Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe
-
Size
247KB
-
MD5
61230f922120a18697f197e01635d880
-
SHA1
d7cd1ce566e2f175b728420db54a5bbefaa0de1a
-
SHA256
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941
-
SHA512
683e4e95626b73a115850e5b50ce688e337ffe2b6cff83ce2806fe8703f4c1f621da2631909676d26ca4b00c1eff366bfb89e1a6562218bbf677e3b2603b2a5c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1q:n3C9BRo7MlrWKo+lxtvGt1q
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
Processes:
resource yara_rule behavioral2/memory/3572-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/668-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/780-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral2/memory/3572-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/668-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4320-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1328-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1400-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4848-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4488-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2220-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1556-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2764-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1208-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4832-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3244-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/780-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4088-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4796-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4808-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/960-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/896-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4128-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
hthbbh.exerrxxfff.exetntbbh.exevpdpv.exepjpjd.exexflrxlx.exe9nttbh.exedvjjd.exelffxxfx.exebbhnhh.exevvjjv.exefrlrfrr.exexxrfrfr.exerrxrxxx.exehbnnnt.exejdpdj.exevvvpp.exerlrlfrx.exedvddv.exe5rrlrxl.exettnhht.exevdjjd.exetnhbbb.exepjpjd.exelxfrlrf.exevjvvp.exexlllffl.exevdjdd.exexlxrlrr.exe7lrrllr.exejpdvp.exebbhbhb.exedjjdv.exeflxlfff.exe3lfxxxx.exehthhhh.exejjdjv.exe7lrlfxr.exetntttb.exehtbbtt.exejpdpj.exerxfrrll.exentbbnb.exejvdvv.exerlxrrrl.exehhthtb.exebbnhnb.exejvjvp.exenhhbtb.exe5jdjp.exe9rxrllf.exehnbbbb.exeppddd.exefrfflll.exehnnhnt.exe7pppj.exelrrllrr.exelffxrrr.exelrffxlf.exenbntbn.exeddjpv.exerfflrlx.exebtbbbb.exevpppd.exepid process 1400 hthbbh.exe 668 rrxxfff.exe 4320 tntbbh.exe 1328 vpdpv.exe 4848 pjpjd.exe 4344 xflrxlx.exe 1784 9nttbh.exe 2220 dvjjd.exe 4488 lffxxfx.exe 5064 bbhnhh.exe 1556 vvjjv.exe 1208 frlrfrr.exe 4832 xxrfrfr.exe 4016 rrxrxxx.exe 2764 hbnnnt.exe 2980 jdpdj.exe 4696 vvvpp.exe 3244 rlrlfrx.exe 780 dvddv.exe 4700 5rrlrxl.exe 4088 ttnhht.exe 4852 vdjjd.exe 4796 tnhbbb.exe 2572 pjpjd.exe 4808 lxfrlrf.exe 3628 vjvvp.exe 1128 xlllffl.exe 896 vdjdd.exe 960 xlxrlrr.exe 4128 7lrrllr.exe 3576 jpdvp.exe 2904 bbhbhb.exe 2284 djjdv.exe 5096 flxlfff.exe 740 3lfxxxx.exe 2248 hthhhh.exe 236 jjdjv.exe 1848 7lrlfxr.exe 2528 tntttb.exe 3572 htbbtt.exe 3152 jpdpj.exe 1400 rxfrrll.exe 452 ntbbnb.exe 1528 jvdvv.exe 1328 rlxrrrl.exe 1932 hhthtb.exe 2672 bbnhnb.exe 3888 jvjvp.exe 3988 nhhbtb.exe 4628 5jdjp.exe 376 9rxrllf.exe 2840 hnbbbb.exe 2432 ppddd.exe 4160 frfflll.exe 4652 hnnhnt.exe 2384 7pppj.exe 4512 lrrllrr.exe 1816 lffxrrr.exe 2340 lrffxlf.exe 1616 nbntbn.exe 3284 ddjpv.exe 1840 rfflrlx.exe 2680 btbbbb.exe 2884 vpppd.exe -
Processes:
resource yara_rule behavioral2/memory/3572-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exehthbbh.exerrxxfff.exetntbbh.exevpdpv.exepjpjd.exexflrxlx.exe9nttbh.exedvjjd.exelffxxfx.exebbhnhh.exevvjjv.exefrlrfrr.exexxrfrfr.exerrxrxxx.exehbnnnt.exejdpdj.exevvvpp.exerlrlfrx.exedvddv.exe5rrlrxl.exettnhht.exedescription pid process target process PID 3572 wrote to memory of 1400 3572 bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe hthbbh.exe PID 3572 wrote to memory of 1400 3572 bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe hthbbh.exe PID 3572 wrote to memory of 1400 3572 bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe hthbbh.exe PID 1400 wrote to memory of 668 1400 hthbbh.exe rrxxfff.exe PID 1400 wrote to memory of 668 1400 hthbbh.exe rrxxfff.exe PID 1400 wrote to memory of 668 1400 hthbbh.exe rrxxfff.exe PID 668 wrote to memory of 4320 668 rrxxfff.exe tntbbh.exe PID 668 wrote to memory of 4320 668 rrxxfff.exe tntbbh.exe PID 668 wrote to memory of 4320 668 rrxxfff.exe tntbbh.exe PID 4320 wrote to memory of 1328 4320 tntbbh.exe vpdpv.exe PID 4320 wrote to memory of 1328 4320 tntbbh.exe vpdpv.exe PID 4320 wrote to memory of 1328 4320 tntbbh.exe vpdpv.exe PID 1328 wrote to memory of 4848 1328 vpdpv.exe pjpjd.exe PID 1328 wrote to memory of 4848 1328 vpdpv.exe pjpjd.exe PID 1328 wrote to memory of 4848 1328 vpdpv.exe pjpjd.exe PID 4848 wrote to memory of 4344 4848 pjpjd.exe xflrxlx.exe PID 4848 wrote to memory of 4344 4848 pjpjd.exe xflrxlx.exe PID 4848 wrote to memory of 4344 4848 pjpjd.exe xflrxlx.exe PID 4344 wrote to memory of 1784 4344 xflrxlx.exe 9nttbh.exe PID 4344 wrote to memory of 1784 4344 xflrxlx.exe 9nttbh.exe PID 4344 wrote to memory of 1784 4344 xflrxlx.exe 9nttbh.exe PID 1784 wrote to memory of 2220 1784 9nttbh.exe dvjjd.exe PID 1784 wrote to memory of 2220 1784 9nttbh.exe dvjjd.exe PID 1784 wrote to memory of 2220 1784 9nttbh.exe dvjjd.exe PID 2220 wrote to memory of 4488 2220 dvjjd.exe lffxxfx.exe PID 2220 wrote to memory of 4488 2220 dvjjd.exe lffxxfx.exe PID 2220 wrote to memory of 4488 2220 dvjjd.exe lffxxfx.exe PID 4488 wrote to memory of 5064 4488 lffxxfx.exe bbhnhh.exe PID 4488 wrote to memory of 5064 4488 lffxxfx.exe bbhnhh.exe PID 4488 wrote to memory of 5064 4488 lffxxfx.exe bbhnhh.exe PID 5064 wrote to memory of 1556 5064 bbhnhh.exe vvjjv.exe PID 5064 wrote to memory of 1556 5064 bbhnhh.exe vvjjv.exe PID 5064 wrote to memory of 1556 5064 bbhnhh.exe vvjjv.exe PID 1556 wrote to memory of 1208 1556 vvjjv.exe frlrfrr.exe PID 1556 wrote to memory of 1208 1556 vvjjv.exe frlrfrr.exe PID 1556 wrote to memory of 1208 1556 vvjjv.exe frlrfrr.exe PID 1208 wrote to memory of 4832 1208 frlrfrr.exe xxrfrfr.exe PID 1208 wrote to memory of 4832 1208 frlrfrr.exe xxrfrfr.exe PID 1208 wrote to memory of 4832 1208 frlrfrr.exe xxrfrfr.exe PID 4832 wrote to memory of 4016 4832 xxrfrfr.exe rrxrxxx.exe PID 4832 wrote to memory of 4016 4832 xxrfrfr.exe rrxrxxx.exe PID 4832 wrote to memory of 4016 4832 xxrfrfr.exe rrxrxxx.exe PID 4016 wrote to memory of 2764 4016 rrxrxxx.exe hbnnnt.exe PID 4016 wrote to memory of 2764 4016 rrxrxxx.exe hbnnnt.exe PID 4016 wrote to memory of 2764 4016 rrxrxxx.exe hbnnnt.exe PID 2764 wrote to memory of 2980 2764 hbnnnt.exe jdpdj.exe PID 2764 wrote to memory of 2980 2764 hbnnnt.exe jdpdj.exe PID 2764 wrote to memory of 2980 2764 hbnnnt.exe jdpdj.exe PID 2980 wrote to memory of 4696 2980 jdpdj.exe vvvpp.exe PID 2980 wrote to memory of 4696 2980 jdpdj.exe vvvpp.exe PID 2980 wrote to memory of 4696 2980 jdpdj.exe vvvpp.exe PID 4696 wrote to memory of 3244 4696 vvvpp.exe rlrlfrx.exe PID 4696 wrote to memory of 3244 4696 vvvpp.exe rlrlfrx.exe PID 4696 wrote to memory of 3244 4696 vvvpp.exe rlrlfrx.exe PID 3244 wrote to memory of 780 3244 rlrlfrx.exe dvddv.exe PID 3244 wrote to memory of 780 3244 rlrlfrx.exe dvddv.exe PID 3244 wrote to memory of 780 3244 rlrlfrx.exe dvddv.exe PID 780 wrote to memory of 4700 780 dvddv.exe 5rrlrxl.exe PID 780 wrote to memory of 4700 780 dvddv.exe 5rrlrxl.exe PID 780 wrote to memory of 4700 780 dvddv.exe 5rrlrxl.exe PID 4700 wrote to memory of 4088 4700 5rrlrxl.exe ttnhht.exe PID 4700 wrote to memory of 4088 4700 5rrlrxl.exe ttnhht.exe PID 4700 wrote to memory of 4088 4700 5rrlrxl.exe ttnhht.exe PID 4088 wrote to memory of 4852 4088 ttnhht.exe vdjjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe"C:\Users\Admin\AppData\Local\Temp\bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\hthbbh.exec:\hthbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\rrxxfff.exec:\rrxxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\tntbbh.exec:\tntbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\vpdpv.exec:\vpdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\pjpjd.exec:\pjpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xflrxlx.exec:\xflrxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\9nttbh.exec:\9nttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\dvjjd.exec:\dvjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\lffxxfx.exec:\lffxxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\bbhnhh.exec:\bbhnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vvjjv.exec:\vvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\frlrfrr.exec:\frlrfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\rrxrxxx.exec:\rrxrxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\hbnnnt.exec:\hbnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jdpdj.exec:\jdpdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vvvpp.exec:\vvvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\rlrlfrx.exec:\rlrlfrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\dvddv.exec:\dvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\5rrlrxl.exec:\5rrlrxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\ttnhht.exec:\ttnhht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\vdjjd.exec:\vdjjd.exe23⤵
- Executes dropped EXE
PID:4852 -
\??\c:\tnhbbb.exec:\tnhbbb.exe24⤵
- Executes dropped EXE
PID:4796 -
\??\c:\pjpjd.exec:\pjpjd.exe25⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lxfrlrf.exec:\lxfrlrf.exe26⤵
- Executes dropped EXE
PID:4808 -
\??\c:\vjvvp.exec:\vjvvp.exe27⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xlllffl.exec:\xlllffl.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\vdjdd.exec:\vdjdd.exe29⤵
- Executes dropped EXE
PID:896 -
\??\c:\xlxrlrr.exec:\xlxrlrr.exe30⤵
- Executes dropped EXE
PID:960 -
\??\c:\7lrrllr.exec:\7lrrllr.exe31⤵
- Executes dropped EXE
PID:4128 -
\??\c:\jpdvp.exec:\jpdvp.exe32⤵
- Executes dropped EXE
PID:3576 -
\??\c:\bbhbhb.exec:\bbhbhb.exe33⤵
- Executes dropped EXE
PID:2904 -
\??\c:\djjdv.exec:\djjdv.exe34⤵
- Executes dropped EXE
PID:2284 -
\??\c:\flxlfff.exec:\flxlfff.exe35⤵
- Executes dropped EXE
PID:5096 -
\??\c:\3lfxxxx.exec:\3lfxxxx.exe36⤵
- Executes dropped EXE
PID:740 -
\??\c:\hthhhh.exec:\hthhhh.exe37⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jjdjv.exec:\jjdjv.exe38⤵
- Executes dropped EXE
PID:236 -
\??\c:\7lrlfxr.exec:\7lrlfxr.exe39⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tntttb.exec:\tntttb.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\htbbtt.exec:\htbbtt.exe41⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jpdpj.exec:\jpdpj.exe42⤵
- Executes dropped EXE
PID:3152 -
\??\c:\rxfrrll.exec:\rxfrrll.exe43⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ntbbnb.exec:\ntbbnb.exe44⤵
- Executes dropped EXE
PID:452 -
\??\c:\jvdvv.exec:\jvdvv.exe45⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe46⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hhthtb.exec:\hhthtb.exe47⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bbnhnb.exec:\bbnhnb.exe48⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jvjvp.exec:\jvjvp.exe49⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nhhbtb.exec:\nhhbtb.exe50⤵
- Executes dropped EXE
PID:3988 -
\??\c:\5jdjp.exec:\5jdjp.exe51⤵
- Executes dropped EXE
PID:4628 -
\??\c:\9rxrllf.exec:\9rxrllf.exe52⤵
- Executes dropped EXE
PID:376 -
\??\c:\hnbbbb.exec:\hnbbbb.exe53⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ppddd.exec:\ppddd.exe54⤵
- Executes dropped EXE
PID:2432 -
\??\c:\frfflll.exec:\frfflll.exe55⤵
- Executes dropped EXE
PID:4160 -
\??\c:\hnnhnt.exec:\hnnhnt.exe56⤵
- Executes dropped EXE
PID:4652 -
\??\c:\7pppj.exec:\7pppj.exe57⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lrrllrr.exec:\lrrllrr.exe58⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lffxrrr.exec:\lffxrrr.exe59⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lrffxlf.exec:\lrffxlf.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nbntbn.exec:\nbntbn.exe61⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ddjpv.exec:\ddjpv.exe62⤵
- Executes dropped EXE
PID:3284 -
\??\c:\rfflrlx.exec:\rfflrlx.exe63⤵
- Executes dropped EXE
PID:1840 -
\??\c:\btbbbb.exec:\btbbbb.exe64⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vpppd.exec:\vpppd.exe65⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tbnntb.exec:\tbnntb.exe66⤵PID:3460
-
\??\c:\1djjd.exec:\1djjd.exe67⤵PID:628
-
\??\c:\djpdd.exec:\djpdd.exe68⤵PID:2896
-
\??\c:\llxlfrl.exec:\llxlfrl.exe69⤵PID:3468
-
\??\c:\nnbttb.exec:\nnbttb.exe70⤵PID:1656
-
\??\c:\3pppp.exec:\3pppp.exe71⤵PID:784
-
\??\c:\xlfffrx.exec:\xlfffrx.exe72⤵PID:3216
-
\??\c:\tbhhnb.exec:\tbhhnb.exe73⤵PID:1132
-
\??\c:\lflrlxf.exec:\lflrlxf.exe74⤵PID:2000
-
\??\c:\nbhhht.exec:\nbhhht.exe75⤵PID:5080
-
\??\c:\vpppv.exec:\vpppv.exe76⤵PID:448
-
\??\c:\xfrrlrx.exec:\xfrrlrx.exe77⤵PID:1708
-
\??\c:\tbnbnt.exec:\tbnbnt.exe78⤵PID:2956
-
\??\c:\pjvvp.exec:\pjvvp.exe79⤵PID:1536
-
\??\c:\3xrllrr.exec:\3xrllrr.exe80⤵PID:4508
-
\??\c:\vjpvd.exec:\vjpvd.exe81⤵PID:400
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe82⤵PID:2880
-
\??\c:\hbnhhh.exec:\hbnhhh.exe83⤵PID:1620
-
\??\c:\jjpjj.exec:\jjpjj.exe84⤵PID:4884
-
\??\c:\rxrxrlr.exec:\rxrxrlr.exe85⤵PID:4856
-
\??\c:\nhhhbt.exec:\nhhhbt.exe86⤵PID:1096
-
\??\c:\xrllffl.exec:\xrllffl.exe87⤵PID:4408
-
\??\c:\xrxffrx.exec:\xrxffrx.exe88⤵PID:4456
-
\??\c:\bhbhhn.exec:\bhbhhn.exe89⤵PID:4500
-
\??\c:\xxffrxx.exec:\xxffrxx.exe90⤵PID:3572
-
\??\c:\ppjjj.exec:\ppjjj.exe91⤵PID:1856
-
\??\c:\djjvv.exec:\djjvv.exe92⤵PID:1400
-
\??\c:\flfffxl.exec:\flfffxl.exe93⤵PID:4080
-
\??\c:\ntttnn.exec:\ntttnn.exe94⤵PID:3176
-
\??\c:\ppjjp.exec:\ppjjp.exe95⤵PID:2116
-
\??\c:\fflllrr.exec:\fflllrr.exe96⤵PID:544
-
\??\c:\nnthhn.exec:\nnthhn.exe97⤵PID:2672
-
\??\c:\pjjjj.exec:\pjjjj.exe98⤵PID:4784
-
\??\c:\bbnhbh.exec:\bbnhbh.exe99⤵PID:2220
-
\??\c:\vpjdv.exec:\vpjdv.exe100⤵PID:1588
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe101⤵PID:4964
-
\??\c:\rrxxrrf.exec:\rrxxrrf.exe102⤵PID:4896
-
\??\c:\btnnnt.exec:\btnnnt.exe103⤵PID:1480
-
\??\c:\lfxffff.exec:\lfxffff.exe104⤵PID:2496
-
\??\c:\1lxxxrr.exec:\1lxxxrr.exe105⤵PID:3596
-
\??\c:\ntbtnn.exec:\ntbtnn.exe106⤵PID:2556
-
\??\c:\jddvv.exec:\jddvv.exe107⤵PID:4444
-
\??\c:\xfffxxr.exec:\xfffxxr.exe108⤵PID:2340
-
\??\c:\llfrxfx.exec:\llfrxfx.exe109⤵PID:1452
-
\??\c:\tnbbtt.exec:\tnbbtt.exe110⤵PID:4104
-
\??\c:\jpdvd.exec:\jpdvd.exe111⤵PID:3764
-
\??\c:\jpjdp.exec:\jpjdp.exe112⤵PID:3156
-
\??\c:\xxffxxx.exec:\xxffxxx.exe113⤵PID:628
-
\??\c:\7hbttt.exec:\7hbttt.exe114⤵PID:1488
-
\??\c:\nthbbb.exec:\nthbbb.exe115⤵PID:456
-
\??\c:\vjjpj.exec:\vjjpj.exe116⤵PID:1644
-
\??\c:\vpvpp.exec:\vpvpp.exe117⤵PID:2148
-
\??\c:\lfrlfll.exec:\lfrlfll.exe118⤵PID:4040
-
\??\c:\bntttt.exec:\bntttt.exe119⤵PID:4220
-
\??\c:\vvppv.exec:\vvppv.exe120⤵PID:1128
-
\??\c:\ffxfxxx.exec:\ffxfxxx.exe121⤵PID:3264
-
\??\c:\vdppp.exec:\vdppp.exe122⤵PID:3704
-
\??\c:\tntnhh.exec:\tntnhh.exe123⤵PID:748
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe124⤵PID:1664
-
\??\c:\bhbthh.exec:\bhbthh.exe125⤵PID:2964
-
\??\c:\vvvpp.exec:\vvvpp.exe126⤵PID:4292
-
\??\c:\fxlfffx.exec:\fxlfffx.exe127⤵PID:4580
-
\??\c:\hbnnhn.exec:\hbnnhn.exe128⤵PID:740
-
\??\c:\3jdvp.exec:\3jdvp.exe129⤵PID:516
-
\??\c:\frxlfxx.exec:\frxlfxx.exe130⤵PID:4440
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe131⤵PID:3808
-
\??\c:\bbhbhh.exec:\bbhbhh.exe132⤵PID:2584
-
\??\c:\jvjdv.exec:\jvjdv.exe133⤵PID:2712
-
\??\c:\xrflxxx.exec:\xrflxxx.exe134⤵PID:1852
-
\??\c:\tnbbnn.exec:\tnbbnn.exe135⤵PID:2576
-
\??\c:\pjjdd.exec:\pjjdd.exe136⤵PID:3040
-
\??\c:\lrfffxr.exec:\lrfffxr.exe137⤵PID:1320
-
\??\c:\bnttbh.exec:\bnttbh.exe138⤵PID:1736
-
\??\c:\bhthth.exec:\bhthth.exe139⤵PID:3516
-
\??\c:\jvvvj.exec:\jvvvj.exe140⤵PID:2732
-
\??\c:\flrrrrr.exec:\flrrrrr.exe141⤵PID:2304
-
\??\c:\7nnhhb.exec:\7nnhhb.exe142⤵PID:4620
-
\??\c:\jjjdj.exec:\jjjdj.exe143⤵PID:4544
-
\??\c:\lrxlflr.exec:\lrxlflr.exe144⤵PID:4932
-
\??\c:\nnbthb.exec:\nnbthb.exe145⤵PID:376
-
\??\c:\ppvvp.exec:\ppvvp.exe146⤵PID:3248
-
\??\c:\ffxlrfr.exec:\ffxlrfr.exe147⤵PID:1556
-
\??\c:\hhtntb.exec:\hhtntb.exe148⤵PID:1208
-
\??\c:\vvppp.exec:\vvppp.exe149⤵PID:4596
-
\??\c:\jdpjp.exec:\jdpjp.exe150⤵PID:4512
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe151⤵PID:2556
-
\??\c:\7hnbbn.exec:\7hnbbn.exe152⤵PID:4444
-
\??\c:\vppjd.exec:\vppjd.exe153⤵PID:2336
-
\??\c:\lfffffl.exec:\lfffffl.exe154⤵PID:1452
-
\??\c:\nbbthh.exec:\nbbthh.exe155⤵PID:4104
-
\??\c:\pdjdd.exec:\pdjdd.exe156⤵PID:3764
-
\??\c:\7dpjv.exec:\7dpjv.exe157⤵PID:3156
-
\??\c:\1rxxlll.exec:\1rxxlll.exe158⤵PID:628
-
\??\c:\hhbhtt.exec:\hhbhtt.exe159⤵PID:1488
-
\??\c:\jvjjj.exec:\jvjjj.exe160⤵PID:5060
-
\??\c:\7lrfffl.exec:\7lrfffl.exe161⤵PID:1644
-
\??\c:\nhnhbh.exec:\nhnhbh.exe162⤵PID:4676
-
\??\c:\tbhntn.exec:\tbhntn.exe163⤵PID:4040
-
\??\c:\ppjdp.exec:\ppjdp.exe164⤵PID:896
-
\??\c:\lxrrxfx.exec:\lxrrxfx.exe165⤵PID:960
-
\??\c:\nttnht.exec:\nttnht.exe166⤵PID:3264
-
\??\c:\1jdjv.exec:\1jdjv.exe167⤵PID:3880
-
\??\c:\fxrrlxr.exec:\fxrrlxr.exe168⤵PID:912
-
\??\c:\flrrllf.exec:\flrrllf.exe169⤵PID:1664
-
\??\c:\hbnnhb.exec:\hbnnhb.exe170⤵PID:4108
-
\??\c:\vpvpp.exec:\vpvpp.exe171⤵PID:3956
-
\??\c:\xflxlll.exec:\xflxlll.exe172⤵PID:4476
-
\??\c:\nnhbnb.exec:\nnhbnb.exe173⤵PID:5032
-
\??\c:\3hbnhn.exec:\3hbnhn.exe174⤵PID:4396
-
\??\c:\1pppd.exec:\1pppd.exe175⤵PID:656
-
\??\c:\lrfffff.exec:\lrfffff.exe176⤵PID:384
-
\??\c:\lrfllrx.exec:\lrfllrx.exe177⤵PID:4556
-
\??\c:\5thnhh.exec:\5thnhh.exe178⤵PID:4748
-
\??\c:\pdjjp.exec:\pdjjp.exe179⤵PID:4348
-
\??\c:\llrlfff.exec:\llrlfff.exe180⤵PID:3840
-
\??\c:\lfllffx.exec:\lfllffx.exe181⤵PID:2692
-
\??\c:\bttnnn.exec:\bttnnn.exe182⤵PID:1700
-
\??\c:\pjpdp.exec:\pjpdp.exe183⤵PID:1568
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe184⤵PID:840
-
\??\c:\nnbttt.exec:\nnbttt.exe185⤵PID:2176
-
\??\c:\3nnhhn.exec:\3nnhhn.exe186⤵PID:2304
-
\??\c:\pppjd.exec:\pppjd.exe187⤵PID:4620
-
\??\c:\lxxlflx.exec:\lxxlflx.exe188⤵PID:4628
-
\??\c:\tntbhn.exec:\tntbhn.exe189⤵PID:1076
-
\??\c:\pjjdv.exec:\pjjdv.exe190⤵PID:4568
-
\??\c:\vpvpj.exec:\vpvpj.exe191⤵PID:4824
-
\??\c:\rrxrrll.exec:\rrxrrll.exe192⤵PID:4652
-
\??\c:\btbbtn.exec:\btbbtn.exe193⤵PID:4112
-
\??\c:\vdpjv.exec:\vdpjv.exe194⤵PID:4016
-
\??\c:\jvdjp.exec:\jvdjp.exe195⤵PID:4592
-
\??\c:\lxlllrr.exec:\lxlllrr.exe196⤵PID:1840
-
\??\c:\1hnnbb.exec:\1hnnbb.exe197⤵PID:4084
-
\??\c:\jjvpp.exec:\jjvpp.exe198⤵PID:3020
-
\??\c:\xfxxxfx.exec:\xfxxxfx.exe199⤵PID:3460
-
\??\c:\ntnhtn.exec:\ntnhtn.exe200⤵PID:1272
-
\??\c:\djdvv.exec:\djdvv.exe201⤵PID:1112
-
\??\c:\rxfxlrf.exec:\rxfxlrf.exe202⤵PID:1608
-
\??\c:\nbtbhb.exec:\nbtbhb.exe203⤵PID:2572
-
\??\c:\jdjdd.exec:\jdjdd.exe204⤵PID:2184
-
\??\c:\xfrxxxl.exec:\xfrxxxl.exe205⤵PID:2000
-
\??\c:\3rlllll.exec:\3rlllll.exe206⤵PID:3628
-
\??\c:\bthnht.exec:\bthnht.exe207⤵PID:5056
-
\??\c:\ppjdv.exec:\ppjdv.exe208⤵PID:1792
-
\??\c:\flrfrxf.exec:\flrfrxf.exe209⤵PID:4128
-
\??\c:\lfffrlx.exec:\lfffrlx.exe210⤵PID:2108
-
\??\c:\bbtbht.exec:\bbtbht.exe211⤵PID:3240
-
\??\c:\jvvdv.exec:\jvvdv.exe212⤵PID:2880
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe213⤵PID:3652
-
\??\c:\tbtthb.exec:\tbtthb.exe214⤵PID:4292
-
\??\c:\vpvvp.exec:\vpvvp.exe215⤵PID:2248
-
\??\c:\frlrxxx.exec:\frlrxxx.exe216⤵PID:236
-
\??\c:\nhbttt.exec:\nhbttt.exe217⤵PID:4056
-
\??\c:\vpvpd.exec:\vpvpd.exe218⤵PID:4408
-
\??\c:\xlrllll.exec:\xlrllll.exe219⤵PID:3312
-
\??\c:\xfllrrr.exec:\xfllrrr.exe220⤵PID:3196
-
\??\c:\bthbbh.exec:\bthbbh.exe221⤵PID:2076
-
\??\c:\nhbbbb.exec:\nhbbbb.exe222⤵PID:1020
-
\??\c:\pvvpp.exec:\pvvpp.exe223⤵PID:3540
-
\??\c:\rflfflf.exec:\rflfflf.exe224⤵PID:1328
-
\??\c:\bnhbbb.exec:\bnhbbb.exe225⤵PID:1932
-
\??\c:\dpddd.exec:\dpddd.exe226⤵PID:4344
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe227⤵PID:1896
-
\??\c:\7bhbbh.exec:\7bhbbh.exe228⤵PID:1148
-
\??\c:\tnnnth.exec:\tnnnth.exe229⤵PID:2672
-
\??\c:\1pppj.exec:\1pppj.exe230⤵PID:3888
-
\??\c:\lxlffll.exec:\lxlffll.exe231⤵PID:1588
-
\??\c:\bhbtbn.exec:\bhbtbn.exe232⤵PID:1236
-
\??\c:\pjvvj.exec:\pjvvj.exe233⤵PID:2436
-
\??\c:\pjjpv.exec:\pjjpv.exe234⤵PID:3248
-
\??\c:\xxrrlff.exec:\xxrrlff.exe235⤵PID:1836
-
\??\c:\ttnnhh.exec:\ttnnhh.exe236⤵PID:4340
-
\??\c:\bbhhnn.exec:\bbhhnn.exe237⤵PID:2384
-
\??\c:\pjppp.exec:\pjppp.exe238⤵PID:3724
-
\??\c:\llxxllr.exec:\llxxllr.exe239⤵PID:2556
-
\??\c:\nhnnhb.exec:\nhnnhb.exe240⤵PID:1440
-
\??\c:\tbhhbb.exec:\tbhhbb.exe241⤵PID:860
-
\??\c:\dvdjd.exec:\dvdjd.exe242⤵PID:1452