Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exe
-
Size
345KB
-
MD5
6ac496c08e737e4050cf3ac8d4085c4b
-
SHA1
00acdf980218e4e1feb4d24e11955b1217a590a4
-
SHA256
359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99
-
SHA512
ca0a3d5904f1b214d5df61e385278fca8e13e569cd40701239ba47b1f2d6cef7772282de0403f11d53c9d4d672a752fc9580d71bdf01e01ff7b454fc6dd7247a
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyIU:n3C9uDnUXoSWlnwJv90aKToFqwfIBO
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2132-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2132-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2868-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3924-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/408-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4704-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3168-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3168-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3168-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3168-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1472-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2172-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4792-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3760-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2580-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1916-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4944-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1948-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2396-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3796-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2484-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
fxllxrl.exevjvpj.exedvjdd.exenttthb.exebnnhnt.exejvppj.exexflllrl.exexrxfllx.exehhhnnt.exethnnth.exejddjp.exelxflllr.exetnntbn.exeddjjp.exe3pddj.exefxfllfl.exennntbt.exedjjdd.exebhnthn.exepdjjd.exelrxxfll.exeddvjp.exerfxxllf.exe7xxlxfl.exennbnnt.exepppjv.exenhnnth.exeffllxxl.exenhnnnb.exejjjpd.exelxfflll.exetbhthn.exenhnttt.exeththnb.exedjdvp.exexfrxrrr.exebbbhbn.exerxrxxfl.exehbnnbh.exevjpjd.exefxfffff.exebtntnt.exeddjjv.exerllfrff.exennttbh.exevppvv.exexrxxfff.exehtnnnt.exepvpvd.exexrlrxff.exe5flffll.exenhtnbh.exepdddj.exexrrxrxr.exenntbnh.exejdjjj.exerrrxxxx.exenntbtt.exedvpjv.exerlrrlrx.exetntbtt.exejddvp.exelrxrrlr.exexrrxrrr.exepid process 2132 fxllxrl.exe 2868 vjvpj.exe 3924 dvjdd.exe 4704 nttthb.exe 408 bnnhnt.exe 1608 jvppj.exe 3168 xflllrl.exe 1472 xrxfllx.exe 4560 hhhnnt.exe 4404 thnnth.exe 1032 jddjp.exe 2172 lxflllr.exe 3760 tnntbn.exe 2288 ddjjp.exe 4792 3pddj.exe 2580 fxfllfl.exe 1916 nnntbt.exe 1948 djjdd.exe 4944 bhnthn.exe 1492 pdjjd.exe 536 lrxxfll.exe 2088 ddvjp.exe 736 rfxxllf.exe 2204 7xxlxfl.exe 2124 nnbnnt.exe 2396 pppjv.exe 3796 nhnnth.exe 2484 ffllxxl.exe 4816 nhnnnb.exe 4684 jjjpd.exe 2432 lxfflll.exe 616 tbhthn.exe 3600 nhnttt.exe 3556 ththnb.exe 3908 djdvp.exe 2960 xfrxrrr.exe 4468 bbbhbn.exe 4336 rxrxxfl.exe 3196 hbnnbh.exe 2844 vjpjd.exe 2892 fxfffff.exe 4080 btntnt.exe 1772 ddjjv.exe 4704 rllfrff.exe 3720 nnttbh.exe 436 vppvv.exe 4456 xrxxfff.exe 1624 htnnnt.exe 4680 pvpvd.exe 4088 xrlrxff.exe 1940 5flffll.exe 2532 nhtnbh.exe 4640 pdddj.exe 3876 xrrxrxr.exe 2660 nntbnh.exe 5000 jdjjj.exe 2288 rrrxxxx.exe 2540 nntbtt.exe 3120 dvpjv.exe 3164 rlrrlrx.exe 2580 tntbtt.exe 1080 jddvp.exe 952 lrxrrlr.exe 3012 xrrxrrr.exe -
Processes:
resource yara_rule behavioral2/memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exefxllxrl.exevjvpj.exedvjdd.exenttthb.exebnnhnt.exejvppj.exexflllrl.exexrxfllx.exehhhnnt.exethnnth.exejddjp.exelxflllr.exetnntbn.exeddjjp.exe3pddj.exefxfllfl.exennntbt.exedjjdd.exebhnthn.exepdjjd.exelrxxfll.exedescription pid process target process PID 2652 wrote to memory of 2132 2652 359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exe fxllxrl.exe PID 2652 wrote to memory of 2132 2652 359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exe fxllxrl.exe PID 2652 wrote to memory of 2132 2652 359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exe fxllxrl.exe PID 2132 wrote to memory of 2868 2132 fxllxrl.exe vjvpj.exe PID 2132 wrote to memory of 2868 2132 fxllxrl.exe vjvpj.exe PID 2132 wrote to memory of 2868 2132 fxllxrl.exe vjvpj.exe PID 2868 wrote to memory of 3924 2868 vjvpj.exe dvjdd.exe PID 2868 wrote to memory of 3924 2868 vjvpj.exe dvjdd.exe PID 2868 wrote to memory of 3924 2868 vjvpj.exe dvjdd.exe PID 3924 wrote to memory of 4704 3924 dvjdd.exe nttthb.exe PID 3924 wrote to memory of 4704 3924 dvjdd.exe nttthb.exe PID 3924 wrote to memory of 4704 3924 dvjdd.exe nttthb.exe PID 4704 wrote to memory of 408 4704 nttthb.exe bnnhnt.exe PID 4704 wrote to memory of 408 4704 nttthb.exe bnnhnt.exe PID 4704 wrote to memory of 408 4704 nttthb.exe bnnhnt.exe PID 408 wrote to memory of 1608 408 bnnhnt.exe jvppj.exe PID 408 wrote to memory of 1608 408 bnnhnt.exe jvppj.exe PID 408 wrote to memory of 1608 408 bnnhnt.exe jvppj.exe PID 1608 wrote to memory of 3168 1608 jvppj.exe xflllrl.exe PID 1608 wrote to memory of 3168 1608 jvppj.exe xflllrl.exe PID 1608 wrote to memory of 3168 1608 jvppj.exe xflllrl.exe PID 3168 wrote to memory of 1472 3168 xflllrl.exe xrxfllx.exe PID 3168 wrote to memory of 1472 3168 xflllrl.exe xrxfllx.exe PID 3168 wrote to memory of 1472 3168 xflllrl.exe xrxfllx.exe PID 1472 wrote to memory of 4560 1472 xrxfllx.exe hhhnnt.exe PID 1472 wrote to memory of 4560 1472 xrxfllx.exe hhhnnt.exe PID 1472 wrote to memory of 4560 1472 xrxfllx.exe hhhnnt.exe PID 4560 wrote to memory of 4404 4560 hhhnnt.exe thnnth.exe PID 4560 wrote to memory of 4404 4560 hhhnnt.exe thnnth.exe PID 4560 wrote to memory of 4404 4560 hhhnnt.exe thnnth.exe PID 4404 wrote to memory of 1032 4404 thnnth.exe jddjp.exe PID 4404 wrote to memory of 1032 4404 thnnth.exe jddjp.exe PID 4404 wrote to memory of 1032 4404 thnnth.exe jddjp.exe PID 1032 wrote to memory of 2172 1032 jddjp.exe lxflllr.exe PID 1032 wrote to memory of 2172 1032 jddjp.exe lxflllr.exe PID 1032 wrote to memory of 2172 1032 jddjp.exe lxflllr.exe PID 2172 wrote to memory of 3760 2172 lxflllr.exe tnntbn.exe PID 2172 wrote to memory of 3760 2172 lxflllr.exe tnntbn.exe PID 2172 wrote to memory of 3760 2172 lxflllr.exe tnntbn.exe PID 3760 wrote to memory of 2288 3760 tnntbn.exe ddjjp.exe PID 3760 wrote to memory of 2288 3760 tnntbn.exe ddjjp.exe PID 3760 wrote to memory of 2288 3760 tnntbn.exe ddjjp.exe PID 2288 wrote to memory of 4792 2288 ddjjp.exe 3pddj.exe PID 2288 wrote to memory of 4792 2288 ddjjp.exe 3pddj.exe PID 2288 wrote to memory of 4792 2288 ddjjp.exe 3pddj.exe PID 4792 wrote to memory of 2580 4792 3pddj.exe fxfllfl.exe PID 4792 wrote to memory of 2580 4792 3pddj.exe fxfllfl.exe PID 4792 wrote to memory of 2580 4792 3pddj.exe fxfllfl.exe PID 2580 wrote to memory of 1916 2580 fxfllfl.exe nnntbt.exe PID 2580 wrote to memory of 1916 2580 fxfllfl.exe nnntbt.exe PID 2580 wrote to memory of 1916 2580 fxfllfl.exe nnntbt.exe PID 1916 wrote to memory of 1948 1916 nnntbt.exe djjdd.exe PID 1916 wrote to memory of 1948 1916 nnntbt.exe djjdd.exe PID 1916 wrote to memory of 1948 1916 nnntbt.exe djjdd.exe PID 1948 wrote to memory of 4944 1948 djjdd.exe bhnthn.exe PID 1948 wrote to memory of 4944 1948 djjdd.exe bhnthn.exe PID 1948 wrote to memory of 4944 1948 djjdd.exe bhnthn.exe PID 4944 wrote to memory of 1492 4944 bhnthn.exe pdjjd.exe PID 4944 wrote to memory of 1492 4944 bhnthn.exe pdjjd.exe PID 4944 wrote to memory of 1492 4944 bhnthn.exe pdjjd.exe PID 1492 wrote to memory of 536 1492 pdjjd.exe lrxxfll.exe PID 1492 wrote to memory of 536 1492 pdjjd.exe lrxxfll.exe PID 1492 wrote to memory of 536 1492 pdjjd.exe lrxxfll.exe PID 536 wrote to memory of 2088 536 lrxxfll.exe ddvjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exe"C:\Users\Admin\AppData\Local\Temp\359012e44ada1b5eab38f3fd57f3f9383a4a0dbd7b98f0c436fab91ce3659c99.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fxllxrl.exec:\fxllxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvpj.exec:\vjvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjdd.exec:\dvjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttthb.exec:\nttthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnhnt.exec:\bnnhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvppj.exec:\jvppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xflllrl.exec:\xflllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxfllx.exec:\xrxfllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhnnt.exec:\hhhnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnnth.exec:\thnnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddjp.exec:\jddjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxflllr.exec:\lxflllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnntbn.exec:\tnntbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjjp.exec:\ddjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pddj.exec:\3pddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfllfl.exec:\fxfllfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnntbt.exec:\nnntbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjdd.exec:\djjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnthn.exec:\bhnthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjjd.exec:\pdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxxfll.exec:\lrxxfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvjp.exec:\ddvjp.exe23⤵
- Executes dropped EXE
-
\??\c:\rfxxllf.exec:\rfxxllf.exe24⤵
- Executes dropped EXE
-
\??\c:\7xxlxfl.exec:\7xxlxfl.exe25⤵
- Executes dropped EXE
-
\??\c:\nnbnnt.exec:\nnbnnt.exe26⤵
- Executes dropped EXE
-
\??\c:\pppjv.exec:\pppjv.exe27⤵
- Executes dropped EXE
-
\??\c:\nhnnth.exec:\nhnnth.exe28⤵
- Executes dropped EXE
-
\??\c:\ffllxxl.exec:\ffllxxl.exe29⤵
- Executes dropped EXE
-
\??\c:\nhnnnb.exec:\nhnnnb.exe30⤵
- Executes dropped EXE
-
\??\c:\jjjpd.exec:\jjjpd.exe31⤵
- Executes dropped EXE
-
\??\c:\lxfflll.exec:\lxfflll.exe32⤵
- Executes dropped EXE
-
\??\c:\tbhthn.exec:\tbhthn.exe33⤵
- Executes dropped EXE
-
\??\c:\nhnttt.exec:\nhnttt.exe34⤵
- Executes dropped EXE
-
\??\c:\ththnb.exec:\ththnb.exe35⤵
- Executes dropped EXE
-
\??\c:\djdvp.exec:\djdvp.exe36⤵
- Executes dropped EXE
-
\??\c:\xfrxrrr.exec:\xfrxrrr.exe37⤵
- Executes dropped EXE
-
\??\c:\bbbhbn.exec:\bbbhbn.exe38⤵
- Executes dropped EXE
-
\??\c:\rxrxxfl.exec:\rxrxxfl.exe39⤵
- Executes dropped EXE
-
\??\c:\hbnnbh.exec:\hbnnbh.exe40⤵
- Executes dropped EXE
-
\??\c:\vjpjd.exec:\vjpjd.exe41⤵
- Executes dropped EXE
-
\??\c:\fxfffff.exec:\fxfffff.exe42⤵
- Executes dropped EXE
-
\??\c:\btntnt.exec:\btntnt.exe43⤵
- Executes dropped EXE
-
\??\c:\ddjjv.exec:\ddjjv.exe44⤵
- Executes dropped EXE
-
\??\c:\rllfrff.exec:\rllfrff.exe45⤵
- Executes dropped EXE
-
\??\c:\nnttbh.exec:\nnttbh.exe46⤵
- Executes dropped EXE
-
\??\c:\vppvv.exec:\vppvv.exe47⤵
- Executes dropped EXE
-
\??\c:\xrxxfff.exec:\xrxxfff.exe48⤵
- Executes dropped EXE
-
\??\c:\htnnnt.exec:\htnnnt.exe49⤵
- Executes dropped EXE
-
\??\c:\pvpvd.exec:\pvpvd.exe50⤵
- Executes dropped EXE
-
\??\c:\xrlrxff.exec:\xrlrxff.exe51⤵
- Executes dropped EXE
-
\??\c:\5flffll.exec:\5flffll.exe52⤵
- Executes dropped EXE
-
\??\c:\nhtnbh.exec:\nhtnbh.exe53⤵
- Executes dropped EXE
-
\??\c:\pdddj.exec:\pdddj.exe54⤵
- Executes dropped EXE
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe55⤵
- Executes dropped EXE
-
\??\c:\nntbnh.exec:\nntbnh.exe56⤵
- Executes dropped EXE
-
\??\c:\jdjjj.exec:\jdjjj.exe57⤵
- Executes dropped EXE
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe58⤵
- Executes dropped EXE
-
\??\c:\nntbtt.exec:\nntbtt.exe59⤵
- Executes dropped EXE
-
\??\c:\dvpjv.exec:\dvpjv.exe60⤵
- Executes dropped EXE
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe61⤵
- Executes dropped EXE
-
\??\c:\tntbtt.exec:\tntbtt.exe62⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe63⤵
- Executes dropped EXE
-
\??\c:\lrxrrlr.exec:\lrxrrlr.exe64⤵
- Executes dropped EXE
-
\??\c:\xrrxrrr.exec:\xrrxrrr.exe65⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe66⤵
-
\??\c:\rrxffrr.exec:\rrxffrr.exe67⤵
-
\??\c:\ttbbhh.exec:\ttbbhh.exe68⤵
-
\??\c:\jjjjp.exec:\jjjjp.exe69⤵
-
\??\c:\rffxrrr.exec:\rffxrrr.exe70⤵
-
\??\c:\nbttbh.exec:\nbttbh.exe71⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe72⤵
-
\??\c:\lflffff.exec:\lflffff.exe73⤵
-
\??\c:\bhnnhh.exec:\bhnnhh.exe74⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe75⤵
-
\??\c:\9fxxlrf.exec:\9fxxlrf.exe76⤵
-
\??\c:\bbbtbn.exec:\bbbtbn.exe77⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe78⤵
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe79⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe80⤵
-
\??\c:\lfllllr.exec:\lfllllr.exe81⤵
-
\??\c:\hhthhh.exec:\hhthhh.exe82⤵
-
\??\c:\dppdp.exec:\dppdp.exe83⤵
-
\??\c:\ffrlfrf.exec:\ffrlfrf.exe84⤵
-
\??\c:\bntbth.exec:\bntbth.exe85⤵
-
\??\c:\lxrlflx.exec:\lxrlflx.exe86⤵
-
\??\c:\nbtbtb.exec:\nbtbtb.exe87⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe88⤵
-
\??\c:\rrxxxrl.exec:\rrxxxrl.exe89⤵
-
\??\c:\nbhtbt.exec:\nbhtbt.exe90⤵
-
\??\c:\dpjdj.exec:\dpjdj.exe91⤵
-
\??\c:\xrlllxx.exec:\xrlllxx.exe92⤵
-
\??\c:\llrrfrf.exec:\llrrfrf.exe93⤵
-
\??\c:\hhbbbh.exec:\hhbbbh.exe94⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe95⤵
-
\??\c:\rxxrrrf.exec:\rxxrrrf.exe96⤵
-
\??\c:\rrxxxrl.exec:\rrxxxrl.exe97⤵
-
\??\c:\tbhnnn.exec:\tbhnnn.exe98⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe99⤵
-
\??\c:\9fflrrr.exec:\9fflrrr.exe100⤵
-
\??\c:\nbbhhh.exec:\nbbhhh.exe101⤵
-
\??\c:\pddpj.exec:\pddpj.exe102⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe103⤵
-
\??\c:\rxrrrxf.exec:\rxrrrxf.exe104⤵
-
\??\c:\hhtttn.exec:\hhtttn.exe105⤵
-
\??\c:\jppjj.exec:\jppjj.exe106⤵
-
\??\c:\xfffrxr.exec:\xfffrxr.exe107⤵
-
\??\c:\bhhttn.exec:\bhhttn.exe108⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe109⤵
-
\??\c:\fflffff.exec:\fflffff.exe110⤵
-
\??\c:\nhtttt.exec:\nhtttt.exe111⤵
-
\??\c:\dpppv.exec:\dpppv.exe112⤵
-
\??\c:\rxxflrr.exec:\rxxflrr.exe113⤵
-
\??\c:\nnnntb.exec:\nnnntb.exe114⤵
-
\??\c:\1bnnth.exec:\1bnnth.exe115⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe116⤵
-
\??\c:\rrllllr.exec:\rrllllr.exe117⤵
-
\??\c:\5hnnnt.exec:\5hnnnt.exe118⤵
-
\??\c:\tbbbbh.exec:\tbbbbh.exe119⤵
-
\??\c:\vvvjv.exec:\vvvjv.exe120⤵
-
\??\c:\frfflxl.exec:\frfflxl.exe121⤵
-
\??\c:\bbhnbt.exec:\bbhnbt.exe122⤵
-
\??\c:\bbbnbb.exec:\bbbnbb.exe123⤵
-
\??\c:\vddvv.exec:\vddvv.exe124⤵
-
\??\c:\9xfxrxx.exec:\9xfxrxx.exe125⤵
-
\??\c:\tnhhth.exec:\tnhhth.exe126⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe127⤵
-
\??\c:\lllrrfr.exec:\lllrrfr.exe128⤵
-
\??\c:\tbttnt.exec:\tbttnt.exe129⤵
-
\??\c:\5hbbbb.exec:\5hbbbb.exe130⤵
-
\??\c:\bbtbhn.exec:\bbtbhn.exe131⤵
-
\??\c:\djjjp.exec:\djjjp.exe132⤵
-
\??\c:\nhhbhh.exec:\nhhbhh.exe133⤵
-
\??\c:\vjjjp.exec:\vjjjp.exe134⤵
-
\??\c:\fxxlrxl.exec:\fxxlrxl.exe135⤵
-
\??\c:\vvddv.exec:\vvddv.exe136⤵
-
\??\c:\rlllxlx.exec:\rlllxlx.exe137⤵
-
\??\c:\ntbnbt.exec:\ntbnbt.exe138⤵
-
\??\c:\ppjjj.exec:\ppjjj.exe139⤵
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe140⤵
-
\??\c:\ntbtnh.exec:\ntbtnh.exe141⤵
-
\??\c:\lrfrxxf.exec:\lrfrxxf.exe142⤵
-
\??\c:\thnbnn.exec:\thnbnn.exe143⤵
-
\??\c:\3bnhbb.exec:\3bnhbb.exe144⤵
-
\??\c:\9pdjv.exec:\9pdjv.exe145⤵
-
\??\c:\rflfxfx.exec:\rflfxfx.exe146⤵
-
\??\c:\hbhbnt.exec:\hbhbnt.exe147⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe148⤵
-
\??\c:\xffrlrx.exec:\xffrlrx.exe149⤵
-
\??\c:\bhtbbh.exec:\bhtbbh.exe150⤵
-
\??\c:\pdjpv.exec:\pdjpv.exe151⤵
-
\??\c:\jvppp.exec:\jvppp.exe152⤵
-
\??\c:\1nnnbt.exec:\1nnnbt.exe153⤵
-
\??\c:\pdppv.exec:\pdppv.exe154⤵
-
\??\c:\frfffff.exec:\frfffff.exe155⤵
-
\??\c:\thhthn.exec:\thhthn.exe156⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe157⤵
-
\??\c:\lrxrllx.exec:\lrxrllx.exe158⤵
-
\??\c:\hbntnt.exec:\hbntnt.exe159⤵
-
\??\c:\ppppj.exec:\ppppj.exe160⤵
-
\??\c:\rxrxllx.exec:\rxrxllx.exe161⤵
-
\??\c:\lxlllrx.exec:\lxlllrx.exe162⤵
-
\??\c:\thnbhh.exec:\thnbhh.exe163⤵
-
\??\c:\pdjpp.exec:\pdjpp.exe164⤵
-
\??\c:\rflrffx.exec:\rflrffx.exe165⤵
-
\??\c:\ffrrxlr.exec:\ffrrxlr.exe166⤵
-
\??\c:\3bbtht.exec:\3bbtht.exe167⤵
-
\??\c:\jjjvv.exec:\jjjvv.exe168⤵
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe169⤵
-
\??\c:\xfxxffl.exec:\xfxxffl.exe170⤵
-
\??\c:\hhhbtn.exec:\hhhbtn.exe171⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe172⤵
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe173⤵
-
\??\c:\htbttb.exec:\htbttb.exe174⤵
-
\??\c:\vpjvv.exec:\vpjvv.exe175⤵
-
\??\c:\pdvdp.exec:\pdvdp.exe176⤵
-
\??\c:\flfxlxf.exec:\flfxlxf.exe177⤵
-
\??\c:\tnbbht.exec:\tnbbht.exe178⤵
-
\??\c:\pppjd.exec:\pppjd.exe179⤵
-
\??\c:\vjvpj.exec:\vjvpj.exe180⤵
-
\??\c:\fxlffff.exec:\fxlffff.exe181⤵
-
\??\c:\htbbnt.exec:\htbbnt.exe182⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe183⤵
-
\??\c:\frlxxll.exec:\frlxxll.exe184⤵
-
\??\c:\htbbhn.exec:\htbbhn.exe185⤵
-
\??\c:\7dppv.exec:\7dppv.exe186⤵
-
\??\c:\flxxxlx.exec:\flxxxlx.exe187⤵
-
\??\c:\xrrrxfx.exec:\xrrrxfx.exe188⤵
-
\??\c:\nbtnhh.exec:\nbtnhh.exe189⤵
-
\??\c:\ddvdd.exec:\ddvdd.exe190⤵
-
\??\c:\llrrrxf.exec:\llrrrxf.exe191⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe192⤵
-
\??\c:\xxxxxrl.exec:\xxxxxrl.exe193⤵
-
\??\c:\bnbhbn.exec:\bnbhbn.exe194⤵
-
\??\c:\bnnhhb.exec:\bnnhhb.exe195⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe196⤵
-
\??\c:\hthbtn.exec:\hthbtn.exe197⤵
-
\??\c:\nhntnn.exec:\nhntnn.exe198⤵
-
\??\c:\jvddv.exec:\jvddv.exe199⤵
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe200⤵
-
\??\c:\1htnhn.exec:\1htnhn.exe201⤵
-
\??\c:\3ppjd.exec:\3ppjd.exe202⤵
-
\??\c:\xfflrrx.exec:\xfflrrx.exe203⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe204⤵
-
\??\c:\hhnhhb.exec:\hhnhhb.exe205⤵
-
\??\c:\ddjpj.exec:\ddjpj.exe206⤵
-
\??\c:\7rfxllx.exec:\7rfxllx.exe207⤵
-
\??\c:\hhhnbb.exec:\hhhnbb.exe208⤵
-
\??\c:\5vdvj.exec:\5vdvj.exe209⤵
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe210⤵
-
\??\c:\7nhhht.exec:\7nhhht.exe211⤵
-
\??\c:\nhnhbh.exec:\nhnhbh.exe212⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe213⤵
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe214⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe215⤵
-
\??\c:\hbhbtn.exec:\hbhbtn.exe216⤵
-
\??\c:\dpvdv.exec:\dpvdv.exe217⤵
-
\??\c:\xxxrfll.exec:\xxxrfll.exe218⤵
-
\??\c:\hhhhhh.exec:\hhhhhh.exe219⤵
-
\??\c:\ttnhtb.exec:\ttnhtb.exe220⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe221⤵
-
\??\c:\5fffxrr.exec:\5fffxrr.exe222⤵
-
\??\c:\nbnnht.exec:\nbnnht.exe223⤵
-
\??\c:\bthtnn.exec:\bthtnn.exe224⤵
-
\??\c:\1vvpj.exec:\1vvpj.exe225⤵
-
\??\c:\lxfxxfl.exec:\lxfxxfl.exe226⤵
-
\??\c:\nhbntn.exec:\nhbntn.exe227⤵
-
\??\c:\ddppd.exec:\ddppd.exe228⤵
-
\??\c:\dpddd.exec:\dpddd.exe229⤵
-
\??\c:\xrlxfll.exec:\xrlxfll.exe230⤵
-
\??\c:\bthtbn.exec:\bthtbn.exe231⤵
-
\??\c:\pvjvj.exec:\pvjvj.exe232⤵
-
\??\c:\xllxxff.exec:\xllxxff.exe233⤵
-
\??\c:\hbttnh.exec:\hbttnh.exe234⤵
-
\??\c:\vvdjj.exec:\vvdjj.exe235⤵
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe236⤵
-
\??\c:\tttttt.exec:\tttttt.exe237⤵
-
\??\c:\tnhhhn.exec:\tnhhhn.exe238⤵
-
\??\c:\jjddd.exec:\jjddd.exe239⤵
-
\??\c:\rfrfrfx.exec:\rfrfrfx.exe240⤵
-
\??\c:\bntttt.exec:\bntttt.exe241⤵