Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exe
-
Size
92KB
-
MD5
235acf7d09b335ada30bd8f01546afd6
-
SHA1
7f738d95a707701d3dd4119ff174b71d43b3b76a
-
SHA256
84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c
-
SHA512
e86183acbda350e5ef229f473e96d90bc164a3a1a568fd10a22e805b784423633da670938465e74f0abd9482af235ea5ea31fa8d6fcef8481dac221e8b676880
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/214:ymb3NkkiQ3mdBjFo73PYP1lri3K8Gi
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/400-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral2/memory/400-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4160-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3952-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3952-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/512-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3732-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3100-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4032-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4032-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4312-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2952-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2816-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3132-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2684-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/376-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3424-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1952-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4612-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2968-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5016-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4732-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rfrxxxx.exe3nhhhh.exepppvv.exe3jjjv.exepvdvp.exexlrrlff.exeppvpv.exexfxlxfl.exehhtntb.exe5rlrlxr.exe9xffllf.exebhntnn.exedjppj.exebtttnn.exethnbtt.exepdjjj.exerflllll.exetnbbtb.exevpppp.exelrfxfff.exenhtntt.exetnbttb.exelrxrffr.exeffrxlrl.exebnnbnt.exepjvpj.exerlrrlll.exetbhhnt.exe5vjdp.exerrxxxxx.exeffrlflf.exepjjpp.exejjppj.exerlfffff.exenhhhbn.exenhtnbb.exejjdvv.exeppvpj.exerxffxxx.exeffrrxxx.exehbbbtt.exeppdjj.exe7vvdp.exefrxxxff.exehhbbbt.exedpdvp.exedvddd.exerrffxxx.exetbtnnh.exebthbbb.exevpvvv.exerrxxrrx.exehhbbbh.exedjvjv.exejpppv.exe7frrrxf.exe3bhhhn.exe3jvjp.exefflfxxx.exehhbbbb.exevpppj.exejpjjd.exexflxllf.exehttbbh.exepid process 4160 rfrxxxx.exe 3576 3nhhhh.exe 4004 pppvv.exe 512 3jjjv.exe 3952 pvdvp.exe 3732 xlrrlff.exe 5096 ppvpv.exe 3100 xfxlxfl.exe 4032 hhtntb.exe 4312 5rlrlxr.exe 2952 9xffllf.exe 2816 bhntnn.exe 1284 djppj.exe 3132 btttnn.exe 2684 thnbtt.exe 1940 pdjjj.exe 376 rflllll.exe 3424 tnbbtb.exe 704 vpppp.exe 4248 lrfxfff.exe 4384 nhtntt.exe 1952 tnbttb.exe 1056 lrxrffr.exe 1980 ffrxlrl.exe 4612 bnnbnt.exe 2968 pjvpj.exe 5016 rlrrlll.exe 4960 tbhhnt.exe 4732 5vjdp.exe 4908 rrxxxxx.exe 4992 ffrlflf.exe 1912 pjjpp.exe 3384 jjppj.exe 1812 rlfffff.exe 3964 nhhhbn.exe 4796 nhtnbb.exe 1128 jjdvv.exe 4300 ppvpj.exe 3112 rxffxxx.exe 4480 ffrrxxx.exe 4760 hbbbtt.exe 3576 ppdjj.exe 3484 7vvdp.exe 4004 frxxxff.exe 920 hhbbbt.exe 1256 dpdvp.exe 548 dvddd.exe 536 rrffxxx.exe 1472 tbtnnh.exe 3076 bthbbb.exe 4972 vpvvv.exe 4984 rrxxrrx.exe 4500 hhbbbh.exe 4676 djvjv.exe 4968 jpppv.exe 828 7frrrxf.exe 4308 3bhhhn.exe 4952 3jvjp.exe 4532 fflfxxx.exe 4528 hhbbbb.exe 2752 vpppj.exe 4260 jpjjd.exe 4268 xflxllf.exe 3328 httbbh.exe -
Processes:
resource yara_rule behavioral2/memory/400-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exerfrxxxx.exe3nhhhh.exepppvv.exe3jjjv.exepvdvp.exexlrrlff.exeppvpv.exexfxlxfl.exehhtntb.exe5rlrlxr.exe9xffllf.exebhntnn.exedjppj.exebtttnn.exethnbtt.exepdjjj.exerflllll.exetnbbtb.exevpppp.exelrfxfff.exenhtntt.exedescription pid process target process PID 400 wrote to memory of 4160 400 84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exe rfrxxxx.exe PID 400 wrote to memory of 4160 400 84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exe rfrxxxx.exe PID 400 wrote to memory of 4160 400 84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exe rfrxxxx.exe PID 4160 wrote to memory of 3576 4160 rfrxxxx.exe 3nhhhh.exe PID 4160 wrote to memory of 3576 4160 rfrxxxx.exe 3nhhhh.exe PID 4160 wrote to memory of 3576 4160 rfrxxxx.exe 3nhhhh.exe PID 3576 wrote to memory of 4004 3576 3nhhhh.exe pppvv.exe PID 3576 wrote to memory of 4004 3576 3nhhhh.exe pppvv.exe PID 3576 wrote to memory of 4004 3576 3nhhhh.exe pppvv.exe PID 4004 wrote to memory of 512 4004 pppvv.exe 3jjjv.exe PID 4004 wrote to memory of 512 4004 pppvv.exe 3jjjv.exe PID 4004 wrote to memory of 512 4004 pppvv.exe 3jjjv.exe PID 512 wrote to memory of 3952 512 3jjjv.exe pvdvp.exe PID 512 wrote to memory of 3952 512 3jjjv.exe pvdvp.exe PID 512 wrote to memory of 3952 512 3jjjv.exe pvdvp.exe PID 3952 wrote to memory of 3732 3952 pvdvp.exe xlrrlff.exe PID 3952 wrote to memory of 3732 3952 pvdvp.exe xlrrlff.exe PID 3952 wrote to memory of 3732 3952 pvdvp.exe xlrrlff.exe PID 3732 wrote to memory of 5096 3732 xlrrlff.exe ppvpv.exe PID 3732 wrote to memory of 5096 3732 xlrrlff.exe ppvpv.exe PID 3732 wrote to memory of 5096 3732 xlrrlff.exe ppvpv.exe PID 5096 wrote to memory of 3100 5096 ppvpv.exe xfxlxfl.exe PID 5096 wrote to memory of 3100 5096 ppvpv.exe xfxlxfl.exe PID 5096 wrote to memory of 3100 5096 ppvpv.exe xfxlxfl.exe PID 3100 wrote to memory of 4032 3100 xfxlxfl.exe hhtntb.exe PID 3100 wrote to memory of 4032 3100 xfxlxfl.exe hhtntb.exe PID 3100 wrote to memory of 4032 3100 xfxlxfl.exe hhtntb.exe PID 4032 wrote to memory of 4312 4032 hhtntb.exe 5rlrlxr.exe PID 4032 wrote to memory of 4312 4032 hhtntb.exe 5rlrlxr.exe PID 4032 wrote to memory of 4312 4032 hhtntb.exe 5rlrlxr.exe PID 4312 wrote to memory of 2952 4312 5rlrlxr.exe 9xffllf.exe PID 4312 wrote to memory of 2952 4312 5rlrlxr.exe 9xffllf.exe PID 4312 wrote to memory of 2952 4312 5rlrlxr.exe 9xffllf.exe PID 2952 wrote to memory of 2816 2952 9xffllf.exe bhntnn.exe PID 2952 wrote to memory of 2816 2952 9xffllf.exe bhntnn.exe PID 2952 wrote to memory of 2816 2952 9xffllf.exe bhntnn.exe PID 2816 wrote to memory of 1284 2816 bhntnn.exe djppj.exe PID 2816 wrote to memory of 1284 2816 bhntnn.exe djppj.exe PID 2816 wrote to memory of 1284 2816 bhntnn.exe djppj.exe PID 1284 wrote to memory of 3132 1284 djppj.exe btttnn.exe PID 1284 wrote to memory of 3132 1284 djppj.exe btttnn.exe PID 1284 wrote to memory of 3132 1284 djppj.exe btttnn.exe PID 3132 wrote to memory of 2684 3132 btttnn.exe thnbtt.exe PID 3132 wrote to memory of 2684 3132 btttnn.exe thnbtt.exe PID 3132 wrote to memory of 2684 3132 btttnn.exe thnbtt.exe PID 2684 wrote to memory of 1940 2684 thnbtt.exe pdjjj.exe PID 2684 wrote to memory of 1940 2684 thnbtt.exe pdjjj.exe PID 2684 wrote to memory of 1940 2684 thnbtt.exe pdjjj.exe PID 1940 wrote to memory of 376 1940 pdjjj.exe rflllll.exe PID 1940 wrote to memory of 376 1940 pdjjj.exe rflllll.exe PID 1940 wrote to memory of 376 1940 pdjjj.exe rflllll.exe PID 376 wrote to memory of 3424 376 rflllll.exe tnbbtb.exe PID 376 wrote to memory of 3424 376 rflllll.exe tnbbtb.exe PID 376 wrote to memory of 3424 376 rflllll.exe tnbbtb.exe PID 3424 wrote to memory of 704 3424 tnbbtb.exe vpppp.exe PID 3424 wrote to memory of 704 3424 tnbbtb.exe vpppp.exe PID 3424 wrote to memory of 704 3424 tnbbtb.exe vpppp.exe PID 704 wrote to memory of 4248 704 vpppp.exe lrfxfff.exe PID 704 wrote to memory of 4248 704 vpppp.exe lrfxfff.exe PID 704 wrote to memory of 4248 704 vpppp.exe lrfxfff.exe PID 4248 wrote to memory of 4384 4248 lrfxfff.exe nhtntt.exe PID 4248 wrote to memory of 4384 4248 lrfxfff.exe nhtntt.exe PID 4248 wrote to memory of 4384 4248 lrfxfff.exe nhtntt.exe PID 4384 wrote to memory of 1952 4384 nhtntt.exe tnbttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exe"C:\Users\Admin\AppData\Local\Temp\84189dca5daa68469f884dfd9c2ba9dbb98034d1d5c737c08b3f2d60cfe3592c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\rfrxxxx.exec:\rfrxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\3nhhhh.exec:\3nhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\pppvv.exec:\pppvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\3jjjv.exec:\3jjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\pvdvp.exec:\pvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\xlrrlff.exec:\xlrrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\ppvpv.exec:\ppvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\xfxlxfl.exec:\xfxlxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\hhtntb.exec:\hhtntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\5rlrlxr.exec:\5rlrlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\9xffllf.exec:\9xffllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bhntnn.exec:\bhntnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\djppj.exec:\djppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\btttnn.exec:\btttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\thnbtt.exec:\thnbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pdjjj.exec:\pdjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\rflllll.exec:\rflllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\tnbbtb.exec:\tnbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\vpppp.exec:\vpppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\lrfxfff.exec:\lrfxfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\nhtntt.exec:\nhtntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\tnbttb.exec:\tnbttb.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lrxrffr.exec:\lrxrffr.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe25⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bnnbnt.exec:\bnnbnt.exe26⤵
- Executes dropped EXE
PID:4612 -
\??\c:\pjvpj.exec:\pjvpj.exe27⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rlrrlll.exec:\rlrrlll.exe28⤵
- Executes dropped EXE
PID:5016 -
\??\c:\tbhhnt.exec:\tbhhnt.exe29⤵
- Executes dropped EXE
PID:4960 -
\??\c:\5vjdp.exec:\5vjdp.exe30⤵
- Executes dropped EXE
PID:4732 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe31⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ffrlflf.exec:\ffrlflf.exe32⤵
- Executes dropped EXE
PID:4992 -
\??\c:\pjjpp.exec:\pjjpp.exe33⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jjppj.exec:\jjppj.exe34⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rlfffff.exec:\rlfffff.exe35⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhhhbn.exec:\nhhhbn.exe36⤵
- Executes dropped EXE
PID:3964 -
\??\c:\nhtnbb.exec:\nhtnbb.exe37⤵
- Executes dropped EXE
PID:4796 -
\??\c:\jjdvv.exec:\jjdvv.exe38⤵
- Executes dropped EXE
PID:1128 -
\??\c:\ppvpj.exec:\ppvpj.exe39⤵
- Executes dropped EXE
PID:4300 -
\??\c:\rxffxxx.exec:\rxffxxx.exe40⤵
- Executes dropped EXE
PID:3112 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe41⤵
- Executes dropped EXE
PID:4480 -
\??\c:\hbbbtt.exec:\hbbbtt.exe42⤵
- Executes dropped EXE
PID:4760 -
\??\c:\ppdjj.exec:\ppdjj.exe43⤵
- Executes dropped EXE
PID:3576 -
\??\c:\7vvdp.exec:\7vvdp.exe44⤵
- Executes dropped EXE
PID:3484 -
\??\c:\frxxxff.exec:\frxxxff.exe45⤵
- Executes dropped EXE
PID:4004 -
\??\c:\hhbbbt.exec:\hhbbbt.exe46⤵
- Executes dropped EXE
PID:920 -
\??\c:\dpdvp.exec:\dpdvp.exe47⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dvddd.exec:\dvddd.exe48⤵
- Executes dropped EXE
PID:548 -
\??\c:\rrffxxx.exec:\rrffxxx.exe49⤵
- Executes dropped EXE
PID:536 -
\??\c:\tbtnnh.exec:\tbtnnh.exe50⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bthbbb.exec:\bthbbb.exe51⤵
- Executes dropped EXE
PID:3076 -
\??\c:\vpvvv.exec:\vpvvv.exe52⤵
- Executes dropped EXE
PID:4972 -
\??\c:\rrxxrrx.exec:\rrxxrrx.exe53⤵
- Executes dropped EXE
PID:4984 -
\??\c:\hhbbbh.exec:\hhbbbh.exe54⤵
- Executes dropped EXE
PID:4500 -
\??\c:\djvjv.exec:\djvjv.exe55⤵
- Executes dropped EXE
PID:4676 -
\??\c:\jpppv.exec:\jpppv.exe56⤵
- Executes dropped EXE
PID:4968 -
\??\c:\7frrrxf.exec:\7frrrxf.exe57⤵
- Executes dropped EXE
PID:828 -
\??\c:\3bhhhn.exec:\3bhhhn.exe58⤵
- Executes dropped EXE
PID:4308 -
\??\c:\3jvjp.exec:\3jvjp.exe59⤵
- Executes dropped EXE
PID:4952 -
\??\c:\fflfxxx.exec:\fflfxxx.exe60⤵
- Executes dropped EXE
PID:4532 -
\??\c:\hhbbbb.exec:\hhbbbb.exe61⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vpppj.exec:\vpppj.exe62⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jpjjd.exec:\jpjjd.exe63⤵
- Executes dropped EXE
PID:4260 -
\??\c:\xflxllf.exec:\xflxllf.exe64⤵
- Executes dropped EXE
PID:4268 -
\??\c:\httbbh.exec:\httbbh.exe65⤵
- Executes dropped EXE
PID:3328 -
\??\c:\ppvvv.exec:\ppvvv.exe66⤵PID:3716
-
\??\c:\rxfxrlx.exec:\rxfxrlx.exe67⤵PID:1236
-
\??\c:\httbht.exec:\httbht.exe68⤵PID:4688
-
\??\c:\3tthhh.exec:\3tthhh.exe69⤵PID:1800
-
\??\c:\9pvpd.exec:\9pvpd.exe70⤵PID:3560
-
\??\c:\ppppj.exec:\ppppj.exe71⤵PID:4336
-
\??\c:\rxrlfff.exec:\rxrlfff.exe72⤵PID:2100
-
\??\c:\nhhnhh.exec:\nhhnhh.exe73⤵PID:1736
-
\??\c:\thhbbt.exec:\thhbbt.exe74⤵PID:4756
-
\??\c:\7dpjp.exec:\7dpjp.exe75⤵PID:780
-
\??\c:\jjvvv.exec:\jjvvv.exe76⤵PID:2140
-
\??\c:\rlfrrff.exec:\rlfrrff.exe77⤵PID:4992
-
\??\c:\nhntbh.exec:\nhntbh.exe78⤵PID:1144
-
\??\c:\dvvvp.exec:\dvvvp.exe79⤵PID:4176
-
\??\c:\9pvvp.exec:\9pvvp.exe80⤵PID:1812
-
\??\c:\frfllfr.exec:\frfllfr.exe81⤵PID:3788
-
\??\c:\flffxxx.exec:\flffxxx.exe82⤵PID:4816
-
\??\c:\nttnbb.exec:\nttnbb.exe83⤵PID:1208
-
\??\c:\tnnbbb.exec:\tnnbbb.exe84⤵PID:1468
-
\??\c:\dvppp.exec:\dvppp.exe85⤵PID:1492
-
\??\c:\flrrrxf.exec:\flrrrxf.exe86⤵PID:1700
-
\??\c:\9pjdv.exec:\9pjdv.exe87⤵PID:3240
-
\??\c:\vvjpj.exec:\vvjpj.exe88⤵PID:2356
-
\??\c:\xlfrrfr.exec:\xlfrrfr.exe89⤵PID:512
-
\??\c:\btnbtn.exec:\btnbtn.exe90⤵PID:4936
-
\??\c:\ppdjv.exec:\ppdjv.exe91⤵PID:960
-
\??\c:\7nnhtb.exec:\7nnhtb.exe92⤵PID:3732
-
\??\c:\5ttnnh.exec:\5ttnnh.exe93⤵PID:3800
-
\??\c:\hnnnhh.exec:\hnnnhh.exe94⤵PID:2452
-
\??\c:\jjjdp.exec:\jjjdp.exe95⤵PID:2360
-
\??\c:\rlrrxfx.exec:\rlrrxfx.exe96⤵PID:2044
-
\??\c:\htbntt.exec:\htbntt.exe97⤵PID:1640
-
\??\c:\bhnbbt.exec:\bhnbbt.exe98⤵PID:2208
-
\??\c:\dpdjv.exec:\dpdjv.exe99⤵PID:1100
-
\??\c:\9flrlrl.exec:\9flrlrl.exe100⤵PID:4576
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe101⤵PID:3132
-
\??\c:\5hnhbb.exec:\5hnhbb.exe102⤵PID:4116
-
\??\c:\pdvvv.exec:\pdvvv.exe103⤵PID:2572
-
\??\c:\3lffflr.exec:\3lffflr.exe104⤵PID:4228
-
\??\c:\lflrrxl.exec:\lflrrxl.exe105⤵PID:4376
-
\??\c:\hhnnnb.exec:\hhnnnb.exe106⤵PID:4540
-
\??\c:\dpvvv.exec:\dpvvv.exe107⤵PID:436
-
\??\c:\frxrrrr.exec:\frxrrrr.exe108⤵PID:1068
-
\??\c:\lffffff.exec:\lffffff.exe109⤵PID:1744
-
\??\c:\tbbhbn.exec:\tbbhbn.exe110⤵PID:2012
-
\??\c:\ppddp.exec:\ppddp.exe111⤵PID:1452
-
\??\c:\rrlxllr.exec:\rrlxllr.exe112⤵PID:3960
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe113⤵PID:2916
-
\??\c:\nntbbb.exec:\nntbbb.exe114⤵PID:1448
-
\??\c:\3jdjp.exec:\3jdjp.exe115⤵PID:4724
-
\??\c:\fxflrfl.exec:\fxflrfl.exe116⤵PID:4324
-
\??\c:\bttttt.exec:\bttttt.exe117⤵PID:3876
-
\??\c:\jpddd.exec:\jpddd.exe118⤵PID:1008
-
\??\c:\vdpjp.exec:\vdpjp.exe119⤵PID:2476
-
\??\c:\ffffrll.exec:\ffffrll.exe120⤵PID:1576
-
\??\c:\nnnttn.exec:\nnnttn.exe121⤵PID:3976
-
\??\c:\vvjdj.exec:\vvjdj.exe122⤵PID:4960
-
\??\c:\1jdpp.exec:\1jdpp.exe123⤵PID:2468
-
\??\c:\frxlfll.exec:\frxlfll.exe124⤵PID:3996
-
\??\c:\9xrfllf.exec:\9xrfllf.exe125⤵PID:3520
-
\??\c:\hbnnnh.exec:\hbnnnh.exe126⤵PID:1564
-
\??\c:\9djjj.exec:\9djjj.exe127⤵PID:2420
-
\??\c:\lffxrrx.exec:\lffxrrx.exe128⤵PID:5076
-
\??\c:\1nntbb.exec:\1nntbb.exe129⤵PID:3756
-
\??\c:\3bbhhn.exec:\3bbhhn.exe130⤵PID:3184
-
\??\c:\pvddd.exec:\pvddd.exe131⤵PID:2940
-
\??\c:\flrxllf.exec:\flrxllf.exe132⤵PID:4616
-
\??\c:\hbtttt.exec:\hbtttt.exe133⤵PID:4800
-
\??\c:\tnntnn.exec:\tnntnn.exe134⤵PID:5084
-
\??\c:\vvjjd.exec:\vvjjd.exe135⤵PID:8
-
\??\c:\rxlxxlx.exec:\rxlxxlx.exe136⤵PID:4420
-
\??\c:\1hnnnh.exec:\1hnnnh.exe137⤵PID:1656
-
\??\c:\tnnhnh.exec:\tnnhnh.exe138⤵PID:4668
-
\??\c:\jvppd.exec:\jvppd.exe139⤵PID:512
-
\??\c:\rflffrf.exec:\rflffrf.exe140⤵PID:4936
-
\??\c:\tthhhb.exec:\tthhhb.exe141⤵PID:3080
-
\??\c:\hntnhh.exec:\hntnhh.exe142⤵PID:3732
-
\??\c:\djvpj.exec:\djvpj.exe143⤵PID:3800
-
\??\c:\xrrlllf.exec:\xrrlllf.exe144⤵PID:3040
-
\??\c:\3hntnt.exec:\3hntnt.exe145⤵PID:4368
-
\??\c:\jppvp.exec:\jppvp.exe146⤵PID:372
-
\??\c:\fffrlfl.exec:\fffrlfl.exe147⤵PID:1640
-
\??\c:\frxrlrl.exec:\frxrlrl.exe148⤵PID:2208
-
\??\c:\nhnnnb.exec:\nhnnnb.exe149⤵PID:4064
-
\??\c:\7dvpp.exec:\7dvpp.exe150⤵PID:916
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe151⤵PID:3324
-
\??\c:\fxxrllf.exec:\fxxrllf.exe152⤵PID:4116
-
\??\c:\1nbhhh.exec:\1nbhhh.exe153⤵PID:3724
-
\??\c:\pjvdd.exec:\pjvdd.exe154⤵PID:1580
-
\??\c:\fxxxllf.exec:\fxxxllf.exe155⤵PID:4376
-
\??\c:\bthhnt.exec:\bthhnt.exe156⤵PID:404
-
\??\c:\nbtnbt.exec:\nbtnbt.exe157⤵PID:4000
-
\??\c:\djpjj.exec:\djpjj.exe158⤵PID:2132
-
\??\c:\7ffxrxr.exec:\7ffxrxr.exe159⤵PID:2676
-
\??\c:\xxxlrxx.exec:\xxxlrxx.exe160⤵PID:1452
-
\??\c:\tnnttb.exec:\tnnttb.exe161⤵PID:4964
-
\??\c:\vdjjj.exec:\vdjjj.exe162⤵PID:4332
-
\??\c:\5vppj.exec:\5vppj.exe163⤵PID:3328
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe164⤵PID:1236
-
\??\c:\hhnhnt.exec:\hhnhnt.exe165⤵PID:4688
-
\??\c:\hbtnnn.exec:\hbtnnn.exe166⤵PID:1244
-
\??\c:\djpvp.exec:\djpvp.exe167⤵PID:4484
-
\??\c:\3rlllrf.exec:\3rlllrf.exe168⤵PID:2252
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe169⤵PID:1576
-
\??\c:\nhhhht.exec:\nhhhht.exe170⤵PID:4560
-
\??\c:\vvdjj.exec:\vvdjj.exe171⤵PID:4732
-
\??\c:\rlrffff.exec:\rlrffff.exe172⤵PID:3996
-
\??\c:\thhbtn.exec:\thhbtn.exe173⤵PID:1144
-
\??\c:\vjpvv.exec:\vjpvv.exe174⤵PID:468
-
\??\c:\lrfxxlr.exec:\lrfxxlr.exe175⤵PID:1304
-
\??\c:\hbbbtb.exec:\hbbbtb.exe176⤵PID:4624
-
\??\c:\bhhtnn.exec:\bhhtnn.exe177⤵PID:4292
-
\??\c:\jjddd.exec:\jjddd.exe178⤵PID:1128
-
\??\c:\frrlxxx.exec:\frrlxxx.exe179⤵PID:4028
-
\??\c:\tnhhbb.exec:\tnhhbb.exe180⤵PID:2948
-
\??\c:\hbbnbt.exec:\hbbnbt.exe181⤵PID:640
-
\??\c:\vpdvv.exec:\vpdvv.exe182⤵PID:4780
-
\??\c:\3rrrlrl.exec:\3rrrlrl.exe183⤵PID:3484
-
\??\c:\ffxxflx.exec:\ffxxflx.exe184⤵PID:4860
-
\??\c:\bhhhbb.exec:\bhhhbb.exe185⤵PID:2824
-
\??\c:\dvvpj.exec:\dvvpj.exe186⤵PID:1256
-
\??\c:\pppdv.exec:\pppdv.exe187⤵PID:2988
-
\??\c:\5rfxffr.exec:\5rfxffr.exe188⤵PID:1932
-
\??\c:\bntnnt.exec:\bntnnt.exe189⤵PID:4824
-
\??\c:\dpvpj.exec:\dpvpj.exe190⤵PID:3076
-
\??\c:\vpddd.exec:\vpddd.exe191⤵PID:3632
-
\??\c:\llxfrlx.exec:\llxfrlx.exe192⤵PID:4312
-
\??\c:\bbtnhb.exec:\bbtnhb.exe193⤵PID:4620
-
\??\c:\bbbbtb.exec:\bbbbtb.exe194⤵PID:4676
-
\??\c:\vvdvp.exec:\vvdvp.exe195⤵PID:1836
-
\??\c:\jjpjj.exec:\jjpjj.exe196⤵PID:5064
-
\??\c:\fxffrxx.exec:\fxffrxx.exe197⤵PID:916
-
\??\c:\9lfxlxx.exec:\9lfxlxx.exe198⤵PID:1456
-
\??\c:\3nbtbb.exec:\3nbtbb.exe199⤵PID:1568
-
\??\c:\hhnhbb.exec:\hhnhbb.exe200⤵PID:376
-
\??\c:\vvvvj.exec:\vvvvj.exe201⤵PID:3424
-
\??\c:\pdppp.exec:\pdppp.exe202⤵PID:1068
-
\??\c:\lllfxxl.exec:\lllfxxl.exe203⤵PID:4888
-
\??\c:\lrlxlxx.exec:\lrlxlxx.exe204⤵PID:2752
-
\??\c:\tnbtbn.exec:\tnbtbn.exe205⤵PID:1980
-
\??\c:\jdjdd.exec:\jdjdd.exe206⤵PID:2916
-
\??\c:\vpvvj.exec:\vpvvj.exe207⤵PID:2544
-
\??\c:\lfxrlll.exec:\lfxrlll.exe208⤵PID:4724
-
\??\c:\3fxrrxl.exec:\3fxrrxl.exe209⤵PID:4424
-
\??\c:\7fxffll.exec:\7fxffll.exe210⤵PID:1008
-
\??\c:\bbbttb.exec:\bbbttb.exe211⤵PID:3904
-
\??\c:\bntthn.exec:\bntthn.exe212⤵PID:3448
-
\??\c:\jdpjd.exec:\jdpjd.exe213⤵PID:3468
-
\??\c:\jvddv.exec:\jvddv.exe214⤵PID:1680
-
\??\c:\1ffflrr.exec:\1ffflrr.exe215⤵PID:4868
-
\??\c:\nbbnhh.exec:\nbbnhh.exe216⤵PID:1564
-
\??\c:\3ntnhh.exec:\3ntnhh.exe217⤵PID:4776
-
\??\c:\jdjjp.exec:\jdjjp.exe218⤵PID:4440
-
\??\c:\vpvvp.exec:\vpvvp.exe219⤵PID:3912
-
\??\c:\lfllxfx.exec:\lfllxfx.exe220⤵PID:4864
-
\??\c:\rlxxxll.exec:\rlxxxll.exe221⤵PID:1492
-
\??\c:\5thttt.exec:\5thttt.exe222⤵PID:2948
-
\??\c:\3thbhn.exec:\3thbhn.exe223⤵PID:8
-
\??\c:\1ddjj.exec:\1ddjj.exe224⤵PID:1436
-
\??\c:\vpvpp.exec:\vpvpp.exe225⤵PID:4668
-
\??\c:\rxrlfrf.exec:\rxrlfrf.exe226⤵PID:960
-
\??\c:\xfrrxxx.exec:\xfrrxxx.exe227⤵PID:2672
-
\??\c:\1ddvd.exec:\1ddvd.exe228⤵PID:3768
-
\??\c:\1ppjv.exec:\1ppjv.exe229⤵PID:2348
-
\??\c:\lxflrxr.exec:\lxflrxr.exe230⤵PID:1048
-
\??\c:\thbbtb.exec:\thbbtb.exe231⤵PID:4940
-
\??\c:\vpvvp.exec:\vpvvp.exe232⤵PID:2952
-
\??\c:\7vdvp.exec:\7vdvp.exe233⤵PID:1284
-
\??\c:\lrfllll.exec:\lrfllll.exe234⤵PID:4064
-
\??\c:\fxxlrll.exec:\fxxlrll.exe235⤵PID:3552
-
\??\c:\httthn.exec:\httthn.exe236⤵PID:5008
-
\??\c:\hhbtnn.exec:\hhbtnn.exe237⤵PID:2572
-
\??\c:\djpdp.exec:\djpdp.exe238⤵PID:4768
-
\??\c:\frffllr.exec:\frffllr.exe239⤵PID:1580
-
\??\c:\nhtbbn.exec:\nhtbbn.exe240⤵PID:436
-
\??\c:\jdppd.exec:\jdppd.exe241⤵PID:2728
-
\??\c:\vpddv.exec:\vpddv.exe242⤵PID:1056