Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exe
-
Size
212KB
-
MD5
c7ca343e49da047bf9d753005c0cd327
-
SHA1
52c2f0f24f9a44e2c7d96637581b7f4c6291d3a1
-
SHA256
ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c
-
SHA512
5b14f1b1c0f7878f540f4dd66c27a57e7d07c6fbb9d6f43e473e3951e46f4bbe0cdcd3e248086a84a5ceaadf15b2061266161ef4866dd525b00866ddce2b9b46
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmABd1:n3C9BRIG0asYFm71m8+GdkB9EBd1
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/4016-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
Processes:
resource yara_rule behavioral2/memory/4016-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3904-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1992-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1080-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2224-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2848-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3608-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3920-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3924-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5004-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3744-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4420-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3852-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4196-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2136-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3488-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4336-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3992-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2548-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bbbhbh.exe1xxrllf.exelllxfxr.exebtbbhb.exevvpdp.exerxfxxxx.exexxfxllr.exenhhtnt.exedvddv.exerrfrfrf.exexlxlrlx.exehbbtnh.exevjjdp.exentntnb.exedpjpj.exetntbbt.exedppdv.exe3xrrrrr.exebnnhhh.exe7pjdv.exexxxfffl.exenhhbtn.exe7pjdp.exelfxrrrl.exetnnhbb.exejdppj.exe1bthnt.exevvddd.exe5frlrrf.exehhnttt.exe7lrrrrl.exenntnbt.exevjdjv.exenhnhhh.exevjddv.exerlxlllf.exennhhnt.exeddvvv.exeddjdd.exexlxrrxx.exebtbtth.exepvvvp.exevjjvp.exexrrlfxr.exebhtntt.exe3dvjv.exelffrrfl.exe9xxrlff.exenbnhhn.exedjjpv.exerxxxxxr.exefffffrr.exenthnnn.exepjdpp.exexrfxrff.exellrrflr.exe9vjdp.exe7pvvv.exerlrlffr.exennbbnn.exevdjjp.exepvpvd.exexfrrfxl.exetnttnn.exepid process 2848 bbbhbh.exe 2224 1xxrllf.exe 3904 lllxfxr.exe 1080 btbbhb.exe 1992 vvpdp.exe 4560 rxfxxxx.exe 3608 xxfxllr.exe 3628 nhhtnt.exe 3892 dvddv.exe 3296 rrfrfrf.exe 5096 xlxlrlx.exe 4996 hbbtnh.exe 3920 vjjdp.exe 516 ntntnb.exe 4576 dpjpj.exe 3924 tntbbt.exe 5004 dppdv.exe 3744 3xrrrrr.exe 1480 bnnhhh.exe 4420 7pjdv.exe 3852 xxxfffl.exe 4196 nhhbtn.exe 2964 7pjdp.exe 1552 lfxrrrl.exe 2136 tnnhbb.exe 3980 jdppj.exe 3488 1bthnt.exe 4336 vvddd.exe 3992 5frlrrf.exe 2548 hhnttt.exe 2364 7lrrrrl.exe 4784 nntnbt.exe 3656 vjdjv.exe 888 nhnhhh.exe 116 vjddv.exe 1300 rlxlllf.exe 4476 nnhhnt.exe 4332 ddvvv.exe 4856 ddjdd.exe 2196 xlxrrxx.exe 5108 btbtth.exe 3436 pvvvp.exe 4064 vjjvp.exe 1428 xrrlfxr.exe 3252 bhtntt.exe 1712 3dvjv.exe 2016 lffrrfl.exe 1800 9xxrlff.exe 2264 nbnhhn.exe 4900 djjpv.exe 996 rxxxxxr.exe 2044 fffffrr.exe 2584 nthnnn.exe 4108 pjdpp.exe 3672 xrfxrff.exe 4740 llrrflr.exe 4904 9vjdp.exe 2716 7pvvv.exe 1676 rlrlffr.exe 4920 nnbbnn.exe 4432 vdjjp.exe 4464 pvpvd.exe 2188 xfrrfxl.exe 3800 tnttnn.exe -
Processes:
resource yara_rule behavioral2/memory/4016-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exebbbhbh.exe1xxrllf.exelllxfxr.exebtbbhb.exevvpdp.exerxfxxxx.exexxfxllr.exenhhtnt.exedvddv.exerrfrfrf.exexlxlrlx.exehbbtnh.exevjjdp.exentntnb.exedpjpj.exetntbbt.exedppdv.exe3xrrrrr.exebnnhhh.exe7pjdv.exexxxfffl.exedescription pid process target process PID 4016 wrote to memory of 2848 4016 ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exe bbbhbh.exe PID 4016 wrote to memory of 2848 4016 ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exe bbbhbh.exe PID 4016 wrote to memory of 2848 4016 ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exe bbbhbh.exe PID 2848 wrote to memory of 2224 2848 bbbhbh.exe 1xxrllf.exe PID 2848 wrote to memory of 2224 2848 bbbhbh.exe 1xxrllf.exe PID 2848 wrote to memory of 2224 2848 bbbhbh.exe 1xxrllf.exe PID 2224 wrote to memory of 3904 2224 1xxrllf.exe lllxfxr.exe PID 2224 wrote to memory of 3904 2224 1xxrllf.exe lllxfxr.exe PID 2224 wrote to memory of 3904 2224 1xxrllf.exe lllxfxr.exe PID 3904 wrote to memory of 1080 3904 lllxfxr.exe btbbhb.exe PID 3904 wrote to memory of 1080 3904 lllxfxr.exe btbbhb.exe PID 3904 wrote to memory of 1080 3904 lllxfxr.exe btbbhb.exe PID 1080 wrote to memory of 1992 1080 btbbhb.exe vvpdp.exe PID 1080 wrote to memory of 1992 1080 btbbhb.exe vvpdp.exe PID 1080 wrote to memory of 1992 1080 btbbhb.exe vvpdp.exe PID 1992 wrote to memory of 4560 1992 vvpdp.exe rxfxxxx.exe PID 1992 wrote to memory of 4560 1992 vvpdp.exe rxfxxxx.exe PID 1992 wrote to memory of 4560 1992 vvpdp.exe rxfxxxx.exe PID 4560 wrote to memory of 3608 4560 rxfxxxx.exe xxfxllr.exe PID 4560 wrote to memory of 3608 4560 rxfxxxx.exe xxfxllr.exe PID 4560 wrote to memory of 3608 4560 rxfxxxx.exe xxfxllr.exe PID 3608 wrote to memory of 3628 3608 xxfxllr.exe nhhtnt.exe PID 3608 wrote to memory of 3628 3608 xxfxllr.exe nhhtnt.exe PID 3608 wrote to memory of 3628 3608 xxfxllr.exe nhhtnt.exe PID 3628 wrote to memory of 3892 3628 nhhtnt.exe dvddv.exe PID 3628 wrote to memory of 3892 3628 nhhtnt.exe dvddv.exe PID 3628 wrote to memory of 3892 3628 nhhtnt.exe dvddv.exe PID 3892 wrote to memory of 3296 3892 dvddv.exe rrfrfrf.exe PID 3892 wrote to memory of 3296 3892 dvddv.exe rrfrfrf.exe PID 3892 wrote to memory of 3296 3892 dvddv.exe rrfrfrf.exe PID 3296 wrote to memory of 5096 3296 rrfrfrf.exe xlxlrlx.exe PID 3296 wrote to memory of 5096 3296 rrfrfrf.exe xlxlrlx.exe PID 3296 wrote to memory of 5096 3296 rrfrfrf.exe xlxlrlx.exe PID 5096 wrote to memory of 4996 5096 xlxlrlx.exe hbbtnh.exe PID 5096 wrote to memory of 4996 5096 xlxlrlx.exe hbbtnh.exe PID 5096 wrote to memory of 4996 5096 xlxlrlx.exe hbbtnh.exe PID 4996 wrote to memory of 3920 4996 hbbtnh.exe vjjdp.exe PID 4996 wrote to memory of 3920 4996 hbbtnh.exe vjjdp.exe PID 4996 wrote to memory of 3920 4996 hbbtnh.exe vjjdp.exe PID 3920 wrote to memory of 516 3920 vjjdp.exe ntntnb.exe PID 3920 wrote to memory of 516 3920 vjjdp.exe ntntnb.exe PID 3920 wrote to memory of 516 3920 vjjdp.exe ntntnb.exe PID 516 wrote to memory of 4576 516 ntntnb.exe dpjpj.exe PID 516 wrote to memory of 4576 516 ntntnb.exe dpjpj.exe PID 516 wrote to memory of 4576 516 ntntnb.exe dpjpj.exe PID 4576 wrote to memory of 3924 4576 dpjpj.exe tntbbt.exe PID 4576 wrote to memory of 3924 4576 dpjpj.exe tntbbt.exe PID 4576 wrote to memory of 3924 4576 dpjpj.exe tntbbt.exe PID 3924 wrote to memory of 5004 3924 tntbbt.exe dppdv.exe PID 3924 wrote to memory of 5004 3924 tntbbt.exe dppdv.exe PID 3924 wrote to memory of 5004 3924 tntbbt.exe dppdv.exe PID 5004 wrote to memory of 3744 5004 dppdv.exe 3xrrrrr.exe PID 5004 wrote to memory of 3744 5004 dppdv.exe 3xrrrrr.exe PID 5004 wrote to memory of 3744 5004 dppdv.exe 3xrrrrr.exe PID 3744 wrote to memory of 1480 3744 3xrrrrr.exe bnnhhh.exe PID 3744 wrote to memory of 1480 3744 3xrrrrr.exe bnnhhh.exe PID 3744 wrote to memory of 1480 3744 3xrrrrr.exe bnnhhh.exe PID 1480 wrote to memory of 4420 1480 bnnhhh.exe 7pjdv.exe PID 1480 wrote to memory of 4420 1480 bnnhhh.exe 7pjdv.exe PID 1480 wrote to memory of 4420 1480 bnnhhh.exe 7pjdv.exe PID 4420 wrote to memory of 3852 4420 7pjdv.exe xxxfffl.exe PID 4420 wrote to memory of 3852 4420 7pjdv.exe xxxfffl.exe PID 4420 wrote to memory of 3852 4420 7pjdv.exe xxxfffl.exe PID 3852 wrote to memory of 4196 3852 xxxfffl.exe nhhbtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exe"C:\Users\Admin\AppData\Local\Temp\ee761e574744a22240cc400b366d7d24a2a5e8ad9efbeddaf7b0ce9dd5cf4d8c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\bbbhbh.exec:\bbbhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1xxrllf.exec:\1xxrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\lllxfxr.exec:\lllxfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\btbbhb.exec:\btbbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\vvpdp.exec:\vvpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\xxfxllr.exec:\xxfxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\nhhtnt.exec:\nhhtnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\dvddv.exec:\dvddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\rrfrfrf.exec:\rrfrfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\xlxlrlx.exec:\xlxlrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\hbbtnh.exec:\hbbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\vjjdp.exec:\vjjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\ntntnb.exec:\ntntnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\dpjpj.exec:\dpjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\tntbbt.exec:\tntbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\dppdv.exec:\dppdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\3xrrrrr.exec:\3xrrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\bnnhhh.exec:\bnnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\7pjdv.exec:\7pjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\xxxfffl.exec:\xxxfffl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\nhhbtn.exec:\nhhbtn.exe23⤵
- Executes dropped EXE
PID:4196 -
\??\c:\7pjdp.exec:\7pjdp.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe25⤵
- Executes dropped EXE
PID:1552 -
\??\c:\tnnhbb.exec:\tnnhbb.exe26⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jdppj.exec:\jdppj.exe27⤵
- Executes dropped EXE
PID:3980 -
\??\c:\1bthnt.exec:\1bthnt.exe28⤵
- Executes dropped EXE
PID:3488 -
\??\c:\vvddd.exec:\vvddd.exe29⤵
- Executes dropped EXE
PID:4336 -
\??\c:\5frlrrf.exec:\5frlrrf.exe30⤵
- Executes dropped EXE
PID:3992 -
\??\c:\hhnttt.exec:\hhnttt.exe31⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7lrrrrl.exec:\7lrrrrl.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nntnbt.exec:\nntnbt.exe33⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vjdjv.exec:\vjdjv.exe34⤵
- Executes dropped EXE
PID:3656 -
\??\c:\nhnhhh.exec:\nhnhhh.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\vjddv.exec:\vjddv.exe36⤵
- Executes dropped EXE
PID:116 -
\??\c:\rlxlllf.exec:\rlxlllf.exe37⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nnhhnt.exec:\nnhhnt.exe38⤵
- Executes dropped EXE
PID:4476 -
\??\c:\ddvvv.exec:\ddvvv.exe39⤵
- Executes dropped EXE
PID:4332 -
\??\c:\ddjdd.exec:\ddjdd.exe40⤵
- Executes dropped EXE
PID:4856 -
\??\c:\xlxrrxx.exec:\xlxrrxx.exe41⤵
- Executes dropped EXE
PID:2196 -
\??\c:\btbtth.exec:\btbtth.exe42⤵
- Executes dropped EXE
PID:5108 -
\??\c:\pvvvp.exec:\pvvvp.exe43⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vjjvp.exec:\vjjvp.exe44⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe45⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bhtntt.exec:\bhtntt.exe46⤵
- Executes dropped EXE
PID:3252 -
\??\c:\3dvjv.exec:\3dvjv.exe47⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lffrrfl.exec:\lffrrfl.exe48⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9xxrlff.exec:\9xxrlff.exe49⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nbnhhn.exec:\nbnhhn.exe50⤵
- Executes dropped EXE
PID:2264 -
\??\c:\djjpv.exec:\djjpv.exe51⤵
- Executes dropped EXE
PID:4900 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe52⤵
- Executes dropped EXE
PID:996 -
\??\c:\fffffrr.exec:\fffffrr.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nthnnn.exec:\nthnnn.exe54⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pjdpp.exec:\pjdpp.exe55⤵
- Executes dropped EXE
PID:4108 -
\??\c:\xrfxrff.exec:\xrfxrff.exe56⤵
- Executes dropped EXE
PID:3672 -
\??\c:\llrrflr.exec:\llrrflr.exe57⤵
- Executes dropped EXE
PID:4740 -
\??\c:\9vjdp.exec:\9vjdp.exe58⤵
- Executes dropped EXE
PID:4904 -
\??\c:\7pvvv.exec:\7pvvv.exe59⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rlrlffr.exec:\rlrlffr.exe60⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nnbbnn.exec:\nnbbnn.exe61⤵
- Executes dropped EXE
PID:4920 -
\??\c:\vdjjp.exec:\vdjjp.exe62⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pvpvd.exec:\pvpvd.exe63⤵
- Executes dropped EXE
PID:4464 -
\??\c:\xfrrfxl.exec:\xfrrfxl.exe64⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tnttnn.exec:\tnttnn.exe65⤵
- Executes dropped EXE
PID:3800 -
\??\c:\vvvpp.exec:\vvvpp.exe66⤵PID:4420
-
\??\c:\djppp.exec:\djppp.exe67⤵PID:3872
-
\??\c:\xlrfrfx.exec:\xlrfrfx.exe68⤵PID:4936
-
\??\c:\hnbhnt.exec:\hnbhnt.exe69⤵PID:4552
-
\??\c:\jdpjj.exec:\jdpjj.exe70⤵PID:3464
-
\??\c:\jdddp.exec:\jdddp.exe71⤵PID:3092
-
\??\c:\lxlfxxl.exec:\lxlfxxl.exe72⤵PID:5016
-
\??\c:\bnbbhh.exec:\bnbbhh.exe73⤵PID:2876
-
\??\c:\ppdpv.exec:\ppdpv.exe74⤵PID:3880
-
\??\c:\pvjjp.exec:\pvjjp.exe75⤵PID:708
-
\??\c:\xlrllll.exec:\xlrllll.exe76⤵PID:4648
-
\??\c:\1tbbbn.exec:\1tbbbn.exe77⤵PID:1532
-
\??\c:\5thbtt.exec:\5thbtt.exe78⤵PID:3992
-
\??\c:\frfxrlf.exec:\frfxrlf.exe79⤵PID:1952
-
\??\c:\nthhbb.exec:\nthhbb.exe80⤵PID:2724
-
\??\c:\1pppp.exec:\1pppp.exe81⤵PID:1596
-
\??\c:\9rrrrrr.exec:\9rrrrrr.exe82⤵PID:4784
-
\??\c:\bbbhhn.exec:\bbbhhn.exe83⤵PID:3080
-
\??\c:\pvjjj.exec:\pvjjj.exe84⤵PID:2168
-
\??\c:\lflfffx.exec:\lflfffx.exe85⤵PID:2972
-
\??\c:\btnnbh.exec:\btnnbh.exe86⤵PID:4300
-
\??\c:\hhbthn.exec:\hhbthn.exe87⤵PID:4476
-
\??\c:\9vvvv.exec:\9vvvv.exe88⤵PID:2832
-
\??\c:\xrlllll.exec:\xrlllll.exe89⤵PID:4956
-
\??\c:\tthbbb.exec:\tthbbb.exe90⤵PID:3640
-
\??\c:\pjdvj.exec:\pjdvj.exe91⤵PID:5108
-
\??\c:\rrfffrr.exec:\rrfffrr.exe92⤵PID:836
-
\??\c:\bnnnhn.exec:\bnnnhn.exe93⤵PID:4428
-
\??\c:\frxxffl.exec:\frxxffl.exe94⤵PID:4088
-
\??\c:\9xlrrrr.exec:\9xlrrrr.exe95⤵PID:1312
-
\??\c:\tnhhbh.exec:\tnhhbh.exe96⤵PID:4876
-
\??\c:\pvpdj.exec:\pvpdj.exe97⤵PID:3060
-
\??\c:\llxxflr.exec:\llxxflr.exe98⤵PID:4504
-
\??\c:\9xxrllf.exec:\9xxrllf.exe99⤵PID:4040
-
\??\c:\pvjjp.exec:\pvjjp.exe100⤵PID:996
-
\??\c:\ppdvj.exec:\ppdvj.exe101⤵PID:2044
-
\??\c:\frxrrlf.exec:\frxrrlf.exe102⤵PID:2584
-
\??\c:\hbtnhb.exec:\hbtnhb.exe103⤵PID:3672
-
\??\c:\nntbbn.exec:\nntbbn.exe104⤵PID:3832
-
\??\c:\jpvdd.exec:\jpvdd.exe105⤵PID:5020
-
\??\c:\rrlrrxx.exec:\rrlrrxx.exe106⤵PID:3948
-
\??\c:\ttbthb.exec:\ttbthb.exe107⤵PID:1676
-
\??\c:\pvdjp.exec:\pvdjp.exe108⤵PID:4920
-
\??\c:\1xfflrf.exec:\1xfflrf.exe109⤵PID:3744
-
\??\c:\frxlxrf.exec:\frxlxrf.exe110⤵PID:4464
-
\??\c:\pvvvp.exec:\pvvvp.exe111⤵PID:2188
-
\??\c:\vpvpv.exec:\vpvpv.exe112⤵PID:1120
-
\??\c:\hhhhbh.exec:\hhhhbh.exe113⤵PID:2476
-
\??\c:\vdddd.exec:\vdddd.exe114⤵PID:4056
-
\??\c:\vdddj.exec:\vdddj.exe115⤵PID:2032
-
\??\c:\xlxxxff.exec:\xlxxxff.exe116⤵PID:4552
-
\??\c:\frlllll.exec:\frlllll.exe117⤵PID:1920
-
\??\c:\dpdpp.exec:\dpdpp.exe118⤵PID:2892
-
\??\c:\rlrxfll.exec:\rlrxfll.exe119⤵PID:5016
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe120⤵PID:2876
-
\??\c:\btbbtb.exec:\btbbtb.exe121⤵PID:4200
-
\??\c:\jpvpj.exec:\jpvpj.exe122⤵PID:564
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe123⤵PID:392
-
\??\c:\llrfllr.exec:\llrfllr.exe124⤵PID:4452
-
\??\c:\ttnnbh.exec:\ttnnbh.exe125⤵PID:1844
-
\??\c:\vdvvp.exec:\vdvvp.exe126⤵PID:3468
-
\??\c:\pppjp.exec:\pppjp.exe127⤵PID:3432
-
\??\c:\xxxxxlf.exec:\xxxxxlf.exe128⤵PID:1932
-
\??\c:\hhbtnn.exec:\hhbtnn.exe129⤵PID:888
-
\??\c:\htbhht.exec:\htbhht.exe130⤵PID:216
-
\??\c:\dvvjd.exec:\dvvjd.exe131⤵PID:4324
-
\??\c:\xllfxxr.exec:\xllfxxr.exe132⤵PID:3272
-
\??\c:\rrlxxxf.exec:\rrlxxxf.exe133⤵PID:3816
-
\??\c:\bnnnnn.exec:\bnnnnn.exe134⤵PID:444
-
\??\c:\3vddv.exec:\3vddv.exe135⤵PID:3232
-
\??\c:\9vjpv.exec:\9vjpv.exe136⤵PID:4484
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe137⤵PID:4516
-
\??\c:\thbnbt.exec:\thbnbt.exe138⤵PID:3252
-
\??\c:\nhnbnb.exec:\nhnbnb.exe139⤵PID:4724
-
\??\c:\pjddv.exec:\pjddv.exe140⤵PID:792
-
\??\c:\dpvpj.exec:\dpvpj.exe141⤵PID:1472
-
\??\c:\frrfxxr.exec:\frrfxxr.exe142⤵PID:2240
-
\??\c:\httthh.exec:\httthh.exe143⤵PID:2320
-
\??\c:\nnnbbn.exec:\nnnbbn.exe144⤵PID:516
-
\??\c:\fllfxxr.exec:\fllfxxr.exe145⤵PID:4544
-
\??\c:\tbthnn.exec:\tbthnn.exe146⤵PID:4304
-
\??\c:\3vvvv.exec:\3vvvv.exe147⤵PID:2808
-
\??\c:\xlfrlfr.exec:\xlfrlfr.exe148⤵PID:1448
-
\??\c:\bntttt.exec:\bntttt.exe149⤵PID:4852
-
\??\c:\dvppj.exec:\dvppj.exe150⤵PID:3652
-
\??\c:\flfxrxr.exec:\flfxrxr.exe151⤵PID:3448
-
\??\c:\llllfll.exec:\llllfll.exe152⤵PID:884
-
\??\c:\tnbbnn.exec:\tnbbnn.exe153⤵PID:4292
-
\??\c:\pjpvv.exec:\pjpvv.exe154⤵PID:1720
-
\??\c:\1xffffl.exec:\1xffffl.exe155⤵PID:3872
-
\??\c:\thtntt.exec:\thtntt.exe156⤵PID:2964
-
\??\c:\bnthht.exec:\bnthht.exe157⤵PID:4212
-
\??\c:\7ppjj.exec:\7ppjj.exe158⤵PID:4180
-
\??\c:\ffrxfrx.exec:\ffrxfrx.exe159⤵PID:456
-
\??\c:\ttntth.exec:\ttntth.exe160⤵PID:948
-
\??\c:\ththnh.exec:\ththnh.exe161⤵PID:2852
-
\??\c:\ddvpv.exec:\ddvpv.exe162⤵PID:3488
-
\??\c:\xxflrfl.exec:\xxflrfl.exe163⤵PID:552
-
\??\c:\7fxrlfx.exec:\7fxrlfx.exe164⤵PID:1624
-
\??\c:\hthhnt.exec:\hthhnt.exe165⤵PID:4596
-
\??\c:\vddvp.exec:\vddvp.exe166⤵PID:2548
-
\??\c:\dpvpj.exec:\dpvpj.exe167⤵PID:4568
-
\??\c:\rrxrxlf.exec:\rrxrxlf.exe168⤵PID:4824
-
\??\c:\bnnbbh.exec:\bnnbbh.exe169⤵PID:1420
-
\??\c:\9bhhbb.exec:\9bhhbb.exe170⤵PID:3656
-
\??\c:\5pjdv.exec:\5pjdv.exe171⤵PID:4392
-
\??\c:\frlfrfr.exec:\frlfrfr.exe172⤵PID:2624
-
\??\c:\3rxrrrr.exec:\3rxrrrr.exe173⤵PID:2800
-
\??\c:\tbhbtn.exec:\tbhbtn.exe174⤵PID:1992
-
\??\c:\dvvpp.exec:\dvvpp.exe175⤵PID:4204
-
\??\c:\dddvv.exec:\dddvv.exe176⤵PID:64
-
\??\c:\rxffxff.exec:\rxffxff.exe177⤵PID:3692
-
\??\c:\ttnnhh.exec:\ttnnhh.exe178⤵PID:4992
-
\??\c:\pvvvp.exec:\pvvvp.exe179⤵PID:4876
-
\??\c:\ppjpj.exec:\ppjpj.exe180⤵PID:3780
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe181⤵PID:4360
-
\??\c:\xxllrxx.exec:\xxllrxx.exe182⤵PID:2400
-
\??\c:\9ttttn.exec:\9ttttn.exe183⤵PID:1688
-
\??\c:\vvjpv.exec:\vvjpv.exe184⤵PID:696
-
\??\c:\1xffxll.exec:\1xffxll.exe185⤵PID:4588
-
\??\c:\nhhbtt.exec:\nhhbtt.exe186⤵PID:2796
-
\??\c:\5ttnhh.exec:\5ttnhh.exe187⤵PID:2716
-
\??\c:\vvvpv.exec:\vvvpv.exe188⤵PID:4528
-
\??\c:\frxrllf.exec:\frxrllf.exe189⤵PID:1984
-
\??\c:\9fffxrr.exec:\9fffxrr.exe190⤵PID:3492
-
\??\c:\nhnntb.exec:\nhnntb.exe191⤵PID:944
-
\??\c:\vvpjd.exec:\vvpjd.exe192⤵PID:3800
-
\??\c:\xlrrxfx.exec:\xlrrxfx.exe193⤵PID:4420
-
\??\c:\3rrllll.exec:\3rrllll.exe194⤵PID:2504
-
\??\c:\hbhnth.exec:\hbhnth.exe195⤵PID:1848
-
\??\c:\jvdjv.exec:\jvdjv.exe196⤵PID:1820
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe197⤵PID:3872
-
\??\c:\xflfffx.exec:\xflfffx.exe198⤵PID:3092
-
\??\c:\thnnnt.exec:\thnnnt.exe199⤵PID:4212
-
\??\c:\jvvpj.exec:\jvvpj.exe200⤵PID:2104
-
\??\c:\jdjdv.exec:\jdjdv.exe201⤵PID:452
-
\??\c:\rlffffx.exec:\rlffffx.exe202⤵PID:948
-
\??\c:\tnnnhh.exec:\tnnnhh.exe203⤵PID:4648
-
\??\c:\vvdvj.exec:\vvdvj.exe204⤵PID:1532
-
\??\c:\vppvv.exec:\vppvv.exe205⤵PID:552
-
\??\c:\ffrlffr.exec:\ffrlffr.exe206⤵PID:1952
-
\??\c:\hhhbbb.exec:\hhhbbb.exe207⤵PID:4596
-
\??\c:\9bnnnt.exec:\9bnnnt.exe208⤵PID:2296
-
\??\c:\9jppj.exec:\9jppj.exe209⤵PID:4784
-
\??\c:\5jdvj.exec:\5jdvj.exe210⤵PID:4824
-
\??\c:\rlrllff.exec:\rlrllff.exe211⤵PID:2692
-
\??\c:\bnntnn.exec:\bnntnn.exe212⤵PID:3656
-
\??\c:\dvvpj.exec:\dvvpj.exe213⤵PID:2472
-
\??\c:\jvjdd.exec:\jvjdd.exe214⤵PID:2624
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe215⤵PID:748
-
\??\c:\lfllllf.exec:\lfllllf.exe216⤵PID:3436
-
\??\c:\nhnhbb.exec:\nhnhbb.exe217⤵PID:4204
-
\??\c:\7pvpd.exec:\7pvpd.exe218⤵PID:4484
-
\??\c:\1djdp.exec:\1djdp.exe219⤵PID:2016
-
\??\c:\frxrffx.exec:\frxrffx.exe220⤵PID:4992
-
\??\c:\9tbttt.exec:\9tbttt.exe221⤵PID:4876
-
\??\c:\hthbbt.exec:\hthbbt.exe222⤵PID:3200
-
\??\c:\jvdjd.exec:\jvdjd.exe223⤵PID:5012
-
\??\c:\5rfxrxx.exec:\5rfxrxx.exe224⤵PID:1384
-
\??\c:\rrlxrff.exec:\rrlxrff.exe225⤵PID:1688
-
\??\c:\bbbthh.exec:\bbbthh.exe226⤵PID:540
-
\??\c:\thtnhh.exec:\thtnhh.exe227⤵PID:4520
-
\??\c:\dvvpd.exec:\dvvpd.exe228⤵PID:744
-
\??\c:\flxrlxx.exec:\flxrlxx.exe229⤵PID:3612
-
\??\c:\rllrlrl.exec:\rllrlrl.exe230⤵PID:3668
-
\??\c:\nhhhbb.exec:\nhhhbb.exe231⤵PID:1592
-
\??\c:\vdjpd.exec:\vdjpd.exe232⤵PID:2144
-
\??\c:\flrlfff.exec:\flrlfff.exe233⤵PID:3744
-
\??\c:\lfllrff.exec:\lfllrff.exe234⤵PID:3576
-
\??\c:\tnbbnb.exec:\tnbbnb.exe235⤵PID:1704
-
\??\c:\dppvd.exec:\dppvd.exe236⤵PID:4348
-
\??\c:\dpvvv.exec:\dpvvv.exe237⤵PID:3284
-
\??\c:\rrfxrlx.exec:\rrfxrlx.exe238⤵PID:4872
-
\??\c:\bhhhbt.exec:\bhhhbt.exe239⤵PID:3604
-
\??\c:\hbbthh.exec:\hbbthh.exe240⤵PID:2964
-
\??\c:\jjppv.exec:\jjppv.exe241⤵PID:1796
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe242⤵PID:3180