:\vjvjj.exe55⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jvdpj.exec:\jvdpj.exe56⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xrlrlrr.exec:\xrlrlrr.exe57⤵
- Executes dropped EXE
PID:4336 -
\??\c:\7ntnhh.exec:\7ntnhh.exe58⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jppjd.exec:\jppjd.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7lrlfll.exec:\7lrlfll.exe60⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lfllrxx.exec:\lfllrxx.exe61⤵
- Executes dropped EXE
PID:4836 -
\??\c:\bhnnnt.exec:\bhnnnt.exe62⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jdjdv.exec:\jdjdv.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rlrlffx.exec:\rlrlffx.exe64⤵
- Executes dropped EXE
PID:400 -
\??\c:\htbbtt.exec:\htbbtt.exe65⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jdddv.exec:\jdddv.exe66⤵PID:3256
-
\??\c:\jdjjd.exec:\jdjjd.exe67⤵PID:1964
-
\??\c:\fffxxxr.exec:\fffxxxr.exe68⤵PID:4832
-
\??\c:\nbnnnn.exec:\nbnnnn.exe69⤵PID:2028
-
\??\c:\vpdvp.exec:\vpdvp.exe70⤵PID:4968
-
\??\c:\vvvvd.exec:\vvvvd.exe71⤵PID:2060
-
\??\c:\fxlfxrf.exec:\fxlfxrf.exe72⤵PID:2204
-
\??\c:\nbhhbn.exec:\nbhhbn.exe73⤵PID:556
-
\??\c:\9dvpp.exec:\9dvpp.exe74⤵PID:3160
-
\??\c:\fllfrrf.exec:\fllfrrf.exe75⤵PID:636
-
\??\c:\llrlffx.exec:\llrlffx.exe76⤵PID:2652
-
\??\c:\hbtnhb.exec:\hbtnhb.exe77⤵PID:4048
-
\??\c:\pvvpp.exec:\pvvpp.exe78⤵PID:3712
-
\??\c:\xffxrll.exec:\xffxrll.exe79⤵PID:1748
-
\??\c:\ttnhnn.exec:\ttnhnn.exe80⤵PID:3720
-
\??\c:\ddvpd.exec:\ddvpd.exe81⤵PID:1596
-
\??\c:\rlllffx.exec:\rlllffx.exe82⤵PID:4828
-
\??\c:\ntbttt.exec:\ntbttt.exe83⤵PID:1064
-
\??\c:\7ppdv.exec:\7ppdv.exe84⤵PID:4144
-
\??\c:\vvddd.exec:\vvddd.exe85⤵PID:4564
-
\??\c:\1xrllrr.exec:\1xrllrr.exe86⤵PID:380
-
\??\c:\nnttnh.exec:\nnttnh.exe87⤵PID:3852
-
\??\c:\3bbthh.exec:\3bbthh.exe88⤵PID:4736
-
\??\c:\vvvpp.exec:\vvvpp.exe89⤵PID:2564
-
\??\c:\xxfxrll.exec:\xxfxrll.exe90⤵PID:4896
-
\??\c:\7xxfrfl.exec:\7xxfrfl.exe91⤵PID:1112
-
\??\c:\5ttnhn.exec:\5ttnhn.exe92⤵PID:2188
-
\??\c:\5jdjp.exec:\5jdjp.exe93⤵PID:4644
-
\??\c:\3llfxxr.exec:\3llfxxr.exe94⤵PID:3108
-
\??\c:\xflfrlr.exec:\xflfrlr.exe95⤵PID:2172
-
\??\c:\9nnbbb.exec:\9nnbbb.exe96⤵PID:2588
-
\??\c:\jpvvv.exec:\jpvvv.exe97⤵PID:1084
-
\??\c:\vppdv.exec:\vppdv.exe98⤵PID:4980
-
\??\c:\lrfxfrl.exec:\lrfxfrl.exe99⤵PID:4616
-
\??\c:\7bthnb.exec:\7bthnb.exe100⤵PID:2028
-
\??\c:\3tbtnh.exec:\3tbtnh.exe101⤵PID:3224
-
\??\c:\fxflxxr.exec:\fxflxxr.exe102⤵PID:4408
-
\??\c:\xfffffx.exec:\xfffffx.exe103⤵PID:2204
-
\??\c:\bnbbtt.exec:\bnbbtt.exe104⤵PID:2320
-
\??\c:\vvpjv.exec:\vvpjv.exe105⤵PID:3160
-
\??\c:\5jdpp.exec:\5jdpp.exe106⤵PID:636
-
\??\c:\lrxrffr.exec:\lrxrffr.exe107⤵PID:4428
-
\??\c:\thnhbb.exec:\thnhbb.exe108⤵PID:4048
-
\??\c:\nhhbtt.exec:\nhhbtt.exe109⤵PID:3712
-
\??\c:\vdpdj.exec:\vdpdj.exe110⤵PID:3660
-
\??\c:\jvpdv.exec:\jvpdv.exe111⤵PID:3752
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe112⤵PID:2108
-
\??\c:\hntnhb.exec:\hntnhb.exe113⤵PID:2296
-
\??\c:\7ntnnn.exec:\7ntnnn.exe114⤵PID:224
-
\??\c:\jvvpj.exec:\jvvpj.exe115⤵PID:4732
-
\??\c:\rflfxfx.exec:\rflfxfx.exe116⤵PID:2920
-
\??\c:\xlxrrll.exec:\xlxrrll.exe117⤵PID:4556
-
\??\c:\hbbthh.exec:\hbbthh.exe118⤵PID:4900
-
\??\c:\dvjjp.exec:\dvjjp.exe119⤵PID:2996
-
\??\c:\7jppv.exec:\7jppv.exe120⤵PID:2684
-
\??\c:\5llfxxr.exec:\5llfxxr.exe121⤵PID:1008
-
\??\c:\ttbtnb.exec:\ttbtnb.exe122⤵PID:704
-
\??\c:\hhhbbt.exec:\hhhbbt.exe123⤵PID:3256
-
\??\c:\jvdvj.exec:\jvdvj.exe124⤵PID:368
-
\??\c:\lxlfxll.exec:\lxlfxll.exe125⤵PID:4340
-
\??\c:\3hnhnt.exec:\3hnhnt.exe126⤵PID:2708
-
\??\c:\7ddjp.exec:\7ddjp.exe127⤵PID:4320
-
\??\c:\vpvpj.exec:\vpvpj.exe128⤵PID:4408
-
\??\c:\1ffxllf.exec:\1ffxllf.exe129⤵PID:1836
-
\??\c:\1ttntb.exec:\1ttntb.exe130⤵PID:1272
-
\??\c:\9jjdv.exec:\9jjdv.exe131⤵PID:2988
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe132⤵PID:4452
-
\??\c:\tnbtnn.exec:\tnbtnn.exe133⤵PID:1976
-
\??\c:\jjvpd.exec:\jjvpd.exe134⤵PID:1744
-
\??\c:\rrlfxxl.exec:\rrlfxxl.exe135⤵PID:1588
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe136⤵PID:4828
-
\??\c:\nhhbtt.exec:\nhhbtt.exe137⤵PID:3244
-
\??\c:\ddjdp.exec:\ddjdp.exe138⤵PID:4564
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe139⤵PID:2300
-
\??\c:\hhtttn.exec:\hhtttn.exe140⤵PID:4872
-
\??\c:\bnbtnn.exec:\bnbtnn.exe141⤵PID:4420
-
\??\c:\3dpjd.exec:\3dpjd.exe142⤵PID:2272
-
\??\c:\lfffxlf.exec:\lfffxlf.exe143⤵PID:3452
-
\??\c:\fxxrrll.exec:\fxxrrll.exe144⤵PID:4856
-
\??\c:\btnhhh.exec:\btnhhh.exe145⤵PID:2636
-
\??\c:\btbhnn.exec:\btbhnn.exe146⤵PID:4776
-
\??\c:\djjdv.exec:\djjdv.exe147⤵PID:3728
-
\??\c:\3rrlllf.exec:\3rrlllf.exe148⤵PID:3560
-
\??\c:\1bbtbb.exec:\1bbtbb.exe149⤵PID:4028
-
\??\c:\bbhhbh.exec:\bbhhbh.exe150⤵PID:3224
-
\??\c:\dvjpv.exec:\dvjpv.exe151⤵PID:4932
-
\??\c:\rfxrffx.exec:\rfxrffx.exe152⤵PID:116
-
\??\c:\fxffxfr.exec:\fxffxfr.exe153⤵PID:2204
-
\??\c:\hnhbnn.exec:\hnhbnn.exe154⤵PID:1076
-
\??\c:\jppjd.exec:\jppjd.exe155⤵PID:1832
-
\??\c:\vjppj.exec:\vjppj.exe156⤵PID:5008
-
\??\c:\lrrfxxx.exec:\lrrfxxx.exe157⤵PID:3408
-
\??\c:\hbhbnn.exec:\hbhbnn.exe158⤵PID:3988
-
\??\c:\pjpjv.exec:\pjpjv.exe159⤵PID:4772
-
\??\c:\1lfxrll.exec:\1lfxrll.exe160⤵PID:2108
-
\??\c:\3tbnhh.exec:\3tbnhh.exe161⤵PID:2424
-
\??\c:\jvpjj.exec:\jvpjj.exe162⤵PID:4564
-
\??\c:\dvdvv.exec:\dvdvv.exe163⤵PID:4748
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe164⤵PID:4896
-
\??\c:\tnnbtt.exec:\tnnbtt.exe165⤵PID:1112
-
\??\c:\vdpdj.exec:\vdpdj.exe166⤵PID:3452
-
\??\c:\jjvpj.exec:\jjvpj.exe167⤵PID:1120
-
\??\c:\llfxlfx.exec:\llfxlfx.exe168⤵PID:3268
-
\??\c:\nhhtnt.exec:\nhhtnt.exe169⤵PID:1444
-
\??\c:\9vppj.exec:\9vppj.exe170⤵PID:4616
-
\??\c:\3fffffl.exec:\3fffffl.exe171⤵PID:4632
-
\??\c:\lffxxxr.exec:\lffxxxr.exe172⤵PID:4028
-
\??\c:\bbhbbb.exec:\bbhbbb.exe173⤵PID:3224
-
\??\c:\jvdpd.exec:\jvdpd.exe174⤵PID:4932
-
\??\c:\vpvvj.exec:\vpvvj.exe175⤵PID:116
-
\??\c:\5llrffx.exec:\5llrffx.exe176⤵PID:2204
-
\??\c:\9bhhhh.exec:\9bhhhh.exe177⤵PID:4636
-
\??\c:\jpvpj.exec:\jpvpj.exe178⤵PID:1236
-
\??\c:\rllfffx.exec:\rllfffx.exe179⤵PID:1976
-
\??\c:\bntnnn.exec:\bntnnn.exe180⤵PID:3272
-
\??\c:\9djpj.exec:\9djpj.exe181⤵PID:3752
-
\??\c:\jdppp.exec:\jdppp.exe182⤵PID:4828
-
\??\c:\9rxrllf.exec:\9rxrllf.exe183⤵PID:3244
-
\??\c:\nhnhnh.exec:\nhnhnh.exe184⤵PID:2468
-
\??\c:\pjjdd.exec:\pjjdd.exe185⤵PID:3852
-
\??\c:\vvdvj.exec:\vvdvj.exe186⤵PID:1220
-
\??\c:\9fxrlrl.exec:\9fxrlrl.exe187⤵PID:2176
-
\??\c:\3hhhnn.exec:\3hhhnn.exe188⤵PID:2032
-
\??\c:\9hbbtt.exec:\9hbbtt.exe189⤵PID:1120
-
\??\c:\7dvpj.exec:\7dvpj.exe190⤵PID:3728
-
\??\c:\9xxxrxr.exec:\9xxxrxr.exe191⤵PID:2072
-
\??\c:\xrrxrrr.exec:\xrrxrrr.exe192⤵PID:2028
-
\??\c:\htbnhn.exec:\htbnhn.exe193⤵PID:556
-
\??\c:\vddvp.exec:\vddvp.exe194⤵PID:2320
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe195⤵PID:3160
-
\??\c:\lfllfxr.exec:\lfllfxr.exe196⤵PID:4724
-
\??\c:\nthbnn.exec:\nthbnn.exe197⤵PID:1632
-
\??\c:\jjpjd.exec:\jjpjd.exe198⤵PID:1752
-
\??\c:\lfrlfrx.exec:\lfrlfrx.exe199⤵PID:4908
-
\??\c:\btnhbb.exec:\btnhbb.exe200⤵PID:2312
-
\??\c:\bttthh.exec:\bttthh.exe201⤵PID:2936
-
\??\c:\jdpjp.exec:\jdpjp.exe202⤵PID:32
-
\??\c:\7xrxrxr.exec:\7xrxrxr.exe203⤵PID:224
-
\??\c:\3lxfxlf.exec:\3lxfxlf.exe204⤵PID:3276
-
\??\c:\bhbtnh.exec:\bhbtnh.exe205⤵PID:2300
-
\??\c:\djpvp.exec:\djpvp.exe206⤵PID:2564
-
\??\c:\xflfrrl.exec:\xflfrrl.exe207⤵PID:2996
-
\??\c:\lfrlffx.exec:\lfrlffx.exe208⤵PID:2032
-
\??\c:\nntttt.exec:\nntttt.exe209⤵PID:4592
-
\??\c:\dvjdj.exec:\dvjdj.exe210⤵PID:4340
-
\??\c:\rffxfxr.exec:\rffxfxr.exe211⤵PID:4136
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe212⤵PID:3984
-
\??\c:\hntnhb.exec:\hntnhb.exe213⤵PID:532
-
\??\c:\jddvj.exec:\jddvj.exe214⤵PID:1836
-
\??\c:\rfllffx.exec:\rfllffx.exe215⤵PID:2988
-
\??\c:\7xrrxxr.exec:\7xrrxxr.exe216⤵PID:4636
-
\??\c:\nttnhb.exec:\nttnhb.exe217⤵PID:1540
-
\??\c:\ddppv.exec:\ddppv.exe218⤵PID:2416
-
\??\c:\flffxxr.exec:\flffxxr.exe219⤵PID:2760
-
\??\c:\lfxflff.exec:\lfxflff.exe220⤵PID:4352
-
\??\c:\9nbttt.exec:\9nbttt.exe221⤵PID:380
-
\??\c:\pvdpj.exec:\pvdpj.exe222⤵PID:916
-
\??\c:\9djjv.exec:\9djjv.exe223⤵PID:2076
-
\??\c:\lrfxllf.exec:\lrfxllf.exe224⤵PID:3056
-
\??\c:\xrfrrrf.exec:\xrfrrrf.exe225⤵PID:1580
-
\??\c:\7bhbtt.exec:\7bhbtt.exe226⤵PID:4572
-
\??\c:\jjpjd.exec:\jjpjd.exe227⤵PID:3256
-
\??\c:\jdddv.exec:\jdddv.exe228⤵PID:2696
-
\??\c:\lrfllll.exec:\lrfllll.exe229⤵PID:4676
-
\??\c:\lrfxfrr.exec:\lrfxfrr.exe230⤵PID:4320
-
\??\c:\hbhhhb.exec:\hbhhhb.exe231⤵PID:3984
-
\??\c:\pdpjp.exec:\pdpjp.exe232⤵PID:1272
-
\??\c:\vppjd.exec:\vppjd.exe233⤵PID:2652
-
\??\c:\ffllrxf.exec:\ffllrxf.exe234⤵PID:3564
-
\??\c:\1nbbtn.exec:\1nbbtn.exe235⤵PID:1752
-
\??\c:\nhbhbt.exec:\nhbhbt.exe236⤵PID:4908
-
\??\c:\3vjdv.exec:\3vjdv.exe237⤵PID:4380
-
\??\c:\lflfllf.exec:\lflfllf.exe238⤵PID:4772
-
\??\c:\fxlffxr.exec:\fxlffxr.exe239⤵PID:2920
-
\??\c:\tnttnn.exec:\tnttnn.exe240⤵PID:224
-
\??\c:\jppjv.exec:\jppjv.exe241⤵PID:3276
-
\??\c:\rlrrxlx.exec:\rlrrxlx.exe242⤵PID:1220