Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe
-
Size
224KB
-
MD5
c34a6d6d5a19c8125a85ff4f89dc499d
-
SHA1
58a9aaa0a1fd469566ce6822e269ed3c76120c01
-
SHA256
68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24
-
SHA512
3d34f9e751106b82fbeba83be8063c62d1fcea14733e48900fa76c468e81f8d20fc5676fe33511c4daac57eb6e9c5691704d5fd03564d141001359427f0417c8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xL7m:n3C9BRo7MlrWKo+lxKy
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 33 IoCs
Processes:
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/752-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3348-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4504-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4956-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4956-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4956-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2208-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2524-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4596-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3180-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1752-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3876-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/224-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2644-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3208-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2580-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3740-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/984-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
5tnhbn.exe7xfrxrl.exennnhhb.exerflfxrl.exe3nnhhn.exejdddv.exe3hntnh.exedjdpj.exelxlxrfl.exehthtnt.exepvpjv.exenbbthh.exe3vpvp.exe1djdp.exerxxfxlf.exennnhtt.exerrrrlfl.exe3hhbtn.exevpvpp.exelffrlfx.exebhbtnn.exepjjpd.exelflfxxf.exebhnhtt.exevjvjj.exerrxrrfx.exebthnhb.exe1jpjv.exexlllffl.exevppvp.exexflfrfr.exebthtbb.exentbbtn.exevdjdv.exerlfrlfr.exe3tnhtt.exebhhtnh.exevpjpd.exe7xfrlxr.exelrxlfxr.exentbbtn.exe1tnbtt.exepdjvd.exelrxlxlr.exebnnbtn.exebhhbhh.exevppdd.exe5xfxrrl.exefxffxrx.exehhnhtn.exedvdvv.exedppvp.exelxlfrll.exefxrrfxr.exe1nhhbb.exevjppj.exe7xxrfxx.exexxfrlfx.exe9nnnhh.exedpvvj.exerlfffxf.exebnhnhb.exevpjdv.exefrfrlxr.exepid process 3860 5tnhbn.exe 752 7xfrxrl.exe 3348 nnnhhb.exe 3956 rflfxrl.exe 4504 3nnhhn.exe 1348 jdddv.exe 4956 3hntnh.exe 2208 djdpj.exe 3272 lxlxrfl.exe 2524 hthtnt.exe 4596 pvpjv.exe 968 nbbthh.exe 2136 3vpvp.exe 3180 1djdp.exe 1752 rxxfxlf.exe 4996 nnnhtt.exe 1032 rrrrlfl.exe 3876 3hhbtn.exe 1608 vpvpp.exe 224 lffrlfx.exe 4076 bhbtnn.exe 4016 pjjpd.exe 2644 lflfxxf.exe 4848 bhnhtt.exe 4868 vjvjj.exe 3208 rrxrrfx.exe 2580 bthnhb.exe 4288 1jpjv.exe 3740 xlllffl.exe 984 vppvp.exe 3388 xflfrfr.exe 2536 bthtbb.exe 4968 ntbbtn.exe 940 vdjdv.exe 1416 rlfrlfr.exe 2372 3tnhtt.exe 900 bhhtnh.exe 4292 vpjpd.exe 3264 7xfrlxr.exe 4188 lrxlfxr.exe 3860 ntbbtn.exe 2796 1tnbtt.exe 4024 pdjvd.exe 5000 lrxlxlr.exe 2132 bnnbtn.exe 1624 bhhbhh.exe 1800 vppdd.exe 1512 5xfxrrl.exe 4444 fxffxrx.exe 4956 hhnhtn.exe 1524 dvdvv.exe 3856 dppvp.exe 4668 lxlfrll.exe 1792 fxrrfxr.exe 4440 1nhhbb.exe 4596 vjppj.exe 1596 7xxrfxx.exe 2136 xxfrlfx.exe 3180 9nnnhh.exe 2948 dpvvj.exe 4656 rlfffxf.exe 4644 bnhnhb.exe 1032 vpjdv.exe 444 frfrlxr.exe -
Processes:
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe5tnhbn.exe7xfrxrl.exennnhhb.exerflfxrl.exe3nnhhn.exejdddv.exe3hntnh.exedjdpj.exelxlxrfl.exehthtnt.exepvpjv.exenbbthh.exe3vpvp.exe1djdp.exerxxfxlf.exennnhtt.exerrrrlfl.exe3hhbtn.exevpvpp.exelffrlfx.exebhbtnn.exedescription pid process target process PID 3076 wrote to memory of 3860 3076 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe 5tnhbn.exe PID 3076 wrote to memory of 3860 3076 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe 5tnhbn.exe PID 3076 wrote to memory of 3860 3076 68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe 5tnhbn.exe PID 3860 wrote to memory of 752 3860 5tnhbn.exe 7xfrxrl.exe PID 3860 wrote to memory of 752 3860 5tnhbn.exe 7xfrxrl.exe PID 3860 wrote to memory of 752 3860 5tnhbn.exe 7xfrxrl.exe PID 752 wrote to memory of 3348 752 7xfrxrl.exe nnnhhb.exe PID 752 wrote to memory of 3348 752 7xfrxrl.exe nnnhhb.exe PID 752 wrote to memory of 3348 752 7xfrxrl.exe nnnhhb.exe PID 3348 wrote to memory of 3956 3348 nnnhhb.exe rflfxrl.exe PID 3348 wrote to memory of 3956 3348 nnnhhb.exe rflfxrl.exe PID 3348 wrote to memory of 3956 3348 nnnhhb.exe rflfxrl.exe PID 3956 wrote to memory of 4504 3956 rflfxrl.exe 3nnhhn.exe PID 3956 wrote to memory of 4504 3956 rflfxrl.exe 3nnhhn.exe PID 3956 wrote to memory of 4504 3956 rflfxrl.exe 3nnhhn.exe PID 4504 wrote to memory of 1348 4504 3nnhhn.exe jdddv.exe PID 4504 wrote to memory of 1348 4504 3nnhhn.exe jdddv.exe PID 4504 wrote to memory of 1348 4504 3nnhhn.exe jdddv.exe PID 1348 wrote to memory of 4956 1348 jdddv.exe 3hntnh.exe PID 1348 wrote to memory of 4956 1348 jdddv.exe 3hntnh.exe PID 1348 wrote to memory of 4956 1348 jdddv.exe 3hntnh.exe PID 4956 wrote to memory of 2208 4956 3hntnh.exe djdpj.exe PID 4956 wrote to memory of 2208 4956 3hntnh.exe djdpj.exe PID 4956 wrote to memory of 2208 4956 3hntnh.exe djdpj.exe PID 2208 wrote to memory of 3272 2208 djdpj.exe lxlxrfl.exe PID 2208 wrote to memory of 3272 2208 djdpj.exe lxlxrfl.exe PID 2208 wrote to memory of 3272 2208 djdpj.exe lxlxrfl.exe PID 3272 wrote to memory of 2524 3272 lxlxrfl.exe hthtnt.exe PID 3272 wrote to memory of 2524 3272 lxlxrfl.exe hthtnt.exe PID 3272 wrote to memory of 2524 3272 lxlxrfl.exe hthtnt.exe PID 2524 wrote to memory of 4596 2524 hthtnt.exe pvpjv.exe PID 2524 wrote to memory of 4596 2524 hthtnt.exe pvpjv.exe PID 2524 wrote to memory of 4596 2524 hthtnt.exe pvpjv.exe PID 4596 wrote to memory of 968 4596 pvpjv.exe nbbthh.exe PID 4596 wrote to memory of 968 4596 pvpjv.exe nbbthh.exe PID 4596 wrote to memory of 968 4596 pvpjv.exe nbbthh.exe PID 968 wrote to memory of 2136 968 nbbthh.exe 3vpvp.exe PID 968 wrote to memory of 2136 968 nbbthh.exe 3vpvp.exe PID 968 wrote to memory of 2136 968 nbbthh.exe 3vpvp.exe PID 2136 wrote to memory of 3180 2136 3vpvp.exe 1djdp.exe PID 2136 wrote to memory of 3180 2136 3vpvp.exe 1djdp.exe PID 2136 wrote to memory of 3180 2136 3vpvp.exe 1djdp.exe PID 3180 wrote to memory of 1752 3180 1djdp.exe rxxfxlf.exe PID 3180 wrote to memory of 1752 3180 1djdp.exe rxxfxlf.exe PID 3180 wrote to memory of 1752 3180 1djdp.exe rxxfxlf.exe PID 1752 wrote to memory of 4996 1752 rxxfxlf.exe nnnhtt.exe PID 1752 wrote to memory of 4996 1752 rxxfxlf.exe nnnhtt.exe PID 1752 wrote to memory of 4996 1752 rxxfxlf.exe nnnhtt.exe PID 4996 wrote to memory of 1032 4996 nnnhtt.exe rrrrlfl.exe PID 4996 wrote to memory of 1032 4996 nnnhtt.exe rrrrlfl.exe PID 4996 wrote to memory of 1032 4996 nnnhtt.exe rrrrlfl.exe PID 1032 wrote to memory of 3876 1032 rrrrlfl.exe 3hhbtn.exe PID 1032 wrote to memory of 3876 1032 rrrrlfl.exe 3hhbtn.exe PID 1032 wrote to memory of 3876 1032 rrrrlfl.exe 3hhbtn.exe PID 3876 wrote to memory of 1608 3876 3hhbtn.exe vpvpp.exe PID 3876 wrote to memory of 1608 3876 3hhbtn.exe vpvpp.exe PID 3876 wrote to memory of 1608 3876 3hhbtn.exe vpvpp.exe PID 1608 wrote to memory of 224 1608 vpvpp.exe lffrlfx.exe PID 1608 wrote to memory of 224 1608 vpvpp.exe lffrlfx.exe PID 1608 wrote to memory of 224 1608 vpvpp.exe lffrlfx.exe PID 224 wrote to memory of 4076 224 lffrlfx.exe bhbtnn.exe PID 224 wrote to memory of 4076 224 lffrlfx.exe bhbtnn.exe PID 224 wrote to memory of 4076 224 lffrlfx.exe bhbtnn.exe PID 4076 wrote to memory of 4016 4076 bhbtnn.exe pjjpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe"C:\Users\Admin\AppData\Local\Temp\68478c981ce66933325a6f946fd6c5c6af85b2851ba4360a64e0e3c6e1829c24.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\5tnhbn.exec:\5tnhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\7xfrxrl.exec:\7xfrxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\nnnhhb.exec:\nnnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\rflfxrl.exec:\rflfxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\3nnhhn.exec:\3nnhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\jdddv.exec:\jdddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\3hntnh.exec:\3hntnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\djdpj.exec:\djdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\lxlxrfl.exec:\lxlxrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\hthtnt.exec:\hthtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pvpjv.exec:\pvpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\nbbthh.exec:\nbbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\3vpvp.exec:\3vpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\1djdp.exec:\1djdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\rxxfxlf.exec:\rxxfxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\nnnhtt.exec:\nnnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rrrrlfl.exec:\rrrrlfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\3hhbtn.exec:\3hhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\vpvpp.exec:\vpvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lffrlfx.exec:\lffrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\bhbtnn.exec:\bhbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\pjjpd.exec:\pjjpd.exe23⤵
- Executes dropped EXE
PID:4016 -
\??\c:\lflfxxf.exec:\lflfxxf.exe24⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bhnhtt.exec:\bhnhtt.exe25⤵
- Executes dropped EXE
PID:4848 -
\??\c:\vjvjj.exec:\vjvjj.exe26⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe27⤵
- Executes dropped EXE
PID:3208 -
\??\c:\bthnhb.exec:\bthnhb.exe28⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1jpjv.exec:\1jpjv.exe29⤵
- Executes dropped EXE
PID:4288 -
\??\c:\xlllffl.exec:\xlllffl.exe30⤵
- Executes dropped EXE
PID:3740 -
\??\c:\vppvp.exec:\vppvp.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\xflfrfr.exec:\xflfrfr.exe32⤵
- Executes dropped EXE
PID:3388 -
\??\c:\bthtbb.exec:\bthtbb.exe33⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ntbbtn.exec:\ntbbtn.exe34⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vdjdv.exec:\vdjdv.exe35⤵
- Executes dropped EXE
PID:940 -
\??\c:\rlfrlfr.exec:\rlfrlfr.exe36⤵
- Executes dropped EXE
PID:1416 -
\??\c:\3tnhtt.exec:\3tnhtt.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bhhtnh.exec:\bhhtnh.exe38⤵
- Executes dropped EXE
PID:900 -
\??\c:\vpjpd.exec:\vpjpd.exe39⤵
- Executes dropped EXE
PID:4292 -
\??\c:\7xfrlxr.exec:\7xfrlxr.exe40⤵
- Executes dropped EXE
PID:3264 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe41⤵
- Executes dropped EXE
PID:4188 -
\??\c:\ntbbtn.exec:\ntbbtn.exe42⤵
- Executes dropped EXE
PID:3860 -
\??\c:\1tnbtt.exec:\1tnbtt.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pdjvd.exec:\pdjvd.exe44⤵
- Executes dropped EXE
PID:4024 -
\??\c:\lrxlxlr.exec:\lrxlxlr.exe45⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bnnbtn.exec:\bnnbtn.exe46⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bhhbhh.exec:\bhhbhh.exe47⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vppdd.exec:\vppdd.exe48⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe49⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fxffxrx.exec:\fxffxrx.exe50⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hhnhtn.exec:\hhnhtn.exe51⤵
- Executes dropped EXE
PID:4956 -
\??\c:\dvdvv.exec:\dvdvv.exe52⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dppvp.exec:\dppvp.exe53⤵
- Executes dropped EXE
PID:3856 -
\??\c:\lxlfrll.exec:\lxlfrll.exe54⤵
- Executes dropped EXE
PID:4668 -
\??\c:\fxrrfxr.exec:\fxrrfxr.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1nhhbb.exec:\1nhhbb.exe56⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vjppj.exec:\vjppj.exe57⤵
- Executes dropped EXE
PID:4596 -
\??\c:\7xxrfxx.exec:\7xxrfxx.exe58⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xxfrlfx.exec:\xxfrlfx.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9nnnhh.exec:\9nnnhh.exe60⤵
- Executes dropped EXE
PID:3180 -
\??\c:\dpvvj.exec:\dpvvj.exe61⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rlfffxf.exec:\rlfffxf.exe62⤵
- Executes dropped EXE
PID:4656 -
\??\c:\bnhnhb.exec:\bnhnhb.exe63⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vpjdv.exec:\vpjdv.exe64⤵
- Executes dropped EXE
PID:1032 -
\??\c:\frfrlxr.exec:\frfrlxr.exe65⤵
- Executes dropped EXE
PID:444 -
\??\c:\5xxrffl.exec:\5xxrffl.exe66⤵PID:4036
-
\??\c:\tbhbtt.exec:\tbhbtt.exe67⤵PID:964
-
\??\c:\pdddv.exec:\pdddv.exe68⤵PID:216
-
\??\c:\rffxxlf.exec:\rffxxlf.exe69⤵PID:1708
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe70⤵PID:3688
-
\??\c:\nhhhtt.exec:\nhhhtt.exe71⤵PID:4180
-
\??\c:\jdjjj.exec:\jdjjj.exe72⤵PID:4792
-
\??\c:\pdpdj.exec:\pdpdj.exe73⤵PID:3024
-
\??\c:\rrrlrrl.exec:\rrrlrrl.exe74⤵PID:1548
-
\??\c:\xfrfxrl.exec:\xfrfxrl.exe75⤵PID:2060
-
\??\c:\nnnnnn.exec:\nnnnnn.exe76⤵PID:3208
-
\??\c:\jjvpd.exec:\jjvpd.exe77⤵PID:4060
-
\??\c:\xffxrlx.exec:\xffxrlx.exe78⤵PID:4612
-
\??\c:\bttnnh.exec:\bttnnh.exe79⤵PID:3680
-
\??\c:\nbntnh.exec:\nbntnh.exe80⤵PID:4988
-
\??\c:\dpvpd.exec:\dpvpd.exe81⤵PID:3528
-
\??\c:\flxfrrf.exec:\flxfrrf.exe82⤵PID:2924
-
\??\c:\1nhbbb.exec:\1nhbbb.exe83⤵PID:2076
-
\??\c:\5pjjd.exec:\5pjjd.exe84⤵PID:2848
-
\??\c:\llxfrll.exec:\llxfrll.exe85⤵PID:4252
-
\??\c:\1llxxrl.exec:\1llxxrl.exe86⤵PID:2712
-
\??\c:\htntht.exec:\htntht.exe87⤵PID:4448
-
\??\c:\vpvpp.exec:\vpvpp.exe88⤵PID:4280
-
\??\c:\ppddd.exec:\ppddd.exe89⤵PID:3076
-
\??\c:\frxrffr.exec:\frxrffr.exe90⤵PID:3300
-
\??\c:\frxrrrr.exec:\frxrrrr.exe91⤵PID:764
-
\??\c:\btnhbt.exec:\btnhbt.exe92⤵PID:992
-
\??\c:\jvjpj.exec:\jvjpj.exe93⤵PID:4496
-
\??\c:\vvppv.exec:\vvppv.exe94⤵PID:1820
-
\??\c:\9xxrrrf.exec:\9xxrrrf.exe95⤵PID:3152
-
\??\c:\5xrllrf.exec:\5xrllrf.exe96⤵PID:4168
-
\??\c:\ntbhht.exec:\ntbhht.exe97⤵PID:4208
-
\??\c:\vpppp.exec:\vpppp.exe98⤵PID:2180
-
\??\c:\9jjdd.exec:\9jjdd.exe99⤵PID:4624
-
\??\c:\lflffrr.exec:\lflffrr.exe100⤵PID:3272
-
\??\c:\5xlllrl.exec:\5xlllrl.exe101⤵PID:2240
-
\??\c:\bbhhhh.exec:\bbhhhh.exe102⤵PID:5016
-
\??\c:\hhbbbb.exec:\hhbbbb.exe103⤵PID:1072
-
\??\c:\ddvpd.exec:\ddvpd.exe104⤵PID:968
-
\??\c:\pdddd.exec:\pdddd.exe105⤵PID:2984
-
\??\c:\hnbttt.exec:\hnbttt.exe106⤵PID:3220
-
\??\c:\9dvvv.exec:\9dvvv.exe107⤵PID:4576
-
\??\c:\lfffxxx.exec:\lfffxxx.exe108⤵PID:5084
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe109⤵PID:3960
-
\??\c:\7bbbbn.exec:\7bbbbn.exe110⤵PID:1032
-
\??\c:\9pjdj.exec:\9pjdj.exe111⤵PID:1504
-
\??\c:\pjdpv.exec:\pjdpv.exe112⤵PID:1400
-
\??\c:\5fllfll.exec:\5fllfll.exe113⤵PID:2636
-
\??\c:\hbthbb.exec:\hbthbb.exe114⤵PID:4484
-
\??\c:\nhnhtt.exec:\nhnhtt.exe115⤵PID:3688
-
\??\c:\jjppp.exec:\jjppp.exe116⤵PID:3020
-
\??\c:\ppppj.exec:\ppppj.exe117⤵PID:4512
-
\??\c:\rlrllrl.exec:\rlrllrl.exe118⤵PID:464
-
\??\c:\3lllfll.exec:\3lllfll.exe119⤵PID:484
-
\??\c:\htbttt.exec:\htbttt.exe120⤵PID:4060
-
\??\c:\jddvv.exec:\jddvv.exe121⤵PID:2160
-
\??\c:\9pdvj.exec:\9pdvj.exe122⤵PID:3140
-
\??\c:\1frrllr.exec:\1frrllr.exe123⤵PID:2924
-
\??\c:\5rlllxr.exec:\5rlllxr.exe124⤵PID:2344
-
\??\c:\ttntbh.exec:\ttntbh.exe125⤵PID:2848
-
\??\c:\djjdv.exec:\djjdv.exe126⤵PID:4276
-
\??\c:\9pjjd.exec:\9pjjd.exe127⤵PID:1976
-
\??\c:\flrrlrl.exec:\flrrlrl.exe128⤵PID:4520
-
\??\c:\tbhhhh.exec:\tbhhhh.exe129⤵PID:2920
-
\??\c:\ttbttt.exec:\ttbttt.exe130⤵PID:4188
-
\??\c:\1djdv.exec:\1djdv.exe131⤵PID:3860
-
\??\c:\rrrlfll.exec:\rrrlfll.exe132⤵PID:1536
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe133⤵PID:3624
-
\??\c:\bbhhbh.exec:\bbhhbh.exe134⤵PID:2900
-
\??\c:\vdddj.exec:\vdddj.exe135⤵PID:2328
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe136⤵PID:4936
-
\??\c:\frlffff.exec:\frlffff.exe137⤵PID:4664
-
\??\c:\hbtbhn.exec:\hbtbhn.exe138⤵PID:568
-
\??\c:\9vdvv.exec:\9vdvv.exe139⤵PID:2668
-
\??\c:\1rxxfff.exec:\1rxxfff.exe140⤵PID:1524
-
\??\c:\1tbbbb.exec:\1tbbbb.exe141⤵PID:4668
-
\??\c:\7djdv.exec:\7djdv.exe142⤵PID:1792
-
\??\c:\1lflrrx.exec:\1lflrrx.exe143⤵PID:3864
-
\??\c:\nbhnnt.exec:\nbhnnt.exe144⤵PID:4596
-
\??\c:\pddpj.exec:\pddpj.exe145⤵PID:1564
-
\??\c:\xfrlffx.exec:\xfrlffx.exe146⤵PID:2136
-
\??\c:\bnhbtn.exec:\bnhbtn.exe147⤵PID:3956
-
\??\c:\btnthb.exec:\btnthb.exe148⤵PID:3220
-
\??\c:\dvpjv.exec:\dvpjv.exe149⤵PID:2948
-
\??\c:\lxrlxff.exec:\lxrlxff.exe150⤵PID:4804
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe151⤵PID:2676
-
\??\c:\hbtnhb.exec:\hbtnhb.exe152⤵PID:5108
-
\??\c:\9djdd.exec:\9djdd.exe153⤵PID:224
-
\??\c:\vdpjj.exec:\vdpjj.exe154⤵PID:1268
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe155⤵PID:1292
-
\??\c:\ntthbt.exec:\ntthbt.exe156⤵PID:4180
-
\??\c:\nhbtnn.exec:\nhbtnn.exe157⤵PID:1612
-
\??\c:\vjdvp.exec:\vjdvp.exe158⤵PID:1548
-
\??\c:\rxrlxxf.exec:\rxrlxxf.exe159⤵PID:2316
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe160⤵PID:4288
-
\??\c:\tnhtnn.exec:\tnhtnn.exe161⤵PID:4396
-
\??\c:\5tthbt.exec:\5tthbt.exe162⤵PID:4060
-
\??\c:\vjjdv.exec:\vjjdv.exe163⤵PID:2764
-
\??\c:\flxllff.exec:\flxllff.exe164⤵PID:3140
-
\??\c:\flrlfff.exec:\flrlfff.exe165⤵PID:3764
-
\??\c:\hntbth.exec:\hntbth.exe166⤵PID:2344
-
\??\c:\btttnn.exec:\btttnn.exe167⤵PID:2848
-
\??\c:\vddvp.exec:\vddvp.exe168⤵PID:4276
-
\??\c:\3jdjd.exec:\3jdjd.exe169⤵PID:1976
-
\??\c:\9xxlffx.exec:\9xxlffx.exe170⤵PID:4520
-
\??\c:\9tnhbb.exec:\9tnhbb.exe171⤵PID:4816
-
\??\c:\bnhbbb.exec:\bnhbbb.exe172⤵PID:4188
-
\??\c:\5pvjv.exec:\5pvjv.exe173⤵PID:992
-
\??\c:\pjjdd.exec:\pjjdd.exe174⤵PID:3572
-
\??\c:\rflxllf.exec:\rflxllf.exe175⤵PID:1820
-
\??\c:\nnbbtt.exec:\nnbbtt.exe176⤵PID:4588
-
\??\c:\ntntnn.exec:\ntntnn.exe177⤵PID:4168
-
\??\c:\djjdv.exec:\djjdv.exe178⤵PID:1664
-
\??\c:\vvvvv.exec:\vvvvv.exe179⤵PID:2272
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe180⤵PID:2668
-
\??\c:\rfxxrlx.exec:\rfxxrlx.exe181⤵PID:1972
-
\??\c:\httthh.exec:\httthh.exe182⤵PID:4392
-
\??\c:\tntntn.exec:\tntntn.exe183⤵PID:5016
-
\??\c:\9vpvj.exec:\9vpvj.exe184⤵PID:3716
-
\??\c:\1dvpp.exec:\1dvpp.exe185⤵PID:968
-
\??\c:\1xxlllf.exec:\1xxlllf.exe186⤵PID:1624
-
\??\c:\fxllllx.exec:\fxllllx.exe187⤵PID:1096
-
\??\c:\hntnhb.exec:\hntnhb.exe188⤵PID:4996
-
\??\c:\jjpjj.exec:\jjpjj.exe189⤵PID:5084
-
\??\c:\vdpvj.exec:\vdpvj.exe190⤵PID:1768
-
\??\c:\frlxrrf.exec:\frlxrrf.exe191⤵PID:2676
-
\??\c:\xxrfxrr.exec:\xxrfxrr.exe192⤵PID:1152
-
\??\c:\tttnhh.exec:\tttnhh.exe193⤵PID:224
-
\??\c:\tnnbtn.exec:\tnnbtn.exe194⤵PID:4016
-
\??\c:\3jjpv.exec:\3jjpv.exe195⤵PID:1332
-
\??\c:\jpvpj.exec:\jpvpj.exe196⤵PID:2644
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe197⤵PID:4332
-
\??\c:\nbhbtb.exec:\nbhbtb.exe198⤵PID:5044
-
\??\c:\hnnhtn.exec:\hnnhtn.exe199⤵PID:2224
-
\??\c:\jdvpp.exec:\jdvpp.exe200⤵PID:4808
-
\??\c:\pppvj.exec:\pppvj.exe201⤵PID:3740
-
\??\c:\3fllffx.exec:\3fllffx.exe202⤵PID:4592
-
\??\c:\lfxrffr.exec:\lfxrffr.exe203⤵PID:4844
-
\??\c:\nbbnhb.exec:\nbbnhb.exe204⤵PID:648
-
\??\c:\hnhntt.exec:\hnhntt.exe205⤵PID:3212
-
\??\c:\dvdjv.exec:\dvdjv.exe206⤵PID:1416
-
\??\c:\9vjvd.exec:\9vjvd.exe207⤵PID:1860
-
\??\c:\fxfrxxf.exec:\fxfrxxf.exe208⤵PID:3264
-
\??\c:\5ffrlfx.exec:\5ffrlfx.exe209⤵PID:1188
-
\??\c:\7nnnnh.exec:\7nnnnh.exe210⤵PID:1976
-
\??\c:\hbtbbh.exec:\hbtbbh.exe211⤵PID:3300
-
\??\c:\jpdvd.exec:\jpdvd.exe212⤵PID:3860
-
\??\c:\pjppv.exec:\pjppv.exe213⤵PID:1276
-
\??\c:\1lrfxxr.exec:\1lrfxxr.exe214⤵PID:2248
-
\??\c:\xffxlll.exec:\xffxlll.exe215⤵PID:4600
-
\??\c:\1bbthn.exec:\1bbthn.exe216⤵PID:3624
-
\??\c:\1hhbtb.exec:\1hhbtb.exe217⤵PID:4820
-
\??\c:\3pdvp.exec:\3pdvp.exe218⤵PID:808
-
\??\c:\5ffxlfx.exec:\5ffxlfx.exe219⤵PID:64
-
\??\c:\lffxrrl.exec:\lffxrrl.exe220⤵PID:4664
-
\??\c:\9bbtnn.exec:\9bbtnn.exe221⤵PID:4912
-
\??\c:\tbhbbb.exec:\tbhbbb.exe222⤵PID:2916
-
\??\c:\1vpjd.exec:\1vpjd.exe223⤵PID:1492
-
\??\c:\jppdv.exec:\jppdv.exe224⤵PID:5040
-
\??\c:\xlrrrff.exec:\xlrrrff.exe225⤵PID:2988
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe226⤵PID:2320
-
\??\c:\nhnhhh.exec:\nhnhhh.exe227⤵PID:5004
-
\??\c:\9vvvd.exec:\9vvvd.exe228⤵PID:1940
-
\??\c:\pdjdd.exec:\pdjdd.exe229⤵PID:4160
-
\??\c:\5xlxfrr.exec:\5xlxfrr.exe230⤵PID:4244
-
\??\c:\bnhtht.exec:\bnhtht.exe231⤵PID:1864
-
\??\c:\htbttn.exec:\htbttn.exe232⤵PID:2488
-
\??\c:\jdvpj.exec:\jdvpj.exe233⤵PID:5108
-
\??\c:\pjjjj.exec:\pjjjj.exe234⤵PID:3192
-
\??\c:\xlrfrrl.exec:\xlrfrrl.exe235⤵PID:4488
-
\??\c:\lxrllll.exec:\lxrllll.exe236⤵PID:4484
-
\??\c:\bnbtht.exec:\bnbtht.exe237⤵PID:1704
-
\??\c:\7hhhtn.exec:\7hhhtn.exe238⤵PID:3020
-
\??\c:\vvpjj.exec:\vvpjj.exe239⤵PID:4500
-
\??\c:\jdddv.exec:\jdddv.exe240⤵PID:4776
-
\??\c:\fflrxrx.exec:\fflrxrx.exe241⤵PID:2316
-
\??\c:\thbtnh.exec:\thbtnh.exe242⤵PID:2268