Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exe
-
Size
277KB
-
MD5
ee074aaf85f23ec4eff9dce226d420a0
-
SHA1
73d6d903f6b54e162326ad35aaf467afa4b1afa5
-
SHA256
971d925bc94769fe02b75e32f95bd6085e5dd981cf16226fbda944059f1f7d6f
-
SHA512
0f02c7e4126a484099715ab4f7f4dec77948f49f7351225eade16b861e74c576242221d133fcc89c7f79250b1b4fee7b165e194689ceb59c0817e3369622fc7c
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7VvemX:n3C9uYA71kSMuF
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/228-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/852-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ddpjj.exexxfxrrr.exehhhbbb.exenthbtt.exejvjjd.exelfrrxxf.exexrxllfx.exe1bbttt.exeppjdd.exepdjdv.exerfffxxx.exexxrlllx.exebhbhnt.exejdddv.exevvddp.exerxlfffr.exeflxrrrr.exehhhbbb.exe1nntnn.exeppppj.exe5rlfxxr.exexxxxrrl.exehbhnnh.exethttnt.exepjjjj.exedjvpv.exerllfllf.exenhtnbb.exebtnhtt.exevvppp.exellrxffr.exe5lfxxrl.exe3thbtb.exethhbnb.exedjppv.exerxrlrrf.exenthbtt.exebbtntt.exevpvvp.exevdjpd.exexxxxflx.exetttnnh.exebthhtn.exejjpdj.exellxxlfr.exenhtbtb.exehnhhbh.exepdpjd.exejdjdj.exelfxlfxr.exehttbbb.exehthhbb.exe3pvjd.exe9vddj.exexxxxrrr.exettbbtt.exentbbbh.exejpvvp.exe3rfxxfx.exellrrrrl.exennhbhh.exedpjjp.exefxlffff.exe5btnnn.exepid process 3020 ddpjj.exe 1380 xxfxrrr.exe 4604 hhhbbb.exe 3312 nthbtt.exe 1524 jvjjd.exe 1616 lfrrxxf.exe 4168 xrxllfx.exe 4580 1bbttt.exe 2332 ppjdd.exe 3288 pdjdv.exe 2620 rfffxxx.exe 4944 xxrlllx.exe 392 bhbhnt.exe 4372 jdddv.exe 4872 vvddp.exe 3508 rxlfffr.exe 2012 flxrrrr.exe 852 hhhbbb.exe 4476 1nntnn.exe 1240 ppppj.exe 4616 5rlfxxr.exe 2716 xxxxrrl.exe 716 hbhnnh.exe 3892 thttnt.exe 1464 pjjjj.exe 2392 djvpv.exe 1252 rllfllf.exe 4360 nhtnbb.exe 3548 btnhtt.exe 4888 vvppp.exe 2120 llrxffr.exe 1944 5lfxxrl.exe 1968 3thbtb.exe 3884 thhbnb.exe 4412 djppv.exe 3104 rxrlrrf.exe 4160 nthbtt.exe 2444 bbtntt.exe 1504 vpvvp.exe 5040 vdjpd.exe 2132 xxxxflx.exe 4596 tttnnh.exe 5076 bthhtn.exe 2540 jjpdj.exe 2664 llxxlfr.exe 2224 nhtbtb.exe 2000 hnhhbh.exe 3024 pdpjd.exe 4576 jdjdj.exe 3312 lfxlfxr.exe 1068 httbbb.exe 3224 hthhbb.exe 3276 3pvjd.exe 3488 9vddj.exe 3228 xxxxrrr.exe 816 ttbbtt.exe 1484 ntbbbh.exe 4372 jpvvp.exe 4672 3rfxxfx.exe 772 llrrrrl.exe 1740 nnhbhh.exe 3084 dpjjp.exe 1820 fxlffff.exe 4768 5btnnn.exe -
Processes:
resource yara_rule behavioral2/memory/228-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-12-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exeddpjj.exexxfxrrr.exehhhbbb.exenthbtt.exejvjjd.exelfrrxxf.exexrxllfx.exe1bbttt.exeppjdd.exepdjdv.exerfffxxx.exexxrlllx.exebhbhnt.exejdddv.exevvddp.exerxlfffr.exeflxrrrr.exehhhbbb.exe1nntnn.exeppppj.exe5rlfxxr.exedescription pid process target process PID 228 wrote to memory of 3020 228 ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exe ddpjj.exe PID 228 wrote to memory of 3020 228 ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exe ddpjj.exe PID 228 wrote to memory of 3020 228 ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exe ddpjj.exe PID 3020 wrote to memory of 1380 3020 ddpjj.exe xxfxrrr.exe PID 3020 wrote to memory of 1380 3020 ddpjj.exe xxfxrrr.exe PID 3020 wrote to memory of 1380 3020 ddpjj.exe xxfxrrr.exe PID 1380 wrote to memory of 4604 1380 xxfxrrr.exe hhhbbb.exe PID 1380 wrote to memory of 4604 1380 xxfxrrr.exe hhhbbb.exe PID 1380 wrote to memory of 4604 1380 xxfxrrr.exe hhhbbb.exe PID 4604 wrote to memory of 3312 4604 hhhbbb.exe nthbtt.exe PID 4604 wrote to memory of 3312 4604 hhhbbb.exe nthbtt.exe PID 4604 wrote to memory of 3312 4604 hhhbbb.exe nthbtt.exe PID 3312 wrote to memory of 1524 3312 nthbtt.exe jvjjd.exe PID 3312 wrote to memory of 1524 3312 nthbtt.exe jvjjd.exe PID 3312 wrote to memory of 1524 3312 nthbtt.exe jvjjd.exe PID 1524 wrote to memory of 1616 1524 jvjjd.exe lfrrxxf.exe PID 1524 wrote to memory of 1616 1524 jvjjd.exe lfrrxxf.exe PID 1524 wrote to memory of 1616 1524 jvjjd.exe lfrrxxf.exe PID 1616 wrote to memory of 4168 1616 lfrrxxf.exe xrxllfx.exe PID 1616 wrote to memory of 4168 1616 lfrrxxf.exe xrxllfx.exe PID 1616 wrote to memory of 4168 1616 lfrrxxf.exe xrxllfx.exe PID 4168 wrote to memory of 4580 4168 xrxllfx.exe 1bbttt.exe PID 4168 wrote to memory of 4580 4168 xrxllfx.exe 1bbttt.exe PID 4168 wrote to memory of 4580 4168 xrxllfx.exe 1bbttt.exe PID 4580 wrote to memory of 2332 4580 1bbttt.exe ppjdd.exe PID 4580 wrote to memory of 2332 4580 1bbttt.exe ppjdd.exe PID 4580 wrote to memory of 2332 4580 1bbttt.exe ppjdd.exe PID 2332 wrote to memory of 3288 2332 ppjdd.exe pdjdv.exe PID 2332 wrote to memory of 3288 2332 ppjdd.exe pdjdv.exe PID 2332 wrote to memory of 3288 2332 ppjdd.exe pdjdv.exe PID 3288 wrote to memory of 2620 3288 pdjdv.exe rfffxxx.exe PID 3288 wrote to memory of 2620 3288 pdjdv.exe rfffxxx.exe PID 3288 wrote to memory of 2620 3288 pdjdv.exe rfffxxx.exe PID 2620 wrote to memory of 4944 2620 rfffxxx.exe xxrlllx.exe PID 2620 wrote to memory of 4944 2620 rfffxxx.exe xxrlllx.exe PID 2620 wrote to memory of 4944 2620 rfffxxx.exe xxrlllx.exe PID 4944 wrote to memory of 392 4944 xxrlllx.exe bhbhnt.exe PID 4944 wrote to memory of 392 4944 xxrlllx.exe bhbhnt.exe PID 4944 wrote to memory of 392 4944 xxrlllx.exe bhbhnt.exe PID 392 wrote to memory of 4372 392 bhbhnt.exe jdddv.exe PID 392 wrote to memory of 4372 392 bhbhnt.exe jdddv.exe PID 392 wrote to memory of 4372 392 bhbhnt.exe jdddv.exe PID 4372 wrote to memory of 4872 4372 jdddv.exe vvddp.exe PID 4372 wrote to memory of 4872 4372 jdddv.exe vvddp.exe PID 4372 wrote to memory of 4872 4372 jdddv.exe vvddp.exe PID 4872 wrote to memory of 3508 4872 vvddp.exe rxlfffr.exe PID 4872 wrote to memory of 3508 4872 vvddp.exe rxlfffr.exe PID 4872 wrote to memory of 3508 4872 vvddp.exe rxlfffr.exe PID 3508 wrote to memory of 2012 3508 rxlfffr.exe flxrrrr.exe PID 3508 wrote to memory of 2012 3508 rxlfffr.exe flxrrrr.exe PID 3508 wrote to memory of 2012 3508 rxlfffr.exe flxrrrr.exe PID 2012 wrote to memory of 852 2012 flxrrrr.exe hhhbbb.exe PID 2012 wrote to memory of 852 2012 flxrrrr.exe hhhbbb.exe PID 2012 wrote to memory of 852 2012 flxrrrr.exe hhhbbb.exe PID 852 wrote to memory of 4476 852 hhhbbb.exe 1nntnn.exe PID 852 wrote to memory of 4476 852 hhhbbb.exe 1nntnn.exe PID 852 wrote to memory of 4476 852 hhhbbb.exe 1nntnn.exe PID 4476 wrote to memory of 1240 4476 1nntnn.exe ppppj.exe PID 4476 wrote to memory of 1240 4476 1nntnn.exe ppppj.exe PID 4476 wrote to memory of 1240 4476 1nntnn.exe ppppj.exe PID 1240 wrote to memory of 4616 1240 ppppj.exe 5rlfxxr.exe PID 1240 wrote to memory of 4616 1240 ppppj.exe 5rlfxxr.exe PID 1240 wrote to memory of 4616 1240 ppppj.exe 5rlfxxr.exe PID 4616 wrote to memory of 2716 4616 5rlfxxr.exe xxxxrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exe"C:\Users\Admin\AppData\Local\Temp\ee074aaf85f23ec4eff9dce226d420a0.exe.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\ddpjj.exec:\ddpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\hhhbbb.exec:\hhhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\nthbtt.exec:\nthbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\jvjjd.exec:\jvjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\xrxllfx.exec:\xrxllfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\1bbttt.exec:\1bbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\ppjdd.exec:\ppjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pdjdv.exec:\pdjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\rfffxxx.exec:\rfffxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xxrlllx.exec:\xxrlllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\bhbhnt.exec:\bhbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\jdddv.exec:\jdddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\vvddp.exec:\vvddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rxlfffr.exec:\rxlfffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\flxrrrr.exec:\flxrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\hhhbbb.exec:\hhhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\1nntnn.exec:\1nntnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\ppppj.exec:\ppppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\5rlfxxr.exec:\5rlfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe23⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hbhnnh.exec:\hbhnnh.exe24⤵
- Executes dropped EXE
PID:716 -
\??\c:\thttnt.exec:\thttnt.exe25⤵
- Executes dropped EXE
PID:3892 -
\??\c:\pjjjj.exec:\pjjjj.exe26⤵
- Executes dropped EXE
PID:1464 -
\??\c:\djvpv.exec:\djvpv.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rllfllf.exec:\rllfllf.exe28⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nhtnbb.exec:\nhtnbb.exe29⤵
- Executes dropped EXE
PID:4360 -
\??\c:\btnhtt.exec:\btnhtt.exe30⤵
- Executes dropped EXE
PID:3548 -
\??\c:\vvppp.exec:\vvppp.exe31⤵
- Executes dropped EXE
PID:4888 -
\??\c:\llrxffr.exec:\llrxffr.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5lfxxrl.exec:\5lfxxrl.exe33⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3thbtb.exec:\3thbtb.exe34⤵
- Executes dropped EXE
PID:1968 -
\??\c:\thhbnb.exec:\thhbnb.exe35⤵
- Executes dropped EXE
PID:3884 -
\??\c:\djppv.exec:\djppv.exe36⤵
- Executes dropped EXE
PID:4412 -
\??\c:\rxrlrrf.exec:\rxrlrrf.exe37⤵
- Executes dropped EXE
PID:3104 -
\??\c:\nthbtt.exec:\nthbtt.exe38⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bbtntt.exec:\bbtntt.exe39⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vpvvp.exec:\vpvvp.exe40⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vdjpd.exec:\vdjpd.exe41⤵
- Executes dropped EXE
PID:5040 -
\??\c:\xxxxflx.exec:\xxxxflx.exe42⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tttnnh.exec:\tttnnh.exe43⤵
- Executes dropped EXE
PID:4596 -
\??\c:\bthhtn.exec:\bthhtn.exe44⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jjpdj.exec:\jjpdj.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vpppd.exec:\vpppd.exe46⤵PID:4420
-
\??\c:\llxxlfr.exec:\llxxlfr.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nhtbtb.exec:\nhtbtb.exe48⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hnhhbh.exec:\hnhhbh.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pdpjd.exec:\pdpjd.exe50⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jdjdj.exec:\jdjdj.exe51⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe52⤵
- Executes dropped EXE
PID:3312 -
\??\c:\httbbb.exec:\httbbb.exe53⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hthhbb.exec:\hthhbb.exe54⤵
- Executes dropped EXE
PID:3224 -
\??\c:\3pvjd.exec:\3pvjd.exe55⤵
- Executes dropped EXE
PID:3276 -
\??\c:\9vddj.exec:\9vddj.exe56⤵
- Executes dropped EXE
PID:3488 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe57⤵
- Executes dropped EXE
PID:3228 -
\??\c:\ttbbtt.exec:\ttbbtt.exe58⤵
- Executes dropped EXE
PID:816 -
\??\c:\ntbbbh.exec:\ntbbbh.exe59⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jpvvp.exec:\jpvvp.exe60⤵
- Executes dropped EXE
PID:4372 -
\??\c:\3rfxxfx.exec:\3rfxxfx.exe61⤵
- Executes dropped EXE
PID:4672 -
\??\c:\llrrrrl.exec:\llrrrrl.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\nnhbhh.exec:\nnhbhh.exe63⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dpjjp.exec:\dpjjp.exe64⤵
- Executes dropped EXE
PID:3084 -
\??\c:\fxlffff.exec:\fxlffff.exe65⤵
- Executes dropped EXE
PID:1820 -
\??\c:\5btnnn.exec:\5btnnn.exe66⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nhtnhn.exec:\nhtnhn.exe67⤵PID:1544
-
\??\c:\dvddv.exec:\dvddv.exe68⤵PID:2796
-
\??\c:\ffxrrxf.exec:\ffxrrxf.exe69⤵PID:940
-
\??\c:\rrxxxxl.exec:\rrxxxxl.exe70⤵PID:1464
-
\??\c:\hbtntn.exec:\hbtntn.exe71⤵PID:2392
-
\??\c:\thttnn.exec:\thttnn.exe72⤵PID:2712
-
\??\c:\jpppd.exec:\jpppd.exe73⤵PID:4924
-
\??\c:\7xfxrrl.exec:\7xfxrrl.exe74⤵PID:4888
-
\??\c:\htbbtt.exec:\htbbtt.exe75⤵PID:876
-
\??\c:\pjdvv.exec:\pjdvv.exe76⤵PID:1944
-
\??\c:\llxrrrx.exec:\llxrrrx.exe77⤵PID:1652
-
\??\c:\llfxrrl.exec:\llfxrrl.exe78⤵PID:1388
-
\??\c:\1nbbbb.exec:\1nbbbb.exe79⤵PID:4848
-
\??\c:\bbhhtt.exec:\bbhhtt.exe80⤵PID:4464
-
\??\c:\jdpjj.exec:\jdpjj.exe81⤵PID:1196
-
\??\c:\rxxrllf.exec:\rxxrllf.exe82⤵PID:4524
-
\??\c:\bhhhbh.exec:\bhhhbh.exe83⤵PID:2444
-
\??\c:\dvddj.exec:\dvddj.exe84⤵PID:1504
-
\??\c:\vvjpp.exec:\vvjpp.exe85⤵PID:1020
-
\??\c:\7rflfxl.exec:\7rflfxl.exe86⤵PID:3444
-
\??\c:\1bnnhn.exec:\1bnnhn.exe87⤵PID:5076
-
\??\c:\5vvvp.exec:\5vvvp.exe88⤵PID:2732
-
\??\c:\3vdvp.exec:\3vdvp.exe89⤵PID:1692
-
\??\c:\9ffllxr.exec:\9ffllxr.exe90⤵PID:2924
-
\??\c:\hhhhbh.exec:\hhhhbh.exe91⤵PID:2288
-
\??\c:\pdjpp.exec:\pdjpp.exe92⤵PID:4496
-
\??\c:\pjpdv.exec:\pjpdv.exe93⤵PID:4424
-
\??\c:\fflfxxx.exec:\fflfxxx.exe94⤵PID:5080
-
\??\c:\xlflfrr.exec:\xlflfrr.exe95⤵PID:1440
-
\??\c:\ttnnbb.exec:\ttnnbb.exe96⤵PID:3160
-
\??\c:\pjvvp.exec:\pjvvp.exe97⤵PID:3520
-
\??\c:\frrxxxx.exec:\frrxxxx.exe98⤵PID:2436
-
\??\c:\rlffxxx.exec:\rlffxxx.exe99⤵PID:1220
-
\??\c:\btttnt.exec:\btttnt.exe100⤵PID:4992
-
\??\c:\pjpjv.exec:\pjpjv.exe101⤵PID:2776
-
\??\c:\rxfrllf.exec:\rxfrllf.exe102⤵PID:388
-
\??\c:\3lffxxr.exec:\3lffxxr.exe103⤵PID:4296
-
\??\c:\hhhhbh.exec:\hhhhbh.exe104⤵PID:1468
-
\??\c:\pdddp.exec:\pdddp.exe105⤵PID:4944
-
\??\c:\xfxflxr.exec:\xfxflxr.exe106⤵PID:816
-
\??\c:\1lllllf.exec:\1lllllf.exe107⤵PID:4228
-
\??\c:\tnhhbb.exec:\tnhhbb.exe108⤵PID:4024
-
\??\c:\9jvpp.exec:\9jvpp.exe109⤵PID:3676
-
\??\c:\djpdv.exec:\djpdv.exe110⤵PID:3716
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe111⤵PID:4476
-
\??\c:\ffxrlll.exec:\ffxrlll.exe112⤵PID:2212
-
\??\c:\bthnnn.exec:\bthnnn.exe113⤵PID:1060
-
\??\c:\djpdd.exec:\djpdd.exe114⤵PID:4880
-
\??\c:\jdjjp.exec:\jdjjp.exe115⤵PID:1688
-
\??\c:\xxrrfff.exec:\xxrrfff.exe116⤵PID:4920
-
\??\c:\ffxllrl.exec:\ffxllrl.exe117⤵PID:4904
-
\??\c:\nhntnn.exec:\nhntnn.exe118⤵PID:2056
-
\??\c:\7nbnnh.exec:\7nbnnh.exe119⤵PID:2908
-
\??\c:\5pvvp.exec:\5pvvp.exe120⤵PID:2768
-
\??\c:\rxlllll.exec:\rxlllll.exe121⤵PID:5008
-
\??\c:\nhtttt.exec:\nhtttt.exe122⤵PID:2120
-
\??\c:\5tttnn.exec:\5tttnn.exe123⤵PID:2192
-
\??\c:\vvppj.exec:\vvppj.exe124⤵PID:2912
-
\??\c:\frrllff.exec:\frrllff.exe125⤵PID:2720
-
\??\c:\lllfxxr.exec:\lllfxxr.exe126⤵PID:2008
-
\??\c:\tnbbht.exec:\tnbbht.exe127⤵PID:4568
-
\??\c:\jjdvp.exec:\jjdvp.exe128⤵PID:2836
-
\??\c:\rrfxflr.exec:\rrfxflr.exe129⤵PID:1916
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe130⤵PID:1744
-
\??\c:\nhttnh.exec:\nhttnh.exe131⤵PID:2276
-
\??\c:\5vpjd.exec:\5vpjd.exe132⤵PID:4964
-
\??\c:\fffxlff.exec:\fffxlff.exe133⤵PID:1020
-
\??\c:\xrxlfrl.exec:\xrxlfrl.exe134⤵PID:3424
-
\??\c:\tthnth.exec:\tthnth.exe135⤵PID:2540
-
\??\c:\nhnhbn.exec:\nhnhbn.exe136⤵PID:2016
-
\??\c:\djvpj.exec:\djvpj.exe137⤵PID:2472
-
\??\c:\vjjdv.exec:\vjjdv.exe138⤵PID:1312
-
\??\c:\lrxxrll.exec:\lrxxrll.exe139⤵PID:2844
-
\??\c:\bntnhh.exec:\bntnhh.exe140⤵PID:1076
-
\??\c:\bthbth.exec:\bthbth.exe141⤵PID:440
-
\??\c:\vvdvj.exec:\vvdvj.exe142⤵PID:1404
-
\??\c:\lllxxlx.exec:\lllxxlx.exe143⤵PID:3312
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe144⤵PID:3484
-
\??\c:\bhbhbt.exec:\bhbhbt.exe145⤵PID:2992
-
\??\c:\dpdvd.exec:\dpdvd.exe146⤵PID:1960
-
\??\c:\dvvvp.exec:\dvvvp.exe147⤵PID:3020
-
\??\c:\rflxrrl.exec:\rflxrrl.exe148⤵PID:4112
-
\??\c:\htbtbt.exec:\htbtbt.exe149⤵PID:956
-
\??\c:\tntnhb.exec:\tntnhb.exe150⤵PID:2280
-
\??\c:\jdjdv.exec:\jdjdv.exe151⤵PID:2420
-
\??\c:\xllrllr.exec:\xllrllr.exe152⤵PID:1468
-
\??\c:\rxxfffx.exec:\rxxfffx.exe153⤵PID:2372
-
\??\c:\hnhbtt.exec:\hnhbtt.exe154⤵PID:4728
-
\??\c:\5nbbtb.exec:\5nbbtb.exe155⤵PID:1584
-
\??\c:\vpvvp.exec:\vpvvp.exe156⤵PID:380
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe157⤵PID:852
-
\??\c:\fxffxxr.exec:\fxffxxr.exe158⤵PID:3768
-
\??\c:\ntbttt.exec:\ntbttt.exe159⤵PID:4828
-
\??\c:\dpdpj.exec:\dpdpj.exe160⤵PID:2764
-
\??\c:\lxlfrll.exec:\lxlfrll.exe161⤵PID:2760
-
\??\c:\1ntttn.exec:\1ntttn.exe162⤵PID:2640
-
\??\c:\9ppdv.exec:\9ppdv.exe163⤵PID:1064
-
\??\c:\7jdvp.exec:\7jdvp.exe164⤵PID:1576
-
\??\c:\lffrlfx.exec:\lffrlfx.exe165⤵PID:1400
-
\??\c:\nnbhnh.exec:\nnbhnh.exe166⤵PID:1816
-
\??\c:\jjjjd.exec:\jjjjd.exe167⤵PID:4236
-
\??\c:\3lfxxxr.exec:\3lfxxxr.exe168⤵PID:4888
-
\??\c:\nnhtnn.exec:\nnhtnn.exe169⤵PID:3564
-
\??\c:\5vpjj.exec:\5vpjj.exe170⤵PID:4840
-
\??\c:\xffxlxr.exec:\xffxlxr.exe171⤵PID:2076
-
\??\c:\bhtnnn.exec:\bhtnnn.exe172⤵PID:3064
-
\??\c:\jpdvj.exec:\jpdvj.exe173⤵PID:3492
-
\??\c:\ddjjd.exec:\ddjjd.exe174⤵PID:468
-
\??\c:\fxxlflf.exec:\fxxlflf.exe175⤵PID:4464
-
\??\c:\bnnnhb.exec:\bnnnhb.exe176⤵PID:1196
-
\??\c:\djppv.exec:\djppv.exe177⤵PID:1636
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe178⤵PID:4744
-
\??\c:\llrrllf.exec:\llrrllf.exe179⤵PID:4964
-
\??\c:\hnbhnn.exec:\hnbhnn.exe180⤵PID:1020
-
\??\c:\jvppv.exec:\jvppv.exe181⤵PID:3424
-
\??\c:\jjjdv.exec:\jjjdv.exe182⤵PID:640
-
\??\c:\lflxrll.exec:\lflxrll.exe183⤵PID:744
-
\??\c:\btbbtt.exec:\btbbtt.exe184⤵PID:5068
-
\??\c:\dvjjj.exec:\dvjjj.exe185⤵PID:3128
-
\??\c:\vvpjp.exec:\vvpjp.exe186⤵PID:5108
-
\??\c:\rrrlfrx.exec:\rrrlfrx.exe187⤵PID:3448
-
\??\c:\ttnbtt.exec:\ttnbtt.exe188⤵PID:2452
-
\??\c:\1dvjd.exec:\1dvjd.exe189⤵PID:2436
-
\??\c:\xlrllfx.exec:\xlrllfx.exe190⤵PID:3960
-
\??\c:\bnbbbt.exec:\bnbbbt.exe191⤵PID:2992
-
\??\c:\1nbthh.exec:\1nbthh.exe192⤵PID:740
-
\??\c:\vdddv.exec:\vdddv.exe193⤵PID:2100
-
\??\c:\xrrrfrl.exec:\xrrrfrl.exe194⤵PID:4660
-
\??\c:\thbhnn.exec:\thbhnn.exe195⤵PID:388
-
\??\c:\1btnnb.exec:\1btnnb.exe196⤵PID:3668
-
\??\c:\pjppp.exec:\pjppp.exe197⤵PID:4944
-
\??\c:\frfffff.exec:\frfffff.exe198⤵PID:392
-
\??\c:\nhtnhb.exec:\nhtnhb.exe199⤵PID:404
-
\??\c:\ddjpj.exec:\ddjpj.exe200⤵PID:1584
-
\??\c:\xlrrllf.exec:\xlrrllf.exe201⤵PID:1900
-
\??\c:\lxrrfxr.exec:\lxrrfxr.exe202⤵PID:1740
-
\??\c:\bhhbbb.exec:\bhhbbb.exe203⤵PID:1120
-
\??\c:\djdvp.exec:\djdvp.exe204⤵PID:1820
-
\??\c:\xxxrffx.exec:\xxxrffx.exe205⤵PID:4116
-
\??\c:\ttnhbb.exec:\ttnhbb.exe206⤵PID:2760
-
\??\c:\3jdvp.exec:\3jdvp.exe207⤵PID:3608
-
\??\c:\rxffflr.exec:\rxffflr.exe208⤵PID:3040
-
\??\c:\tbnhnt.exec:\tbnhnt.exe209⤵PID:1232
-
\??\c:\ffffrrl.exec:\ffffrrl.exe210⤵PID:2712
-
\??\c:\xfxlfrr.exec:\xfxlfrr.exe211⤵PID:2632
-
\??\c:\jddpj.exec:\jddpj.exe212⤵PID:5000
-
\??\c:\djpjd.exec:\djpjd.exe213⤵PID:4308
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe214⤵PID:5064
-
\??\c:\lllfffx.exec:\lllfffx.exe215⤵PID:2204
-
\??\c:\btbttn.exec:\btbttn.exe216⤵PID:1652
-
\??\c:\3vvpd.exec:\3vvpd.exe217⤵PID:4044
-
\??\c:\jdpjj.exec:\jdpjj.exe218⤵PID:3032
-
\??\c:\btthbb.exec:\btthbb.exe219⤵PID:2080
-
\??\c:\3hnnnt.exec:\3hnnnt.exe220⤵PID:1916
-
\??\c:\jjpjd.exec:\jjpjd.exe221⤵PID:2276
-
\??\c:\lxrxfff.exec:\lxrxfff.exe222⤵PID:1640
-
\??\c:\fflfxxr.exec:\fflfxxr.exe223⤵PID:4512
-
\??\c:\hbbtnn.exec:\hbbtnn.exe224⤵PID:5076
-
\??\c:\nbtttn.exec:\nbtttn.exe225⤵PID:2472
-
\??\c:\pdpdd.exec:\pdpdd.exe226⤵PID:1216
-
\??\c:\rrxrffx.exec:\rrxrffx.exe227⤵PID:3024
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe228⤵PID:2920
-
\??\c:\nthbtb.exec:\nthbtb.exe229⤵PID:2448
-
\??\c:\bthbtt.exec:\bthbtt.exe230⤵PID:1404
-
\??\c:\pjjvp.exec:\pjjvp.exe231⤵PID:3312
-
\??\c:\vpdpp.exec:\vpdpp.exe232⤵PID:1888
-
\??\c:\1xfxrlf.exec:\1xfxrlf.exe233⤵PID:4992
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe234⤵PID:1000
-
\??\c:\nhtthh.exec:\nhtthh.exe235⤵PID:2208
-
\??\c:\1jvpj.exec:\1jvpj.exe236⤵PID:2776
-
\??\c:\ddpjj.exec:\ddpjj.exe237⤵PID:3764
-
\??\c:\3rxrllr.exec:\3rxrllr.exe238⤵PID:2368
-
\??\c:\lfrlrxx.exec:\lfrlrxx.exe239⤵PID:4872
-
\??\c:\9tbtnb.exec:\9tbtnb.exe240⤵PID:4764
-
\??\c:\tthbhh.exec:\tthbhh.exe241⤵PID:2256
-
\??\c:\vdvpd.exec:\vdvpd.exe242⤵PID:3188